{ "Event": { "published": true, "date": "2023-06-23", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-06-23", "timestamp": 1687564982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d00f106b-e3fa-40b0-b491-747c6e2af64d", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b271ab0a-1191-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687502795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502795, "uuid": "deeb471d-3021-4c9e-bae5-30cf47a86b5e", "comment": "Malware payload (RedLineStealer)", "value": "772b61451a0e388ff34e69c1ad5b832f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502795, "uuid": "42a5441d-b0c9-46fb-8073-0a65b0239101", "comment": "Malware payload (RedLineStealer)", "value": "001c9740d82d824844f9985955012752ab2b75c4d6ac7397062a5971364232df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502795, "uuid": "fa7c6e3f-bbc9-4a3c-b70b-07be34214a89", "comment": "Malware payload (RedLineStealer)", "value": "46863f84b87e1c4342f4a1b6cf2358989a33d81d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502795, "uuid": "e0e72305-dc90-44a0-a608-d65123308563", "comment": "Malware payload (RedLineStealer)", "value": "8716f098809c058bc2e14584371e68d6062375fe291bd0fd82ebc47bdf0a74bccd3d4aa79c344fdda15d09fc086c7294", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502795, "uuid": "8469989f-de75-4984-a6aa-fa0cdac30629", "value": "T1F6443BFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA284CA19BA0952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502795, "uuid": "f87f57b1-10f9-4ffe-98be-cce0b0d5bbd6", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502795, "uuid": "440b4ef1-bd5c-43a1-9b83-5d6ec281565b", "value": "6144:q0ueQ8igt0poiRG/XvLNUgYhuE22PcQJQmL:q0ueIgtAoiRG/fSvXcQJQmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687502795, "uuid": "d913f7e9-05af-410d-bf9d-61fd52200b77", "value": 276293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687502795, "uuid": "01be66f6-2734-4fe4-810e-3018a985a382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502795, "uuid": "476c4f89-95eb-4eb6-8307-b26a7bacf48c", "value": "772b61451a0e388ff34e69c1ad5b832f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6e0ee0-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687510333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510333, "uuid": "75a9f6f2-2f71-453c-aae6-636d2afd7363", "comment": "Malware payload (RedLineStealer)", "value": "4e8fbee499ba111dd1a839356c4e3ffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510333, "uuid": "0dda915a-46f5-4fc1-9c83-c77d1f21dae3", "comment": "Malware payload (RedLineStealer)", "value": "009216f8902e8c8bdc21572a2f33fcb40a72401d93124b7629dc5d2341bef653", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510333, "uuid": "df3fd303-70b2-4b14-a747-e6de7923df4d", "comment": "Malware payload (RedLineStealer)", "value": "a36d334c1fffe36683892a5aca70ccbcd19cb1a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510333, "uuid": "f020e393-ccd6-4362-b221-62b65602c2b2", "comment": "Malware payload (RedLineStealer)", "value": "20897aeac37bb0c77e13d69088acfa6c314043ca0e46615321f290fce9532aaa41a2dbe4e0ce0980647276e3884706a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510333, "uuid": "ee77421e-cdc9-4762-9cc8-d064eb75b1a1", "value": "T1ECB4F1CA26404973CF23CEB1D4EBE9D68E7A71210B714BC7230C59F64A156D0E61B97E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510333, "uuid": "64ad92b2-7ad8-41bc-b834-0d38b7016505", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510333, "uuid": "3fc7494b-972d-451e-bfaa-1771c6e91f97", "value": "12288:1S9k7idTey5sg+17gKaPgqbT8cqORT6ZQovQJQmZ:g9k7mTey5sgkgeqf7qOc+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510333, "uuid": "0d86f4c6-d6b8-4767-85b2-b9d75056ab97", "value": 540992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510333, "uuid": "f8f758ea-c49b-4ce9-bbf4-4c01f2adcb63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510333, "uuid": "e4b13c92-3739-4ea1-9acf-2611d8ccc590", "value": "4e8fbee499ba111dd1a839356c4e3ffd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932291d2-11e3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687537961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687537961, "uuid": "531ed59b-864e-476a-9075-6cb89155e127", "comment": "Malware payload (RedLineStealer)", "value": "afc5d13b304bc668c3e1034b969a50c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687537961, "uuid": "44db4029-a021-4318-8bf9-e855bbe17e4a", "comment": "Malware payload (RedLineStealer)", "value": "00ac09e692560f5467ce94608a9199dbf5f1919bc5cb48c068cf2ff5f9393d02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687537961, "uuid": "d15546bf-6651-4c83-879c-05d3a720d76f", "comment": "Malware payload (RedLineStealer)", "value": "37a4f6a3aecec6a5f2c30f9779d1148097147386", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687537961, "uuid": "014cccd4-fa43-4ce9-a5b0-b05060c18a53", "comment": "Malware payload (RedLineStealer)", "value": "6bd42e3dfa295d22194787684eaf1d9425c6c5cd31f6d6752313a4e778ef1a7e0ae2807333420de4139569da39445fce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687537961, "uuid": "96a62168-e0f9-4acc-ad9e-4b43e02294e6", "value": "T12B1611782215D6BBD7C32871E853900F082A25B26ADFB9993797CCF619A35BCC474BC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687537961, "uuid": "9f26c760-6397-499c-b79a-41e4a7684482", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687537961, "uuid": "9e6758a2-e77f-460a-8f75-0aa89030dc75", "value": "98304:K53Jczb8Iy8CG4/KR6rB//2g+lyvA9Dzp+tUJ25/2du5DXCfUPi4uITD2ANBTtuT:kezb8NHG4/KkBH23lyvYzZJknYeqITD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687537961, "uuid": "54aca692-b372-4a41-b20a-23eff9430c36", "value": 4110336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687537961, "uuid": "394cf069-d328-4173-8b21-4231f51e5b33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687537961, "uuid": "5bc7fd95-b395-46ba-97d0-49609942b8ad", "value": "afc5d13b304bc668c3e1034b969a50c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce94ce0-117d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687494276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494276, "uuid": "0457d09a-9e2b-4598-9476-2d67bc7a0cc6", "comment": "Malware payload", "value": "d8c769292497bbf67425b0ee83053664", "object_relation": "md5", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false }, { "name": "sconengr-com", "colour": "#A461B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494276, "uuid": "49105849-95c5-4a80-b542-f0685c0259a1", "comment": "Malware payload", "value": "03377b5ac5da038cd277b4daff732974eb59797d167ff270b93edb0e52ddcfd2", "object_relation": "sha256", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false }, { "name": "sconengr-com", "colour": "#A461B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494276, "uuid": "3268bade-4cac-4183-8cec-10a3d0cc652a", "comment": "Malware payload", "value": "af86ce737e640199f4cbba428981c1af8aa96c6b", "object_relation": "sha1", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false }, { "name": "sconengr-com", "colour": "#A461B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494276, "uuid": "10b51029-2916-401b-8f7f-afbbf006d442", "comment": "Malware payload", "value": "917ab0c5cddb386617631e77cfc0f7863b847a644c6137abde4a7c2ce1ade8305238c6a324dcaa1dc9247828ef1d5968", "object_relation": "sha3-384", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false }, { "name": "sconengr-com", "colour": "#A461B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687494276, "uuid": "20422987-a6bc-47c8-a8da-7b1e7ebfad9b", "value": "T129B4232D2D377A5780D3AC74F655C89247BECD06E8B542BAA241C685ABC31EC6134BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687494276, "uuid": "d1ebd878-ca2b-47d9-931f-d06f05c3fa0d", "value": "12288:qm3vTV+xXu05mQEGLC2gtWnnAISxg/NtWau+paHzx:HvsR5mQEGJnAvaNtWt+wHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687494276, "uuid": "a17b9fa2-a12d-4525-aaca-f1e3a6dcc1a9", "value": 542533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687494276, "uuid": "f4dea050-92da-40f8-ac92-48df496c9092", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687494276, "uuid": "94254304-3353-4fe3-b173-820392588695", "value": "Revised DEBIT & CREDIT Notes_Reconcilation .r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4842b7-115a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687479186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687479186, "uuid": "88e8585d-35b0-4ce4-844c-02873405cd07", "comment": "Malware payload (Quakbot)", "value": "92ce4b719618935d8dae0fbc6ceab12f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687479186, "uuid": "ecb15b51-e2e9-4fa5-859c-a486fd071e3b", "comment": "Malware payload (Quakbot)", "value": "03d62c7a36cf24c12607751d0af3b178bb6bf238091e5bd362363f9717f526cb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687479186, "uuid": "df6c7562-b255-4c63-9d45-048ff01e2cce", "comment": "Malware payload (Quakbot)", "value": "4d88402b354b9d732ac50804e8e12c618602be3e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687479186, "uuid": "85c706d0-e4ec-4861-ad82-4bd1152314f3", "comment": "Malware payload (Quakbot)", "value": "19cbbe452b82d20c5a06419323db71be44ac1197cf3b9a0bf55bb5e31b73c372d469ad9bad5bdd3bd91540f6235dd009", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687479186, "uuid": "0a08bb12-0dfe-44a5-91eb-3eb950b4f26b", "value": "T17D74496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687479186, "uuid": "8dfd9bed-f39b-425b-bb84-33373d7b373c", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593O:fIS1xb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687479186, "uuid": "80353680-fba6-4a92-8073-dc53f6148766", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687479186, "uuid": "62e1421b-f2a3-4275-93f2-1840cb117969", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687479186, "uuid": "17ba1e73-2be8-48b2-94b4-a801f2f34557", "value": "BSN-102185964.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c94621-11bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687522511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522511, "uuid": "6bc531c5-9c27-4266-a0d5-43c0fbb639c6", "comment": "Malware payload (Formbook)", "value": "ac55edeca30c574480a1b7ad005f68f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522511, "uuid": "e0da7edb-68bf-43ca-aed4-a7aba3bde1f2", "comment": "Malware payload (Formbook)", "value": "0434b553716106cbc769d01e7c12768bcd0d445f2bdb25ec4bbb6568f5188d28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522511, "uuid": "22f195b5-1c83-420c-859f-40e8fc7ff222", "comment": "Malware payload (Formbook)", "value": "a5bd84034ad6021dd66256a870fad8ba245ba6e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522511, "uuid": "03d5ca31-329e-4708-9f03-bb20d3c95983", "comment": "Malware payload (Formbook)", "value": "107f7fe822df17d67c5728ace008841db83d7a7ebc75eec31e291d3ffd2fbdb91ef28c0e8683c24bbe156d4014107835", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522511, "uuid": "95a07921-f87b-4024-a5f6-9cb548ff738c", "value": "T134D4231032E41A32E1704BBA38C3553593B9A7556A12DBCFADEE74D12CE374426837AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522511, "uuid": "197e29cc-e309-4788-b567-8d2cc3632626", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522511, "uuid": "e634a377-1c91-4e1d-92bf-41e0e50f1274", "value": "12288:ok54/mNUAO98EmMA+y0hU1rTI05HvhUSP6JIXVJQ7UTUF4z:ok54/QUT9y+lU1ZHvhUSP6elGUgFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687522511, "uuid": "a42d3eb7-1f43-45a8-9c07-8751bedbfcf8", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687522511, "uuid": "36a0e716-f3a2-4c70-815b-3a15119fbcfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522511, "uuid": "a89a3e60-1cb6-49ab-b84e-67674c42cbd1", "value": "rTRC-SCAN00001_TRC-MTC-BLC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c303d1e-11cc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687528044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528044, "uuid": "9979d220-f9f4-4c29-bd92-9154754707dd", "comment": "Malware payload (Amadey)", "value": "c2630733eb1c69fb83a1f6f6d8ab40b1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528044, "uuid": "5d547a79-65e3-4e5f-afee-c75df27a44bf", "comment": "Malware payload (Amadey)", "value": "05bb813eb2649566be47fefc56da3ad7b01409edb0bf682bd41ce21e4e3635be", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528044, "uuid": "90e76cb0-3bda-4939-9dcd-0a081ef58b4e", "comment": "Malware payload (Amadey)", "value": "539e46da19ad3759db60089fef6b56cb93e17caf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528044, "uuid": "61873f99-4dad-4687-a838-cacca8e30573", "comment": "Malware payload (Amadey)", "value": "1bbfc166daebaabddcae898e6c2b46826ca849c1463965e00fb032528e6e425f1cf5cc558bf164de81e4d5c2fbacba62", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528044, "uuid": "ff2fedb3-11ba-4a47-b0d9-812c19743d8e", "value": "T1C51612752200D6BBE3D32971E453900F0C1AA8726AEFB99977978DFA09631BCC475BC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528044, "uuid": "08e766b3-2146-4fca-bed1-7c6bc1196fb8", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528044, "uuid": "db35c05a-e0a9-4523-8282-5c30acfcd8f8", "value": "98304:tFsizgcghVkP8BWAEop4bjQbmzHf5KDICjENBL10dnYvDzZP8UkaYxmDfm:4izWLkPo4bMyjf5KDIFNBCdYvXxEmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687528044, "uuid": "fea6b2aa-0896-4d92-8419-4702e5470ce6", "value": 4103680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687528044, "uuid": "50bd18cf-98d6-4498-8901-8b033c6cab04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528044, "uuid": "42cf3669-d8b8-4df5-8459-7b42457a8da0", "value": "c2630733eb1c69fb83a1f6f6d8ab40b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b54b884-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500985, "uuid": "3263c7ff-009c-4426-9771-f60dd3f8fe00", "comment": "Malware payload (RedLineStealer)", "value": "c8d3fd71478299e2828af83d9f549632", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500985, "uuid": "a00c3476-5199-4a90-893d-b489d9d618c0", "comment": "Malware payload (RedLineStealer)", "value": "06601632273040ad2ee841bf423a74db85365603c5d816e7ddb663481ec42898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500985, "uuid": "37cda392-3a09-4239-a39f-5ac7fabb8383", "comment": "Malware payload (RedLineStealer)", "value": "9b3ba583c7f29c4813d2c5d3b5e8581c8e66eece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500985, "uuid": "5def2d85-5a12-4a3e-9cc5-e7e96acbe533", "comment": "Malware payload (RedLineStealer)", "value": "0b3868c6326946231d717ae13f66c85cecf4bdca9a54c1bfdfa638852d85de8bf9ba7523a38f150539bf37f0afcb58e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500985, "uuid": "2f8da3bf-443b-4d3e-8ef3-dfbbeb6c65fa", "value": "T1D3B401CA61804573CF63DDF2D4EFEAD30E3A31210B654B87120C99F54A462E5E61B67B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500985, "uuid": "76c9c439-11ef-4a5b-93ec-2a8ce3014ad2", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500985, "uuid": "49fc79e1-0f8a-40dd-b8e9-00de2152d7ad", "value": "12288:OqmNpTey5stQNQ/Gb+uopX8j3ocDcCjp5qFQJQmZ:OqmTTey5staQ/iWXW3DcCjp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500985, "uuid": "b98e1db9-2620-48b6-af10-52f49f8fc62b", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500985, "uuid": "d2347416-4cca-49d8-a7fc-7f3258025246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500985, "uuid": "f8a2c7ad-6047-4845-9f24-7dd2360b3ba7", "value": "c8d3fd71478299e2828af83d9f549632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7671a5b3-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500977, "uuid": "56c740dd-2a5b-4867-b069-73203903f350", "comment": "Malware payload (RedLineStealer)", "value": "ca70ac7e2f591d465429bcc7d134aa54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500977, "uuid": "3081732b-bd3b-49bd-ba6f-e6a19744060e", "comment": "Malware payload (RedLineStealer)", "value": "068851f56cc4b39c3582a29ca7739eaa9a9684e79da3082efae961e90ee3b167", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500977, "uuid": "0959c3fc-0817-4135-a238-94fc61350779", "comment": "Malware payload (RedLineStealer)", "value": "d7b55e1783e8c134b7072f2eeebb70221846298c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500977, "uuid": "f5a93d5c-c570-4dc3-af70-1d9e7a3d7d0c", "comment": "Malware payload (RedLineStealer)", "value": "6941f0d0d9a269ff936568359dfa8c16e11a8947c56ed1d4b7a428750e070134ebc2bf7f88151c801550df1fe50a8958", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500977, "uuid": "72887be0-0cb3-4b80-ba9b-84d9f4e5b5ec", "value": "T1D7B4F1DA75804573CF63CDB2D8EFE9C64EBA71224B624B87120C89F98F455D4A21B43E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500977, "uuid": "08cf01e2-8a98-4562-971d-ab868904a70b", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500977, "uuid": "51b47deb-63c9-4947-849f-0ac070a7bdf8", "value": "6144:qD4U+jmvhjJuqwePpsyJfsbTN0HCWirf0Dgno6L4KtYLCVOThlpESWe2QJQmZ:qEU+aLTey5saHke6LXtchySR2QJQmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500977, "uuid": "85579c27-e8f4-49fc-ad2c-e7b56ea5a610", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500977, "uuid": "18408e6a-890c-41e4-8ab1-8da8858c7e85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500977, "uuid": "29ca6216-2877-4d11-8c1e-ba363404012d", "value": "ca70ac7e2f591d465429bcc7d134aa54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ec501b-1159-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687478850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478850, "uuid": "07197ce5-3b58-4244-9248-c027ce247a93", "comment": "Malware payload (Quakbot)", "value": "4f3931dbb9d2ad456923ccc9e8342490", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478850, "uuid": "94d5fb14-9626-4f21-98d0-f9c73373916a", "comment": "Malware payload (Quakbot)", "value": "06a141ccd79b1d5010adeaa80e49fbe8f13d99269980598590597c81fd31991e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478850, "uuid": "2c6f3869-ad71-4627-a78e-0619df269562", "comment": "Malware payload (Quakbot)", "value": "35fd61c75a2a5e95081336a136469e384c7eb92d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478850, "uuid": "4a32fdeb-1cb5-4104-a8a1-18684b13e525", "comment": "Malware payload (Quakbot)", "value": "2a889b89b9131c965fd9dfc34c2dfce5b123cb6584ecc9e5949746d5683c1aaa169fa66d6a29bade6059e7a10d80e9d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478850, "uuid": "d3171e41-7346-416e-a4ac-6c4873d10c8e", "value": "T199558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478850, "uuid": "330a327f-270a-4d4f-8774-65026b8490e7", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478850, "uuid": "1e7d3d8f-d01b-4f39-a8e9-7feac440eca8", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4y4Q:QbkS7XB1EsOSNPSp0EAt2bUeM4y4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687478850, "uuid": "cbd79c5d-1711-49d0-82ff-493279ed91fe", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687478850, "uuid": "c8785cfd-0660-412e-852d-32ddba0c43c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478850, "uuid": "f4b2999a-4d7e-46da-8325-94086928b1d4", "value": "02qbot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32db9866-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501293, "uuid": "7cdc46e0-28ec-42d3-b0f9-7d4417f79f95", "comment": "Malware payload (RedLineStealer)", "value": "de74c3f7e740c6bf0f80275bba2fa4db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501293, "uuid": "6c41315b-2879-4cba-84be-8329a9eea53c", "comment": "Malware payload (RedLineStealer)", "value": "078136143c33d4a5a0d1c3302e8e0ccdf4c6d5e93890d05311c973df63d610bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501293, "uuid": "fbc346f1-f97f-4548-96e9-3e818ea711d7", "comment": "Malware payload (RedLineStealer)", "value": "8eb47cb144a9ef1595c7781d8f5000d0f17287af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501293, "uuid": "3864672f-ab2a-43f6-bc55-77c1a3398566", "comment": "Malware payload (RedLineStealer)", "value": "eeb2c66765c29299e6335d96c3f19ebb9d30f9c7216596c5b531bb381978178976237c24f4730212c39917d4d71fbd68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501293, "uuid": "764e825a-c1fe-4760-8b10-2acb996ec62f", "value": "T104E412CE75404533DBB7D9F2C8EFE9D74E7A7122076007C7120C9AF49A886E4A91B17A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501293, "uuid": "59acb8ec-f44d-41a9-8abd-f5fef3af1082", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501293, "uuid": "f53bbc73-a535-4e09-81ea-b9b7f27d9df5", "value": "12288:LI1bCTey5sqO/ZNlLokvY+hbiss7LIPXw784SaF8D1fEcBRWeMc8Jp944QJQmZ:LI12Tey5slYqPsIPS7SaF48eT8D9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501293, "uuid": "9c19d217-b400-4e7a-95b0-387195e7f210", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501293, "uuid": "fafa6151-bda0-4459-87e9-f5a98017a04f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501293, "uuid": "2d233838-d4d1-45f3-ae18-0a54cd0bd0e8", "value": "de74c3f7e740c6bf0f80275bba2fa4db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc0d9f9-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499135, "uuid": "32ebfaca-5ecd-4649-8096-fb649c6f054e", "comment": "Malware payload (RedLineStealer)", "value": "0f7bd72d1d79184082b1a262a6533634", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499135, "uuid": "4ba7ceb7-bcbb-4664-a489-132164d34968", "comment": "Malware payload (RedLineStealer)", "value": "0794d2dc6d953bf92144011cca502d9d0ec407be9f3df15df37ab58b7829dabb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499135, "uuid": "07db03ca-8a71-49d8-828c-e7745d4acd77", "comment": "Malware payload (RedLineStealer)", "value": "f9eb998804723be1618c414d9280e169f6ca6d72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499135, "uuid": "9ce40db8-b6f2-41cb-ae19-c026827b3d47", "comment": "Malware payload (RedLineStealer)", "value": "fdc9bffa7408796a234009241ba3a84d2ad1f35b02480f2f319094e836e04d4e5b01ece6397accffd1d172ae5314286a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499135, "uuid": "a641bf4d-0981-44a3-aff9-8844a7a8cddc", "value": "T199444CFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA284CA19BA0952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499135, "uuid": "a7784533-d799-45c6-abe4-697300b1e413", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499135, "uuid": "f3b625ca-f1ce-4e25-a5e1-0b2b0a01185f", "value": "6144:ae1DT8igt0poiRG/XvLNUgYhuE22VQJQmL:ae1DHgtAoiRG/fSvtQJQmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499135, "uuid": "db420921-958b-43d6-b0a4-d2aee684de62", "value": 276293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499135, "uuid": "d88e5c68-eb96-4f08-b283-d37876a93e13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499135, "uuid": "c59fc4e8-5d3e-42ac-bf80-6f435b369459", "value": "0f7bd72d1d79184082b1a262a6533634.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd8e492-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500667, "uuid": "14d9022c-e6f8-4e32-b8f9-813469ec1a75", "comment": "Malware payload (RedLineStealer)", "value": "a716cef743df9b026a2716022916dae0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500667, "uuid": "d6b82f22-8d0b-40bf-a2ae-e3a8290075dc", "comment": "Malware payload (RedLineStealer)", "value": "08371e805c76119787c6d84ee44f45a347473c676cdb5c0ab9e0cc8382371a50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500667, "uuid": "eed99db2-9595-4d93-a21b-65fa2af97fc8", "comment": "Malware payload (RedLineStealer)", "value": "95725dd8842cf0f10b76eac692a7a82728f90dd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500667, "uuid": "390cd79a-764c-44e2-bd4a-ea9f82db4e99", "comment": "Malware payload (RedLineStealer)", "value": "5a366b86c9e41e4c7640a309598932308ae284e1691fc8149e611c998c3cdd14c4430f75f73c9237584456991bfb5cb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500667, "uuid": "d00f6898-00ed-414f-a7bd-f3173d132e55", "value": "T160B4F1C625804973CF63DDF1C4AFE9D68F7A70210B750B87130D9AF98E011E4A62B47A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500667, "uuid": "f6e1786b-af7d-4427-a11a-8aac47c64fef", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500667, "uuid": "b4efe98c-f164-4d99-9358-d4ec1a1d09a6", "value": "6144:JaCBVRkvha3JuqwePpsyJfsohmCLQ5v+L2/34ye+QueZI07T/t1/SfpBQJQmZ:8CBVaSTey5s0PLQV34LJ1afpBQJQmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500667, "uuid": "92dc2809-845f-44a2-8b7c-e563fe472fb1", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500667, "uuid": "87f3e000-01f3-468f-a6ce-c707abbd74f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500667, "uuid": "daccc19c-a393-4b1f-98ba-2e4dcab842e9", "value": "a716cef743df9b026a2716022916dae0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691dee8c-1192-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687503102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503102, "uuid": "244ae29e-c889-4e13-8730-1fa2a91cb2a9", "comment": "Malware payload (RedLineStealer)", "value": "22e12c6584a91ededf0c2b23e681a47f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503102, "uuid": "d2dabe37-2e95-450f-a458-e5b582141fa2", "comment": "Malware payload (RedLineStealer)", "value": "0876c8cfa6fce7ba925879cf54cfc3e5e8dbd4ab75b8d272ec811181bca1d4df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503102, "uuid": "08a2a4f0-af86-4444-bb33-b6ab42df99d8", "comment": "Malware payload (RedLineStealer)", "value": "743b67f04991dfd00684c4c7bb0e160091345375", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503102, "uuid": "d0716950-f1f0-4be3-bdc6-f057c65d6593", "comment": "Malware payload (RedLineStealer)", "value": "6bf4022db9e261329ed048d4b3b34613443a056f5a87d8eb8fd83646daea2b1fe46f20fd4197825342ade5fe0304e1f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503102, "uuid": "b617e282-0969-4f7d-800f-580b0a7a8a29", "value": "T17DB4F1CA25404973DF63CDB2C4EFE9E65E7A603207710BC7230D5AF58E426E0A61B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503102, "uuid": "bdc52db6-0771-4d42-b2c0-c6b434d9bec6", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503102, "uuid": "3e99ba3d-ef69-46ad-8a03-a31908424f91", "value": "12288:Ck76RTey5sJg5/8D+v+va1eF+cRDdtpwQJQmZ:Ck7+Tey5s65kD21xoDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687503102, "uuid": "a4bbe4c9-94e5-4915-a140-9f70fffe0a46", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687503102, "uuid": "8bd65bdb-851e-47d4-87ae-2cf0a58af9e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503102, "uuid": "9d9d7fc3-7c45-4044-8b17-2bc0254f1a11", "value": "22e12c6584a91ededf0c2b23e681a47f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78a3033-11bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687520950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520950, "uuid": "81318958-afe2-4261-9948-299cb6b3b8ce", "comment": "Malware payload (GCleaner)", "value": "cde75d2ae1cd492bb85bad660070d153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520950, "uuid": "ffa00c55-8ca1-4158-bf93-91cb0b8cbaaa", "comment": "Malware payload (GCleaner)", "value": "08a561a57f90aa5c8e5e5f0d58f7294f9c7098c086e42c16d2f2776fe6c3360a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520950, "uuid": "e0881633-c35b-4858-9b5a-93cd480359fa", "comment": "Malware payload (GCleaner)", "value": "748d172b9113221c661f8a5441042b5dbafcf75a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520950, "uuid": "7aef2100-b6a4-4660-b3aa-a4ef3049cc93", "comment": "Malware payload (GCleaner)", "value": "783652b6a906fc3491009aafac86984eea4b4b157c066fe2c7f62f76b5fb1860780e2c49aa1f00818c86597e494fb44b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520950, "uuid": "989c9a7e-bbb9-4a90-92b9-aacbb3ef9371", "value": "T156949E03B2D17C61E925DA728E2EC6FC661FF1604F197B9E66584A7B0A701F2D233316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520950, "uuid": "09b0a814-17b5-4fe1-a318-aa8fb0df5d31", "value": "07720bcaa56246faffb2a5e7dbc39f3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520950, "uuid": "fbafab6a-2371-423b-aebb-01d9d6bc1144", "value": "6144:rVma8Re27srKC2Jxjor8rMxdtUve8ARh+p0BZNH3jnh+cjC9mUWpP:yRe27srj2JxBwxLUvQXBZNH37hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520950, "uuid": "cc9ee456-5f07-46c0-aab6-d5153bdd90bc", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520950, "uuid": "f5d40760-eea9-4306-95f4-b050fa025ca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520950, "uuid": "2d445f43-86b3-4a67-b4d5-c78947e46077", "value": "cde75d2ae1cd492bb85bad660070d153.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af2d114-11ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687540927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540927, "uuid": "6fad6646-11c6-4252-b8fc-c481e833c5d9", "comment": "Malware payload (Quakbot)", "value": "b22ad38812d6d62a38f9da89cbe6e233", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540927, "uuid": "f9896021-d40b-473a-b669-d5c262242cc2", "comment": "Malware payload (Quakbot)", "value": "08c0af563c8c08323c195eea2068b45694d4bf83e7e4d637924cc67e4bf9806a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540927, "uuid": "83f89fac-bb00-4290-bade-fd0dd71e7388", "comment": "Malware payload (Quakbot)", "value": "b96a56963ce9c0592c5a043de367039ed099f96c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540927, "uuid": "cceba8bb-561e-4a71-a15c-c4d5f5dca170", "comment": "Malware payload (Quakbot)", "value": "4a2338419d697e4e3021c0e7331cbcc4e41f443e33da5279e9599339c6f7f523c8ce27ac70564f00a1d44de31d1cc360", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687540927, "uuid": "ad9660af-4c3c-4137-920f-bc9cb5462e2c", "value": "T12774496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687540927, "uuid": "ec852f86-3628-46b1-8272-3b10a5c58838", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593C:fIS1xbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687540927, "uuid": "5c7068e7-a175-4505-9b38-f8b25cb7e1d1", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687540927, "uuid": "30cce936-c0a5-4480-b63d-bcb21905d4cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687540927, "uuid": "490305cb-d352-4bc6-8b4b-1797baca4344", "value": "BSN-113267659.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a2ea30-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499121, "uuid": "ad56d098-fc16-4dbc-bd15-4700442a6840", "comment": "Malware payload (RedLineStealer)", "value": "1079e87b9a6cb20d85f5b56d19a9d456", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499121, "uuid": "598aee89-6fd2-49d1-a2e4-02abf9e8756e", "comment": "Malware payload (RedLineStealer)", "value": "09c98929d27c0fd2df66d9ac1e905bc5f73a8758827c58f5f079f7677f766ccc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499121, "uuid": "38c64758-3aa9-4f01-9539-dedcd737c837", "comment": "Malware payload (RedLineStealer)", "value": "82622af2ff472796dd8653101afc95d698df200f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499121, "uuid": "69681024-71df-471c-a6b9-94edbe8f9885", "comment": "Malware payload (RedLineStealer)", "value": "c10dc87a5107bd3dab8f47b7612e9a94f1092971a0e0e9bd5d2b0e2b2c929d6bbc937d2e8c9164d334c1b95ff6ee6321", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499121, "uuid": "177c52e2-b034-4ee2-b327-39d4494c7d45", "value": "T12AB4F1DA36400AB3CF23DDB294EFE9DB4E7A71210B7146C3120C8AF54E551E4A52B97E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499121, "uuid": "cb828e84-ed34-41d1-802a-3bb4acbd7b22", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499121, "uuid": "f8eda28d-d501-4801-891d-a98709bb91da", "value": "12288:DWkvHXTey5sG7NQJMlgZ9LmPrjXPlVKhQGMtP18M+QJQmZ:DWkv3Tey5sKQJMqNmPrxchQGFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499121, "uuid": "124727e3-0000-45c8-971b-12e7ccd48c56", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499121, "uuid": "1abc5f93-60b1-405e-91a7-e0a6a6212f35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499121, "uuid": "127e23fd-c3b4-48cb-9548-8cc14ca2be41", "value": "1079e87b9a6cb20d85f5b56d19a9d456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b5397c-1188-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687498823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498823, "uuid": "3bdbdb69-13a9-4318-acf6-53237749485c", "comment": "Malware payload (Amadey)", "value": "0e235f11a213d220f3e0051d5b5e5433", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498823, "uuid": "1aee44c4-a070-44bc-af98-c9e6d7154f83", "comment": "Malware payload (Amadey)", "value": "09cd2877af7dd0d44aee7ca23b52e6a8b7fd5b4aec6493c2dba2ad286df056cd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498823, "uuid": "a29ad8c0-641d-4c68-bb93-bf3a6d09ce2b", "comment": "Malware payload (Amadey)", "value": "99a4b19514f12f0de4ab793b32c820c1c5a392b1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498823, "uuid": "10102206-7550-48a2-8426-51103a0ca856", "comment": "Malware payload (Amadey)", "value": "6a5fbfcc8861a343608d248c1901555deb2afb281e571059318af30944f383ced75c88076d7bec61ad7fd3ecd0cb29ed", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498823, "uuid": "2fa7a69c-1d16-465f-9242-0a9fd8ac2756", "value": "T1A0E401CA65804833DF77CDB1D4EFF8D64A7A62210BB64787120C4AF64E422D5E21B97B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498823, "uuid": "01c4400b-d4a8-4490-b11a-9e52840f656c", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498823, "uuid": "b89b8b24-c1bd-4b4e-94fe-cfbe45d33684", "value": "12288:TEr14Tey5s6iMsX+mRibC3lwpqhRiVZlwi2XtlRU4f3G2tqreEWQJQmZ:TEruTey5s6iMLYX3lNo/12XprLg6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687498823, "uuid": "da4db97c-8a8d-440d-a60a-daa2d537b8a5", "value": 714048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687498823, "uuid": "fa377be9-5936-4ca5-b296-3d781a25275a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498823, "uuid": "3304e3b7-aecd-4290-a861-03ae8f6d3756", "value": "0e235f11a213d220f3e0051d5b5e5433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555a7d09-11ae-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687515094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687515094, "uuid": "acda2d7a-eda0-4d2b-b1da-a73a0a535e6c", "comment": "Malware payload (AgentTesla)", "value": "8ad740c26f03cb48c8ffd56cea716d2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687515094, "uuid": "388e6d26-66a1-43b1-9c47-5dc520a9968b", "comment": "Malware payload (AgentTesla)", "value": "0a018efcff28dc535fa4b8fd73ae64de88ff7773116c41e265bc908bbcc6adfd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687515094, "uuid": "c4133985-95da-4369-84ce-68071e57400e", "comment": "Malware payload (AgentTesla)", "value": "612feb5b8faa726282618dbf5f428f88a5d685be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687515094, "uuid": "60d794f9-c27c-492c-b30c-92746e8eac63", "comment": "Malware payload (AgentTesla)", "value": "06b2ab880819522352c8a481de98852ade41d806eca1763b271e8428ebbfa32fb70b577e2e95a740c0e3f155dab4d5ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687515094, "uuid": "71e12f49-806e-4349-9afb-0486ec3cff3d", "value": "T15B5413597A90C47BF0B29E752D7A43AA3FC5E66650E8930F13580F0C3D3A2960A5F763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687515094, "uuid": "cc7f1aea-08f5-4546-8728-283efe2161ae", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687515094, "uuid": "1cacd6ff-d03b-417e-8e6f-089c8c2d2e37", "value": "6144:PYa6jE6RDZF9pwLRiI/7f8eiiUHUraREUVIrk:PYxEgl8R1g2rorp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687515094, "uuid": "30454b14-24fa-4b52-9079-d9aa1a4739b5", "value": 289175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687515094, "uuid": "71642dac-3367-4d6e-9e60-edaa733884ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687515094, "uuid": "4607f059-9780-4153-b335-d35abf884fc6", "value": "50% Payment Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146ed4f2-11e0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687536460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536460, "uuid": "449125fc-dace-4224-a290-2b4c6c880d01", "comment": "Malware payload (RedLineStealer)", "value": "abc9bf0c99b3b4feb28fcfde236f188f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536460, "uuid": "e7099d39-7ef6-4e6e-b4d5-67b9606584e9", "comment": "Malware payload (RedLineStealer)", "value": "0a6c17dc3eea59b75591030b0f8ce03b57a4e6ee017fba31bcfe85beffd523fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536460, "uuid": "b043e0ef-f5e2-475f-be01-5388a1aed50b", "comment": "Malware payload (RedLineStealer)", "value": "d84f9c9f49d2c05dc7f907556608ae6bb8c4df60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536460, "uuid": "dd0bbb80-b471-453a-a48a-79b2d2580ded", "comment": "Malware payload (RedLineStealer)", "value": "70726bb88f205fadc9d1d53fc16300a9f4e2c7b47e85e8002be222c8482d224cb29c04a4d42c68a34b206920ceb0d8bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536460, "uuid": "90f562eb-4711-4b47-b347-20730e01bca2", "value": "T1AF1612752200C2BBE3C35971E453900F482A647266EFB9897B97CDFA19635BCC8B4BD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536460, "uuid": "5dffaa10-cefc-4899-813f-430885461ba9", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536460, "uuid": "ef77b993-3fa9-436f-b846-1659caae321f", "value": "98304:aSebtf29SliJ7kHXKISt791RXIcfBzujdfdGhaqsAt3sF5xCNdtcHcELphK+RphD:Ef29SAJ7oRStDKc5zmdb28bwPRenZhca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687536460, "uuid": "26bfe2f8-c1fb-4d18-960e-937a173fda6c", "value": 4103680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687536460, "uuid": "5db640f9-bacc-42d3-9611-6468db65ec48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536460, "uuid": "df41fc78-ba4c-41a7-ac48-d2883dd59f1b", "value": "abc9bf0c99b3b4feb28fcfde236f188f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae2337f-11ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687520284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520284, "uuid": "77fbd3e8-3d2b-4005-9cd2-b32b6cddd0fb", "comment": "Malware payload (Formbook)", "value": "a6933b4b69fd4a2410aae1ac0a28c253", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520284, "uuid": "9bbc2269-754d-43e7-9177-c26aacc3965b", "comment": "Malware payload (Formbook)", "value": "0adbe52e9ca41fd1e3d40a466c5cc79eab2040ea0f08754e4b3427422f89ff31", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520284, "uuid": "45d8d18d-73a3-4d4f-b18a-6f02f66b84af", "comment": "Malware payload (Formbook)", "value": "c027f8cd73ffb740bac0fabd08075276f96ce9d3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520284, "uuid": "4d529446-de48-4358-a61f-f180f5e19562", "comment": "Malware payload (Formbook)", "value": "7c95f317decec0f3cc8779e64a45ea7939463f6f9141197db4e0dd8f38a3f766c76f8a4be1a476107baa192fc22a8260", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520284, "uuid": "5f181e95-1ed2-47d9-99d7-3ca525760450", "value": "T14A64CF21B06ACE3FEF1453726F85D5915396FC623FA9494B6047B30E1AF738029CAE16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520284, "uuid": "5fd5fe69-7c49-43c8-8af5-e62cb12075d2", "value": "6144:EZ+RwPONXoRjDhIcp0fDlavx+W26nAu1vBwBi0pnRrk5jMIWltEgMSO0DN:8v2i4rkKIWlO9SO0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520284, "uuid": "d9bcec3e-bb24-4420-a546-5b335a2e64d3", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520284, "uuid": "dc57fbb0-58ec-4c13-937d-35bc2f7171b3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520284, "uuid": "03f4dc3a-6883-466e-a5b2-2a55d30f5baa", "value": "OCi_MT103.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367c3508-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687510318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510318, "uuid": "50b5bab3-fffc-4fb4-b906-4acd0518803c", "comment": "Malware payload (RedLineStealer)", "value": "7055709b43b6dd4b36f4abeaf1845a55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510318, "uuid": "3467de75-4f34-49fc-9860-f95b6de8d023", "comment": "Malware payload (RedLineStealer)", "value": "0b231f67c5624428e7f6f568f47dea0cb9bea2d4af8974d23cbcc9d3601748e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510318, "uuid": "2e642314-975d-4215-a3b7-68b9ce2651b2", "comment": "Malware payload (RedLineStealer)", "value": "cad419afd1e450d72ffb9a08a2b6492fb8e5fb0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510318, "uuid": "8ba5f3e5-9ef5-426a-8e7e-eed57b0cbdb8", "comment": "Malware payload (RedLineStealer)", "value": "713eb717dba834666fe7a132c3526080f7f13ab0a2455b63a3b7137e17302b5ff78a4d7bec7371b8968004151f152eb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510318, "uuid": "692c0a04-56ec-4018-908d-dfea1b27960a", "value": "T1B0444BFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA284CA19B90952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510318, "uuid": "1668da6a-936e-4598-9fe5-5f5593372eab", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510318, "uuid": "756c3b41-c569-4c29-baef-e6bfb39049e9", "value": "6144:ltTy5igt0poiRG/XvLNUgYhuE22SQQJQmT:ltT1gtAoiRG/fSvaQQJQmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510318, "uuid": "928e51f2-93da-49c0-bba7-042c172e91b4", "value": 276291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510318, "uuid": "3959ac97-caf2-4e51-8bd3-0ea9dc641ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510318, "uuid": "c332ea22-367a-4c69-8379-c97097588958", "value": "7055709b43b6dd4b36f4abeaf1845a55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff66d4d-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500080, "uuid": "a4c90cf7-d3cc-4472-a9c3-0c893a0215a7", "comment": "Malware payload (Amadey)", "value": "77bcc0b9bf38fe5bf3b45b9b9a0e0b4d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500080, "uuid": "3ee1b5a6-69a1-4eca-a5f3-ddf51d7a5a5e", "comment": "Malware payload (Amadey)", "value": "0b915f8a5f4e50994a7034cfa82fa27ceaf14ae8304638f63c4d941c69638182", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500080, "uuid": "ba208ddd-c888-40be-8df9-771012e5799d", "comment": "Malware payload (Amadey)", "value": "67714a593984637ee4284cde0fcf9ad7a7d7fb78", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500080, "uuid": "37e2bc50-5f4a-4886-8d25-9e3f8f9d2d50", "comment": "Malware payload (Amadey)", "value": "65d8e7f5a6e7d5b2dbb1e7c60e3051dcb9e8d1eea00c64f9509ce9f7fa694b876465a4cfb93a3351fa2026ab588841a4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500080, "uuid": "5ac79f62-9598-40c9-b348-a7c63f8f5e0d", "value": "T1D9B4F1CA25404973CF33DDF2C4EFE9E64A7A71200BA54BC7120D8AF98A452D4E61B57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500080, "uuid": "3854185a-3914-43ad-8f86-5eb02bdbba0b", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500080, "uuid": "8323c7ad-9302-45e6-838e-64070a77c211", "value": "12288:YreiHPTey5sW3uZV+6eVVD6eW0kYbNQ2yQJQmZ:YreivTey5sWebQvsQNQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500080, "uuid": "9382b215-b180-4ac9-8925-4acb4f2eb6d6", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500080, "uuid": "016cb5dd-3c43-4228-8f26-39747e174d7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500080, "uuid": "35c1eb2e-c5b8-4c85-90cb-b5966b90ba96", "value": "77bcc0b9bf38fe5bf3b45b9b9a0e0b4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a9bbee-11b7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687519011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519011, "uuid": "6fafeeef-e06c-4b74-b711-7394fdd0ddeb", "comment": "Malware payload (Formbook)", "value": "eb4ec13e49edaa7b70956780c01e766a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519011, "uuid": "fb3ca4ed-0385-4946-b7f6-da7a0209193c", "comment": "Malware payload (Formbook)", "value": "0bc4f76fe986f1ba6cc98772aa9ede93f048b69dc0663bc51ab9e11e436546a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519011, "uuid": "3056a70d-710d-4f41-98bb-712a894d0c30", "comment": "Malware payload (Formbook)", "value": "020f0e12df96a129d375a43762447459fdc33930", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519011, "uuid": "1b511d78-8053-4d7d-b413-19e90b40c3eb", "comment": "Malware payload (Formbook)", "value": "098042460dc157b2e62e55715c0d6905ccd777a2757a55831b0b8b4cb2b5f541184166bddeb4e4f9981db81df0fa828d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519011, "uuid": "36d16f9e-d31d-4b6e-9dc0-9286df07a58a", "value": "T19C54021576E5C0A3E9A206320F36D6FEAEE5ED12DC904A0737D03F0F7832662895D792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519011, "uuid": "77f7100e-71bc-4b08-b899-aa26f979c4c6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519011, "uuid": "87eaa6c6-3aa7-418d-a19f-b48f005ab862", "value": "6144:gYa6GTqdrqDz0kZ/rSgWOwpCD3vKuzptEXXlypu:gYUTpDz00zSgJLGGcE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687519011, "uuid": "a6456fdd-840a-43f4-baea-e5b42b582b95", "value": 285423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687519011, "uuid": "98823a07-5d6a-4f5c-8916-6d5341b154e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519011, "uuid": "37d41148-ecbb-41f0-a665-17e922250815", "value": "eb4ec13e49edaa7b70956780c01e766a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38354016-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501302, "uuid": "3acd9eed-4165-441b-ae04-899c7657bfff", "comment": "Malware payload (RedLineStealer)", "value": "ee91d916bb11cff1ae51e15f8be1bc06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501302, "uuid": "14882f59-4b76-4cff-9e65-1f584ced4a7c", "comment": "Malware payload (RedLineStealer)", "value": "0becf3cff36e3981d12d6a3991bb0303b4835a14bac199c18c73f715bfbea811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501302, "uuid": "8830575d-705a-4c89-a5c2-6f299f7ff41f", "comment": "Malware payload (RedLineStealer)", "value": "4721fa9dbd027faf52786f1a6b93c5001bed9011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501302, "uuid": "7c0b0f29-0119-4a3c-a113-a81dc15fe5f8", "comment": "Malware payload (RedLineStealer)", "value": "97950531d270fa4195ace7c4e0bbdb6fbd586d7bdf5eddf616c61f1a5497fbc1aadd46e249e97dcb0a16bf8e59bb0c36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501302, "uuid": "d9ddec3d-16d9-4790-b401-4cf86026f5da", "value": "T1D5444BFB52D1D460DD0FA4B02C6EE1BDEE30B461DEA284CA19BA0952D3534E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501302, "uuid": "34d8bcf8-f3ab-4936-a997-1d0eaf936e45", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501302, "uuid": "1839d36b-81d4-4b3a-a5db-ac2860ad5bd0", "value": "6144:g7Ukvw6igt0poiRG/XvLNUgYhuE22WQJQmb:g7Ukv6gtAoiRG/fSvuQJQmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501302, "uuid": "611fac49-1f68-4a12-b78c-c75f766c9a0e", "value": 275777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501302, "uuid": "3fbc7a56-cbc6-4c70-9cce-8905105ffc15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501302, "uuid": "5d990edd-f150-4c2e-b82d-3f8b122f2956", "value": "ee91d916bb11cff1ae51e15f8be1bc06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0139a9-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499431, "uuid": "9a2f7ebe-c6bc-42f7-809b-80b36046b094", "comment": "Malware payload (RedLineStealer)", "value": "20f46f11803d19e34b7b459b18f7ae33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499431, "uuid": "a34c6d03-5fa0-473f-b1c6-2b2faaa5acd3", "comment": "Malware payload (RedLineStealer)", "value": "0c1c39149b8b50eb7ef0cd9984a9fd30227da1e0622497374c5a0531652f33c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499431, "uuid": "7483c6a1-f560-4fbd-b54b-d81b960a4799", "comment": "Malware payload (RedLineStealer)", "value": "101daa61176edac658dad80eae1e0cc6dfc7b7d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499431, "uuid": "1dec046f-e269-405f-9ca4-558736726968", "comment": "Malware payload (RedLineStealer)", "value": "1c96f92e7092ccd2efbf63b41a37ad9f21688a5cf0a49bb44fc87c55c4edadf526d50b35cd5013bf8c4f6d2d8df42703", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499431, "uuid": "0284b4d4-3299-442c-a104-21afbeeff231", "value": "T18C444CFB52D1D460DD0FA4B02C5EE1BDEE31B461DEA284CA1AB90952D3530E4BCE798D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499431, "uuid": "cede4dc5-9d1e-4e12-87f6-eae13d4d97d0", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499431, "uuid": "f91c9f32-4276-47e4-b0a4-1b2ce5559c13", "value": "6144:pghSpigt0poiRG/XvLNUgYhuE22qQJQmT:pghFgtAoiRG/fSvCQJQmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499431, "uuid": "c0f6496a-e454-42f1-8100-67add3186b74", "value": 276291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499431, "uuid": "e12942ca-6672-4181-874b-fb31a82a3348", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499431, "uuid": "b26e4182-9d62-4a4e-a907-c8d432f97660", "value": "20f46f11803d19e34b7b459b18f7ae33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046e83a1-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500356, "uuid": "2a49f85c-9c8f-4e64-b619-ad64418dd724", "comment": "Malware payload (RedLineStealer)", "value": "2f2b289621a39508c9874bcec6426aeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500356, "uuid": "0acffb63-1ef3-4a7b-b178-7eccbcaf2c96", "comment": "Malware payload (RedLineStealer)", "value": "0c7f07a4b5c83c80e585c7981b721c0409347d0bd9b06d8337e63669246a839a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500356, "uuid": "d8f8e21f-769e-4aa3-9166-c23ced6e6e83", "comment": "Malware payload (RedLineStealer)", "value": "4b0de7a83926b2c052e3e7b7a400473c82f9125e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500356, "uuid": "739eb55f-6a33-4750-9aea-abc02161eb5a", "comment": "Malware payload (RedLineStealer)", "value": "804f6a229a91d65186379cf4956ec35181670da76b90b407310d7a12287abb06e2eb269d4c14838f54c97eff082db9e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500356, "uuid": "9853bca1-47fe-41d3-b210-b5d131848637", "value": "T1C8E401C662404973CE33C9F294AFE9D25E78713247B14B8B130D46FA8E456E0E61B97B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500356, "uuid": "e7c57af5-81c6-4fa2-9187-43d9d6e13819", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500356, "uuid": "3350c26a-72bb-4ec2-936e-e9771b920ac8", "value": "12288:V0TCcTey5sqG8ce7Cisay/Mwhv9+0KwN9SEZGpDbEQJQmZ:V0TLTey5sqR7ElV+0lYEGDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500356, "uuid": "d6170d9e-e412-4b1f-8a1e-941c6217ff78", "value": 715072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500356, "uuid": "ea60ac81-246c-4ee0-beb5-72ee37976ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500356, "uuid": "28869a95-5443-403f-b626-03d5ce4722cc", "value": "2f2b289621a39508c9874bcec6426aeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc1bb6a-11de-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687535857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687535857, "uuid": "5d401273-8857-415b-8e70-5e57382dbbdb", "comment": "Malware payload (RedLineStealer)", "value": "920a0825d2b1cc7d4fd6200a5b3609a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687535857, "uuid": "9a84892c-0faa-438c-9506-cd3bdb00cb10", "comment": "Malware payload (RedLineStealer)", "value": "0c816155dc64fd4cf441279777bd35f7b23dd46539f5a03109f040ce766d6acf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687535857, "uuid": "4f773c36-444f-47ac-964a-1fcddcd6439b", "comment": "Malware payload (RedLineStealer)", "value": "1506c20544a50ddf89e2bb5d720aee6cd78a936b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687535857, "uuid": "fcb00d08-af69-4a98-bcec-96a3fd78ff3b", "comment": "Malware payload (RedLineStealer)", "value": "484bac77220102763d84490b23d390725aa99be71663f2771ac82c9318d0a4f789583477465f326f798605d53b898b2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687535857, "uuid": "e285d554-ac7c-4ccc-8796-acaabbc86d6c", "value": "T1A53601352680DD73D7CB7372D063826F881A697096EFB49CA3374DEE296B87CC960944", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687535857, "uuid": "20cbfc78-85ab-4c0f-93d7-160abd85f11b", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687535857, "uuid": "f1f6dfcc-51f6-416a-989d-76d824581873", "value": "98304:KQ8Mzme+0TaG28caXeVTfc70pTdoJcq/jjZOzdrLg7TGtxR6kyzrQ4rd0LfRXRPA:C0TaD8poPacqPZOzVsKHR6vzrQ4rKLfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687535857, "uuid": "5b351db7-7922-4d4b-be89-bac51241a89a", "value": 5225472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687535857, "uuid": "0b71ec21-1766-4a31-b8ad-a6104c595e39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687535857, "uuid": "92d4da1d-6d73-4a64-9707-ca68d69c0191", "value": "920a0825d2b1cc7d4fd6200a5b3609a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3af7d4-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500669, "uuid": "c4511498-62ba-406b-9c11-a139ca1bd3da", "comment": "Malware payload (Amadey)", "value": "0cba47f4b33534189eeceda1664ce7c6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500669, "uuid": "514e0a2a-2197-45b5-bfb5-dd7a37456289", "comment": "Malware payload (Amadey)", "value": "0db41845de6021a4b146ba7ad65e0e582e369e708f11d5a8481091511306a566", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500669, "uuid": "113820af-c5db-4127-b173-ae38e44ee012", "comment": "Malware payload (Amadey)", "value": "b8199fe1d07941b6235c35c077852866eafd60f5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500669, "uuid": "e90880a4-d715-4c50-bb1f-9cc1d0f709fc", "comment": "Malware payload (Amadey)", "value": "48f7ce1190f16f627e2f6616350c25ffe8635137c6d18fb9ea42523414659ffacc1dc4163456503a3ddf07f2a00c59c3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500669, "uuid": "4b26bc9a-d162-4c51-b1fb-99e33c931e09", "value": "T1FEB4F1DA66404833CF63CEB2D4EFE9D74E3A71300BB187C7120D89E94A515E4A61B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500669, "uuid": "cbe3cb46-d2fd-485d-9f52-84f5b3fe3d27", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500669, "uuid": "d3657cb8-2551-426e-8bab-2d5b0f2af48b", "value": "12288:xktB/Tey5siWhL7JSYxvWV2tEE+pBO8ogJefmlCQJQmZ:xktBTey5siWhzxvWQt12rMfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500669, "uuid": "4c940233-a3a7-4e87-8d35-81a3c8aecc32", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500669, "uuid": "b8e03088-cc5d-44cf-9d4b-74b879c34ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500669, "uuid": "b6ba7298-fdea-43d0-83a5-7103180b81ba", "value": "0cba47f4b33534189eeceda1664ce7c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c41394-11ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687540897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540897, "uuid": "de51d3fb-a5b4-49f8-b967-aaf617435cab", "comment": "Malware payload", "value": "27df4dcb273e5e3ab31e5b777e8ff6c6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540897, "uuid": "16fa928c-c266-40ab-a3a6-9d85305f1b53", "comment": "Malware payload", "value": "0dbd6719aae8fe5b7baf0fd18e1cd744f5d347e622b27693295fa976276b643c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540897, "uuid": "fa23aa7d-37d5-4898-934d-16a1b393c234", "comment": "Malware payload", "value": "addbca19e2fc72ba62b4f2a541f13c0d7306ff41", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540897, "uuid": "43239179-7ea6-4fbc-8bee-497f2260323d", "comment": "Malware payload", "value": "2afaa9e06ddac63b2a40fcfdc575b3afb49c3b8e7026ff1566c2340e388189794945b0dbaf90ef5780b19b8c0cbde730", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687540897, "uuid": "ec15038b-cdd3-4197-9850-fd6daa89ff71", "value": "T15E74496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687540897, "uuid": "42cd9ee0-cd08-4e87-83e3-7080aeb371a3", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593C:fIS1xbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687540897, "uuid": "79d7bf66-5cb3-4da3-88e8-c3879202d501", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687540897, "uuid": "1f78acc8-6722-42df-9277-1bc7d9b918a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687540897, "uuid": "8f04b43b-6e55-4dd7-9524-f314cd9e1eaa", "value": "BSN-100756732.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab9bb21-11c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687524579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524579, "uuid": "0437577a-00f3-4524-a2e9-a77d4ec5756e", "comment": "Malware payload (SnakeKeylogger)", "value": "23c733d0e1a65828e79f50168287ef47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524579, "uuid": "5a9280b9-d440-4251-9bfc-e677b0f42945", "comment": "Malware payload (SnakeKeylogger)", "value": "0e2fbc09a6836c716471ac4d1bfed12eeba8c542f404ae1bcba79228ff007224", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524579, "uuid": "8222d455-438a-4d98-b9a0-8a7fe66101b1", "comment": "Malware payload (SnakeKeylogger)", "value": "b594faf03393cc26cff6a5c97a11fd113847e506", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524579, "uuid": "e0b54e71-00b3-4f8b-bcab-4a9866564958", "comment": "Malware payload (SnakeKeylogger)", "value": "9c95620cf8ae984666c452296d4398feed2c052a9cd8ac760c5dc93123e56dbded6c68cafd7558c3369ba383cc885b3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524579, "uuid": "bd2c1401-79fe-4b20-bf84-00fd031f56ec", "value": "T109C4236B33294E25D2358E710CE7137043B425547915E24BAFAB21C62AF3BA05663F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524579, "uuid": "be932704-3a5a-4508-a9f5-90387cd4d8f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524579, "uuid": "de5d4f33-c6db-44c9-a8b0-f48b5f96d925", "value": "12288:tk54/mNUAa0zpAyvPaHr63sa6kirSBeulhx02:tk54/QUf0ahHW3x6kir0hnG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687524579, "uuid": "086ef002-9d7c-4359-8cb5-d891c0ca4ca2", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687524579, "uuid": "f640c8d6-4236-4a2d-b2a9-f85a52ca364f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524579, "uuid": "f715a079-ed67-40dc-ab3b-8be7f0086105", "value": "receipt_DOC0037733674661 jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c052749c-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500671, "uuid": "686db24d-0bd3-4b20-bd8e-4530dd187701", "comment": "Malware payload (Amadey)", "value": "a4704ed5b8404b258387751e1be57931", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500671, "uuid": "c76a2105-9de1-4b33-a1e5-f4dcc209488d", "comment": "Malware payload (Amadey)", "value": "0e59e63bbe4f00bff4aeec444be3c8060288568d427a37e4fb3959c651d1137d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500671, "uuid": "52e76db4-a02f-4fe8-9082-36ac6f193da3", "comment": "Malware payload (Amadey)", "value": "b0ac6dd8f5e9aae37e9316bf57f06ea90e244c49", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500671, "uuid": "f3f5dc20-ce20-4d5a-a3d1-759d8f42499b", "comment": "Malware payload (Amadey)", "value": "db891cf0edc181e5856eea96823f2d4b5aaa8c98e3cce25a75007e66c16ed2c19377d630864e509dcf4f55b758729f86", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500671, "uuid": "9c6361aa-2dd1-418d-8bd3-5034c9619455", "value": "T1B5B4F1CA62804A73CF73DDF1D4EFE9D64E7A712107A14BC7021C86F64E462E4A60B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500671, "uuid": "659e491a-b19b-4292-8435-54d3e7c74b6e", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500671, "uuid": "cae485bd-0eb7-43ed-a533-20ee44acd7a0", "value": "12288:MtS2HTey5spKp1qfU+W3HRx0Wx3gMQJQmZ:MtScTey5ssXqMxx1xg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500671, "uuid": "55df2617-dd3e-4404-a2d1-803715d521dc", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500671, "uuid": "59af3d36-7a2a-490a-beae-462b9d34e59a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500671, "uuid": "c83117db-e1fb-4032-90d2-ae0773202510", "value": "a4704ed5b8404b258387751e1be57931.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af9e512-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500367, "uuid": "3ac4ecdc-8720-4d9b-b67e-8d553ecbb839", "comment": "Malware payload (RedLineStealer)", "value": "8eb2532f3d1f8398f7c5d61343bab078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500367, "uuid": "a3f4e1f4-f0b8-46c3-8d75-d92862397351", "comment": "Malware payload (RedLineStealer)", "value": "0fa1229d5d241f7827c4a01ffe22d93ace79ecff1b11ad8e386bb9722343f867", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500367, "uuid": "e6ad74c9-3f50-4edd-af7a-b3141d6ee77d", "comment": "Malware payload (RedLineStealer)", "value": "54788bb9a4bd4ac6f0907f2b6ba63cc55c30b588", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500367, "uuid": "903bee25-90bc-410b-ab7e-f953597046eb", "comment": "Malware payload (RedLineStealer)", "value": "08c3f08b2679b105383cddae7b864cb2fbfdbf4a7a670c42ac800a7140ac96a66d691b4bb4382f741c5c07f7a71cf46c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500367, "uuid": "b6f6fe90-a915-48c5-91a7-5ab175182229", "value": "T145B4F1CA61404977CF77CDF2C4EFE8974A3A70224B3247C7120D49F68A866E5A21B57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500367, "uuid": "09c914c9-24ab-45dd-8fd0-1f12e171b9de", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500367, "uuid": "23f66818-b7df-4c6e-b03b-ff1efce6cad7", "value": "12288:n7neOVaTey5sxls5ZfA+PKo2LZxVbQfNnnkmQJQmZ:7neOgTey5smK9LrhQf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500367, "uuid": "d1598a08-71fc-4e8b-b904-c19286f610a7", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500367, "uuid": "1116e139-ed68-45b1-ba8e-39360b467640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500367, "uuid": "dca6851f-d1aa-48c2-ada1-86e7f2a89fd9", "value": "8eb2532f3d1f8398f7c5d61343bab078.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e97230a-11db-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687534357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534357, "uuid": "a759d866-e27d-46b7-b0fc-06eb703b542f", "comment": "Malware payload (Amadey)", "value": "283faad6fd6a0cb39abb715bf780a662", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534357, "uuid": "b40a5124-5c41-4214-ae89-508ed95dd7a0", "comment": "Malware payload (Amadey)", "value": "0fc302d9fc10620eb8077791aae82b7830e2ecadf6456284e4a7059144d5c282", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534357, "uuid": "58a0a807-8f5a-4deb-af11-744b056e4c08", "comment": "Malware payload (Amadey)", "value": "4bdeb2249a335c1171da05134451421a930243bf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534357, "uuid": "cb935d24-a331-4929-957a-674e6f8234bf", "comment": "Malware payload (Amadey)", "value": "d532ad038550db93c717b1b514a7743ce63ff4e3621a5a7fbccdb0f734674dbfc83e98205a0d3eaca1c2cacf20c2d246", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534357, "uuid": "e9cbf8e8-c50f-45c3-88c7-398de41cd4ac", "value": "T1BA1612752241C1BBD3D36971E853911F081AA9B2AACFB8997383CDF618A35BCC474BD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534357, "uuid": "328b75ce-2ce4-4521-8ba0-f72355f8c524", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534357, "uuid": "6d6b7d5f-1f17-48bd-b1e5-80a507a06887", "value": "98304:398ohlhjB/U6L4mMRIjXQNhpKbRHy4uv2SWLGSzRlKCC1KtBsF6Huq3zLh8W:N8ohbjd2aQxKbN1SW3C1/F65zF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687534357, "uuid": "5cb94490-cf5b-48c9-91f3-62e432258d6f", "value": 4118016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687534357, "uuid": "16dab3b2-d945-4cbb-94c2-6b41f82dce9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534357, "uuid": "bfc932b6-507e-46d0-bf03-ba9b0056d66b", "value": "283faad6fd6a0cb39abb715bf780a662.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0551480-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516616, "uuid": "85520918-7f58-41df-8183-a39d969393f0", "comment": "Malware payload (RedLineStealer)", "value": "45c8e1e1a578aed26c2226a8f61a1369", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516616, "uuid": "587ce958-3905-4c35-9f65-64efb26c058d", "comment": "Malware payload (RedLineStealer)", "value": "0fd8e709104da385aea0cb066b8c259bf9cd75192bf13c7ee8c5b0106d8c60bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516616, "uuid": "9bd21d4b-a75c-43a1-80a5-83f948a49e87", "comment": "Malware payload (RedLineStealer)", "value": "5cf1941d4a8f2fba53e559389b95a4b643899d11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516616, "uuid": "9fb44d6d-efce-43f4-a570-9b584741bb9c", "comment": "Malware payload (RedLineStealer)", "value": "811f9bf6c0c0f78ae5fe62883885d3c500d1fd9fc0b259377d9d731aea11f76c7ed2ff84763bdcd1e4b0887c23e13836", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516616, "uuid": "d4c91709-fa98-48ab-b321-a4fb2b4e110e", "value": "T1C7E402CA254049B3DF33D9B2D4EFEDD68A7AA0304B724AC7020D95F99E455E0E60B53E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516616, "uuid": "157c6ee8-edfd-4e8a-ae62-f575ae42acce", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516616, "uuid": "14089bd2-3c78-4b40-9194-56b64e5b7a78", "value": "12288:bLasLwTey5sEIYRCZMTDv2vu8XMwelpQTiwGl951otnr85r/C2iQJQmZ:bLasETey5sGMST72vdaled45r/C0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516616, "uuid": "d3072685-dd76-4fb7-8beb-9a77105031f4", "value": 715072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516616, "uuid": "4d7c6bae-4bc6-4c60-9c1a-606001a69675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516616, "uuid": "f6714e3f-e953-4b0b-8364-597f1a33a0f6", "value": "45c8e1e1a578aed26c2226a8f61a1369.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e384d04b-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687516621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516621, "uuid": "e11a9e40-0a6a-4e78-8ec3-2ee92b29b81d", "comment": "Malware payload (Amadey)", "value": "a22d11b6dd4a58dd1c6b3f612711f49a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516621, "uuid": "96f96526-b3af-4d86-9a0d-56a916350479", "comment": "Malware payload (Amadey)", "value": "1030ebc868d8b1d17c2f08fae6ed61422bc09946b8e4840421366d942efa7be9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516621, "uuid": "f7d01109-43ec-4d37-b47b-50b68d2781a6", "comment": "Malware payload (Amadey)", "value": "b1699bd7f45f082fe86dbb1f1bbb14e5bfaca765", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516621, "uuid": "314c802a-2b67-4f54-be81-c40977a1ab5d", "comment": "Malware payload (Amadey)", "value": "0e6f05a33fb76e12456af094f146e22eb9fa0c3df79ecde24ae4b41222e27918cf300b3e87b260b36320fe4359c10be9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516621, "uuid": "25da2f99-eea0-4c1c-99fa-a4bb0a2afca7", "value": "T1FBB4F1CA655089B3CF23CCB2D4EFE9D64EBA71210B7187C7120D89F68F515D4A21B53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516621, "uuid": "efc01db6-9a39-4259-b6c1-2e69533ea911", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516621, "uuid": "d0798ffe-0467-41e4-b3de-69563be7421d", "value": "12288:3UIDeXTey5sU0uXk6UBFflbipq6fwQJQmZ:EIDwTey5sek6Unt4q6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516621, "uuid": "b1b9ccdc-6306-4d46-a76e-64b61b2510c0", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516621, "uuid": "e28cd4ac-ad4a-473c-9e3e-617debb6f949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516621, "uuid": "4ae04b18-9899-4e5a-838d-720efcdd7c4b", "value": "a22d11b6dd4a58dd1c6b3f612711f49a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4afe3ba7-11c8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687526244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687526244, "uuid": "dceff902-e9e5-4030-9532-b81215ceb1e1", "comment": "Malware payload (Amadey)", "value": "bd096cf420eb2349627cf9c34f0b2164", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687526244, "uuid": "64796b00-dc50-478f-9372-fa8fc6d0e31b", "comment": "Malware payload (Amadey)", "value": "103122dcb35d23245844a7078153ac77f1eb110ce024a4c61f841f8d11cd01d6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687526244, "uuid": "39043129-e364-4026-9f98-55e8744ecfa5", "comment": "Malware payload (Amadey)", "value": "b488af10591506b452f2baaf2a1a2e449650c474", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687526244, "uuid": "50eb6fc9-1b7c-42e9-81bd-35966d816854", "comment": "Malware payload (Amadey)", "value": "66476c48121cd9f452e15204ba1eb81d1667e5238690e66f16b70e0d9e06a2832fada8d202d0a627d02c61615edb868d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687526244, "uuid": "c2b39183-f485-4d0d-9598-94dd1f6a9c5b", "value": "T16BB4F1CA25804973CF67C9F2D4DFE9D64FBA72310B6187CB120C5AF58E412D4A24B5BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687526244, "uuid": "83e0a777-da2e-4bf6-983c-ec06d1acb7ed", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687526244, "uuid": "67549f12-3162-4123-8fac-dc5e22e9d5ef", "value": "12288:AI1ojTey5sLCiQ5PVfZnPjY7g5RNWQJQmZ:AI12Tey5sLCiQ5HPkM5Rz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687526244, "uuid": "f0ecb2fc-e929-4d5e-baae-d8d915d13ed2", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687526244, "uuid": "533403a6-df11-4b73-9a2f-1bc199457641", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687526244, "uuid": "bd3f5d4f-0cee-4afa-a23e-c2fc3ef04a3f", "value": "bd096cf420eb2349627cf9c34f0b2164.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4316f50-11c6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687525642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525642, "uuid": "dc8a548a-459c-4b51-9b7e-07c7992bdd26", "comment": "Malware payload (RedLineStealer)", "value": "e10d9f5a277a9a871d7571f6a213de8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525642, "uuid": "b860132c-db65-4892-be53-4e760a4b7989", "comment": "Malware payload (RedLineStealer)", "value": "109fcd6cc68ac92ff48508f6b88b2ce1e25d9fcd788140cce150a2d52f3f7b1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525642, "uuid": "9bd4981c-d8cf-4029-85aa-5740f174e102", "comment": "Malware payload (RedLineStealer)", "value": "b62ebff1053fd8c9922274b184558fd3d208cbb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525642, "uuid": "1f6339b7-cab5-4f97-8726-138d20b9b78f", "comment": "Malware payload (RedLineStealer)", "value": "b5e724804c77a6ee5cd081a519e5f5f621a5fbe00d2d822c4c1589acdbda9a08b45351a2e3c725bae096f6634c437273", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525642, "uuid": "9fb089dd-3ea2-4394-be0e-ded347bf5151", "value": "T1E6C401CA21804973DF23CDF1D4EFE89A4E3661310B724BC7230D95FA8A456E4A61B979", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525642, "uuid": "159a033d-bd96-40be-8101-3f7b7a59cc7f", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525642, "uuid": "3542fe7e-29b1-42fe-8bc7-003eb5f5c467", "value": "12288:cq3HjTey5stFnU8Sk0NwSvlG9SQgXXFLgQJQmZ:cq3DTey5sLnULk6igln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687525642, "uuid": "26428b47-6f33-4a61-8baa-d1f12ecacc25", "value": 544064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687525642, "uuid": "c696f0b8-d802-4c81-9d47-40c515ebc567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525642, "uuid": "b9a4a5ce-bf31-4a88-accd-74eeee4531d8", "value": "e10d9f5a277a9a871d7571f6a213de8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f81b45-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501276, "uuid": "915c6974-0956-4fcb-ab62-ea04e569b7ef", "comment": "Malware payload (RedLineStealer)", "value": "dcaa95a0067f7822c4a339ffcaa87093", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501276, "uuid": "9b42ce10-a30c-4f25-b73c-4ae5552b8f0d", "comment": "Malware payload (RedLineStealer)", "value": "10a27e4e927204d5132a941db2b911591e3fe4e301c0fa390e43c6b8f5243118", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501276, "uuid": "57b129fc-fac1-4dd1-8937-5f03b1f16822", "comment": "Malware payload (RedLineStealer)", "value": "7e97f79e33dababc55b76f8cbcf515e734b80d34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501276, "uuid": "cc4ed52d-1eb3-423f-a722-fc5dc7ca4fd3", "comment": "Malware payload (RedLineStealer)", "value": "c93e00e3d0e9bf59a18026e320e8ef22e44dcaddead27eeb6ff20cf4f0a4aeabef9c60bd5089e8c63370c0b115e57c2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501276, "uuid": "0fec87d2-4d04-4d44-a0e8-e2edaa39e14d", "value": "T14BB4F1CA26404973DF23CCF1D4AFEDD69EB9B0210BB24AC7120D8AF54E516D4A51B93B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501276, "uuid": "e043f416-61fc-4667-9cd7-348ade8f11cc", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501276, "uuid": "7b69eeef-6299-495c-bc65-dc786a484335", "value": "12288:fzOmKhTey5sIZetdlm0BXktTWKrxLPGOOnDGUQJQmZ:7OmKTey5sIZeb00FObrxSDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501276, "uuid": "ea42c51f-27a2-42ee-b870-da755be57471", "value": 532800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501276, "uuid": "8d1a76aa-b813-4296-ac8f-e9a6cddb7c9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501276, "uuid": "5baa9958-7c77-4d66-8850-03f013ea69d1", "value": "dcaa95a0067f7822c4a339ffcaa87093.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453ac34c-11ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687540837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540837, "uuid": "3bbfb7b4-b93f-4930-b50c-35c2af893a1f", "comment": "Malware payload (Quakbot)", "value": "4a0b46db68f8339dfc1c49bda1215b5e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540837, "uuid": "931c18e1-742a-4494-8368-620bd1776080", "comment": "Malware payload (Quakbot)", "value": "1111c89d5f926353be1bfdea35a0cc24b118401e2a20cd9fa60e503c9d69a5ef", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540837, "uuid": "374862dd-c07e-45cc-bdd6-ec49b3eef262", "comment": "Malware payload (Quakbot)", "value": "b5d3c7e01554e2066939862ed03626024d643bf1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540837, "uuid": "bcec0266-6d9f-4b1f-9541-b7a3b22c81de", "comment": "Malware payload (Quakbot)", "value": "38b6bcbe9200dd68082ec90d8f81762dc1f2474c9a4fea8ff8d65ff23864f21a4494e3d8c209dc096984c78d56698288", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687540837, "uuid": "ec273aa3-06d3-4566-b846-4af06d4e19f8", "value": "T1F674496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687540837, "uuid": "0e9d5152-bc72-470f-bdb9-42f53b5cfdcc", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593i:fIS1xbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687540837, "uuid": "8c734302-0acb-403a-9377-524b0a0d2193", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687540837, "uuid": "0d9f5d2c-9591-46f3-9282-79635203bbc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687540837, "uuid": "01adaab4-313a-4807-ac2c-97e5650d22a5", "value": "BSN-75788572.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfb23e4-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499429, "uuid": "d492eb1f-5a02-4693-a223-4b158ab92a14", "comment": "Malware payload (RedLineStealer)", "value": "0d6bd63180f0a9ddcbc8b9a31b022a63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499429, "uuid": "a1559ec2-c3dc-4b03-b935-6f5fe060300a", "comment": "Malware payload (RedLineStealer)", "value": "12664c5292fc87323fb3ef413949b4b31ce798d766de88ae0d7c3dc7a7718967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499429, "uuid": "586b44a5-effc-43f0-b021-d899b763460f", "comment": "Malware payload (RedLineStealer)", "value": "e97a91b08482fa27e2e6b2506107d88196db8053", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499429, "uuid": "23091f1f-4341-4818-a699-786e200cd5bd", "comment": "Malware payload (RedLineStealer)", "value": "f3204df36a7fff1fcd39d038a023a64e0e687809f525ac09f816946097ca49e00439662ea79baf12e216a4fbcace5ce0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499429, "uuid": "02fdf6d7-21fd-4b21-b877-836209c70a0b", "value": "T1F9E402CB72808867CF67DDB2C4DFF9D65A7971200B71878B120D89F64E065E8E20B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499429, "uuid": "87d85071-e228-4f8c-bd10-bd6e4676a970", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499429, "uuid": "bb599984-e7f7-4989-a8e3-00b17efb118d", "value": "12288:CqA3ETey5sVhEInJXGqweJRy4w2bWDykuLmjmDss8snhoPbQJQmZ:CqAUTey5sjEIJtp0DHMmjwsJahN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499429, "uuid": "f6c7c70f-e2f2-454b-9b91-5bca7196a533", "value": 713536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499429, "uuid": "3f346e12-2039-43cc-a285-fb75cce9a344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499429, "uuid": "f0eca0ec-61f6-4d69-8321-6805a03f4bb9", "value": "0d6bd63180f0a9ddcbc8b9a31b022a63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae4de83-11fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687547987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687547987, "uuid": "c87f8a7a-6743-494c-86b1-20ccb8e2351b", "comment": "Malware payload (RedLineStealer)", "value": "0259049dc71320dfe6ed0320a1d513ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687547987, "uuid": "ac9cd375-a882-4627-859a-5e99c5677668", "comment": "Malware payload (RedLineStealer)", "value": "12bed6b0683dfa5d627620ef48f94d65d60ebe3883129a193fa01160f2b9cb41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687547987, "uuid": "b93d3766-b61a-4d9b-aecd-391495204fec", "comment": "Malware payload (RedLineStealer)", "value": "4e57e220ccb4183766f492478485f78acbd385a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687547987, "uuid": "d6fe190b-553e-43a9-9802-897161837987", "comment": "Malware payload (RedLineStealer)", "value": "7c6d38170431b94de280ccdcb49365d633bdd2b35fc9ebfbe9f9c8ea1fa0c87ec593480ed0bc0f4d47462e5f83fe0f34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687547987, "uuid": "2604e74f-01c0-4c7c-a67c-8cffda4e8b07", "value": "T19D55AD83EF491973EA812473E92F77932882A4F1139FB0BAB35F0A96D65383D0574794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687547987, "uuid": "fd9621ed-9ae4-4b01-8bd0-a236c848e1d5", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687547987, "uuid": "4eebbe0b-104a-4dcc-83b1-7563b337dd9f", "value": "24576:mkKv0Q3tMd/muFDB9bo1VrBbsr6hxQX21m+WkxWsDZsPx73Wt0dQ4ev/X+F8OFEg:ZcteoBsmhxQX21mNkxWu2PhDdc3XjODX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687547987, "uuid": "2c663a88-0ae1-4b90-b9c4-11638b5e58ca", "value": 1358852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687547987, "uuid": "9d12f08e-665b-4893-8e27-d411560cc973", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687547987, "uuid": "dac2813a-0632-4246-b8ce-fce1702af3a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa1109a-11ec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687541705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541705, "uuid": "9fcdf60b-0983-447e-9463-2e3aeb89a000", "comment": "Malware payload (Quakbot)", "value": "7e8a9a33480ac791d30db1dad0b7f87f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541705, "uuid": "1816b7bc-8912-41cb-90f4-f2d85a5bdd65", "comment": "Malware payload (Quakbot)", "value": "138b50f9832870157e4f0a2055d39885148c6dbe296ce6cf109d95cd4e7fc7a0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541705, "uuid": "16913df5-3fe5-4928-8a78-258fcb2f2b2c", "comment": "Malware payload (Quakbot)", "value": "9a93f14105ec6cf53543b1897234668b3b600da7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541705, "uuid": "e6332e7c-0f66-456f-93aa-f564a923a14d", "comment": "Malware payload (Quakbot)", "value": "c6e656d1cfa7468d2f3bab71d12a78bbca088ebe381fe2b2b774866d70668de106ff1d6b2f6214520173e1a241c13eb4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541705, "uuid": "530de294-3d18-4706-9f77-c20e05fb0c22", "value": "T186558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541705, "uuid": "a1256232-4ac2-49fb-8fed-688aaf86cde1", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541705, "uuid": "8ee27841-ceba-4c39-90af-6528b6201486", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4y/Q:QbkS7XB1EsOSNPSp0EAt2bUeM4y/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687541705, "uuid": "34ac65b5-e3b2-4905-970e-2f5f42b486d6", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687541705, "uuid": "1e4da1b2-3688-43db-b0c4-612ab21bb183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541705, "uuid": "432e0c9a-4917-4b35-bdbc-98ac4c0f94cd", "value": "01qbot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5825b782-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500067, "uuid": "989c4478-3cb0-4ec2-9255-1df510b16f8b", "comment": "Malware payload (Amadey)", "value": "5f8f223109d4d9c69a6d5ed667b117f0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500067, "uuid": "1920e762-d261-4601-a741-6be5dfe42189", "comment": "Malware payload (Amadey)", "value": "13b540ae1ede214cca02074c36d4c54b3a75560a2bc522cabde6d54bce25aea9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500067, "uuid": "3d4dc263-1f6d-44dc-8a8d-9a473758bc71", "comment": "Malware payload (Amadey)", "value": "3efda96c9b1dc0518e4c05817de663746cc07949", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500067, "uuid": "77470dd0-d3f9-4b8c-8f5d-a0a954144eeb", "comment": "Malware payload (Amadey)", "value": "c3f3fb7c8afad73036c962d40d012b30559a863246e17a656c3a698093e33747c47bf88569b6446982a185df84bded77", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500067, "uuid": "7a9e55e1-2460-460c-9fc3-641d9a7988cf", "value": "T1BDB4F1CA21800563CF23CDF2D4EFF9D64EBA712117654AC7130D95F98E422D8E62B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500067, "uuid": "7dda378d-b467-440c-b567-0138641f45cf", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500067, "uuid": "fceccf14-5307-46a1-b0c9-a0a8c64a0253", "value": "12288:pZk7fFTey5s5PkmmatwSFcDdX4+b4kl5QJQmZ:pZk79Tey5s5P+elSbda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500067, "uuid": "a5f5c9a0-4724-4d81-b73c-9502c44ff494", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500067, "uuid": "2b2e35d1-107e-41e8-b508-5b17734cf6aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500067, "uuid": "cd410059-9418-4ac0-9876-1cab8b4967d2", "value": "5f8f223109d4d9c69a6d5ed667b117f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a4e0c8-11eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687541267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541267, "uuid": "924a8973-f3c9-44b9-842d-fb980f5a0b30", "comment": "Malware payload", "value": "aa9747ebfa2389f29e11230d12f3945b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541267, "uuid": "53d312d6-78e9-4f0f-b963-9ed17ffc27a6", "comment": "Malware payload", "value": "14ca51769c9a9253f46d1484b154bc585c60436652f87580166aec4d2b9baf09", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541267, "uuid": "c406d394-c250-4e81-a0b0-c57273352959", "comment": "Malware payload", "value": "57d1fd3c2c04f077c753b4b6d2ac7d5d912cdf45", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541267, "uuid": "89b44af4-6149-4421-ba79-d77f97ab3fe7", "comment": "Malware payload", "value": "8be6d1394129c813c4de3d5fcb7c28eee49317e9b3d8bd810cfee296d465d608a48d6f2e72c73f2e196aff0db2d614d4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541267, "uuid": "3453869d-601c-41d4-9a60-d729413c589f", "value": "T10295BFB875047DE6266F576BCA96ACEC13A626738ACBA4CD807477C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541267, "uuid": "d1771d82-fe99-472f-a6dd-0641459656a6", "value": "24576:jTKSGjSOb8WEfu2iN9yLi7fmygX8TNOyTVoNEIRxT/un+wdgDQq4GPA6MpnquEJF:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687541267, "uuid": "593b31f2-6006-449f-b67c-fb418fe4ec6f", "value": 2031594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687541267, "uuid": "663de434-bd1b-42fd-9c3d-029222dcf1d7", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541267, "uuid": "b5e8b47d-a227-4590-a498-b8c6f1b6396d", "value": "SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.10770.30342", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2323df-1200-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687550187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550187, "uuid": "9be6d9f7-3d35-44a9-acda-5dddbf6f50ed", "comment": "Malware payload (Gafgyt)", "value": "a6a2f508088877304052fe821d8aab60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550187, "uuid": "3bcc08db-2b21-47e2-be8d-32236295018e", "comment": "Malware payload (Gafgyt)", "value": "14ed26ca60851cb930e98bfb7b7064141d2f85744d0cc39e0e329ee4210cd691", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550187, "uuid": "aad2c772-4e63-4287-9cd3-1b846c9b2cfd", "comment": "Malware payload (Gafgyt)", "value": "49563871acfb92ebf5240fa24e4fd7b6826992e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550187, "uuid": "a8fd6729-be66-4276-acfa-7f6ed9a2f544", "comment": "Malware payload (Gafgyt)", "value": "70f4ab9c9f79d6750b2b3df01c4fb0a8bd2ff56fe362cba4dbc683b5aad6282c260447940035a79073ceae289c8b8369", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550187, "uuid": "e90ec4b4-6c3e-4ac5-80ba-fc7ae80fde84", "value": "T121B328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550187, "uuid": "9f76d2b2-09f9-463b-bda0-d57bf74cf484", "value": "3072:WD3l+XQzPeV91310pWudTKakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWCTypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687550187, "uuid": "4d46b864-d6e2-47bc-8ef6-1265808b7879", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687550187, "uuid": "522e05af-6671-4dde-8bb1-1f745d8b5803", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550187, "uuid": "9d92ae8a-b0bb-4b7c-91a8-e019ea00ae38", "value": "a6a2f508088877304052fe821d8aab60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d4aef8-11bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687520789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520789, "uuid": "eeb16827-8b45-4e55-8253-0c19a21a6137", "comment": "Malware payload (GCleaner)", "value": "8cfa95c16f9788f2125e33aa01ff72c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520789, "uuid": "02359f7f-ce9e-4d32-bae0-563047e2ea15", "comment": "Malware payload (GCleaner)", "value": "14f18fe54fea192829d53d4645f45dd145eebe9eca5d47e4cff74244946eb462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520789, "uuid": "132bad51-6323-48e2-b28a-1209a4179e34", "comment": "Malware payload (GCleaner)", "value": "ca00ecb0c17d8b8994554d26ce082fc4fb2108f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520789, "uuid": "c74448a9-758c-4f97-bd64-3e5f2ce2750b", "comment": "Malware payload (GCleaner)", "value": "3fdfaf30628035e87423d26a0ef1ae69c9a3254fb01adbff4ca5f73aaf0c30500cd91a4d6becdf10619243e217c41ec1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520789, "uuid": "a1cc1c42-147d-4b4b-9103-da1b524cdb60", "value": "T18A748D43B2A23D54E925DB72CE2FC6EC361EF6504F197B6D22299A1F08B11B2D173361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520789, "uuid": "d065791a-2d62-488d-8f6f-c447fc6a73b2", "value": "7f941b060f43f514f09baca0f3e7ac29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520789, "uuid": "42f226f5-4d96-4c45-96d0-e018973aa72a", "value": "6144:kJ9mZZ6uS/xF5vemMzNNVBa/B++acjC9mUWpzTIW:p6b/xF5S5PB3+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520789, "uuid": "df88b9a8-fc72-4301-96f0-2faba6e55a18", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520789, "uuid": "6f1440a0-dd6c-443a-b871-9fce6bf7e0f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520789, "uuid": "9caf8a53-43a7-4b82-9ab6-b0e3837f2152", "value": "8cfa95c16f9788f2125e33aa01ff72c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c1f9e9f-11be-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687522031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522031, "uuid": "86913b79-5b2b-4282-a194-112a51ce1251", "comment": "Malware payload (RedLineStealer)", "value": "fe8a60d948cad5f3b7e3d9f2a30dbf1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522031, "uuid": "aa0da2ef-2d71-4adb-b889-447334512033", "comment": "Malware payload (RedLineStealer)", "value": "1519ffc687e4e797f66b613e8e847d96bf1477e53241574e1d7d177f92e5ccb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522031, "uuid": "255e4d92-c9b7-4deb-83c9-9679681f99ce", "comment": "Malware payload (RedLineStealer)", "value": "7ade4422e5e12ffff396924534f8e241c99dc39e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522031, "uuid": "500195af-b4e0-488b-af4a-597c42d3877a", "comment": "Malware payload (RedLineStealer)", "value": "e5a9fb7888deff06e69a515997d21aa532cc878e794f554d3949c4d360c624ea38e3cdd377029a5afff46acf9ac33cd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522031, "uuid": "e3c6a7bc-8965-4ea3-aca0-f47a07dcfb39", "value": "T14AE402CA658084B3CF37D9B2D4EFEDD24E7DB0210BA14BC7034D89F58A065E9A54B53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522031, "uuid": "ed71d758-db17-4af5-a7d9-5eee9041d540", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522031, "uuid": "b3c94678-788d-4bc7-81d0-2ccd844d5f05", "value": "12288:iNkQxuTey5sKskOjMFEFvyKgdDZ1IaMGT2whyGdTg2BuvsPlNegGQJQmZ:iNkQsTey5sBDImFvwb15RT3u0PDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687522031, "uuid": "82898fa3-98b9-48da-8416-fc57ad15f841", "value": 713536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687522031, "uuid": "a9fe3e25-5c43-4ce2-8fee-4b23d3afd983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522031, "uuid": "e2e0112d-880c-4fbd-ba74-e2b4ef4808f6", "value": "fe8a60d948cad5f3b7e3d9f2a30dbf1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1772070b-11cb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687527446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527446, "uuid": "b8e25b90-58e9-4df9-b6e3-e1b020695ebc", "comment": "Malware payload (RedLineStealer)", "value": "2b554ca3d3868fe28652323d3f518bf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527446, "uuid": "88fe8d90-a5e5-4b49-8e1f-bf50387f26a7", "comment": "Malware payload (RedLineStealer)", "value": "1537ee9bef61f14ff47dabd8993382bc36278b041968bf1072970b2a6421635c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527446, "uuid": "a0bed34a-d6da-4d04-b01b-7e56409481de", "comment": "Malware payload (RedLineStealer)", "value": "09845a0fc0a2048091675ed6d44d537492a811fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527446, "uuid": "3c40d189-df04-4fcb-bfdf-9950d359c8d6", "comment": "Malware payload (RedLineStealer)", "value": "20978762e7cc9a37c8caaf2d69213feb9b3812e94df7188c2ceb7461e16d9487618c69865b4b854f79dad67dea9b7fae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527446, "uuid": "c8d01f38-bba6-4033-aff2-1eb2d794a68f", "value": "T15F1612792240C6BBE3C32471E443941F0C1A29B2AACFB599B787CDE659A35BCC474BD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527446, "uuid": "f03f01b4-f4f0-4f2b-a7a5-abc5c2ef10c6", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527446, "uuid": "d233a545-e3e5-41d1-9577-d0ad48e9053a", "value": "98304:q3ZyQa9/7aDOERoj3nL95q9Kj2L62hdgpOAxO0Xbldue7QZalTJLlnaOrUPSh5ca:+a9/7aqbnLX0gpOAxJrlxQZaNJLXrUPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687527446, "uuid": "21e87d64-2dec-45b2-8c82-d25304704208", "value": 4114432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687527446, "uuid": "08e31698-d0c4-4859-8312-b96408fe4990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527446, "uuid": "e7327f69-f6c7-41b6-bc67-dec63d91251d", "value": "2b554ca3d3868fe28652323d3f518bf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4438fd0-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499443, "uuid": "9019bb93-a328-4f9f-a303-a21ac086f1de", "comment": "Malware payload (RedLineStealer)", "value": "33207dc23af38e652c06c0bd0dfd4a07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499443, "uuid": "04c5c56c-ffba-4562-a13c-d07f512055df", "comment": "Malware payload (RedLineStealer)", "value": "15aa7bde44b2af6f989bf8f39fb77e2d7220c10407117c4bf736c96d3cc242ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499443, "uuid": "2b1f4b8c-7695-43f3-9d44-14d776ac0ec7", "comment": "Malware payload (RedLineStealer)", "value": "a7ce77fce782db9fd1d6af0df83e848b153f4db3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499443, "uuid": "48d97b7a-01d2-4240-85bc-b97a522d2f41", "comment": "Malware payload (RedLineStealer)", "value": "2dcbe74fff7073f4492d98aa37abc64114edf5449f031cef7879b53a8e30671a0f16d490010ffeb63f6cabbd81adb3b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499443, "uuid": "ed97453b-f72f-4ee7-8688-b2ec3723b10f", "value": "T17FB4F1CA26404933CF73DDF1C4AFF8964E7961320BA14BC7121D8AF58E516E4E61B63A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499443, "uuid": "53770434-9c14-4003-9034-f0fcb0828cd4", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499443, "uuid": "8b373630-87a5-4e71-a040-8ee8b8f66c27", "value": "12288:hkvM7Tey5sTeb4TSRy1GBAQB5DamnsZokE0lfQJQmZ:hkv6Tey5szTPI93amsZokC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499443, "uuid": "69011904-6c2b-4fd3-9f97-ac1e9914e20f", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499443, "uuid": "d9a7ec91-1e57-4a2f-bcfb-bcac13760689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499443, "uuid": "75cd005f-5f53-43fd-9897-cff11c36a9d6", "value": "33207dc23af38e652c06c0bd0dfd4a07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0f0ea9-1195-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687504231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504231, "uuid": "09bfeaba-ec1e-4c2d-8a10-ae7711cab274", "comment": "Malware payload (Formbook)", "value": "8e83554394a98f16684097653e7a81e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504231, "uuid": "9570c475-129a-48d8-81a6-e6156539ed78", "comment": "Malware payload (Formbook)", "value": "15c29d8350fe5f4fa969832f760034a5a0a9dde1828056f4293cca32e60a76fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504231, "uuid": "81732636-bd1b-4077-ba43-be2d5f8f7224", "comment": "Malware payload (Formbook)", "value": "af8b99a10836572b387313eb190648c602b2110d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504231, "uuid": "7d7237c5-ef8d-4813-9676-3a987561fb2f", "comment": "Malware payload (Formbook)", "value": "59e9e872a1f737abd17e64b3be9244e0a7eeac863f10e6b19febae1c88d4485abe6083aac36c4f08b65984cb3f82173c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504231, "uuid": "ef87cbef-2638-494f-98a7-f78ba9775a50", "value": "T15925C0A0A7E15837D16F693C8C16A21D3C19BEA13B34788977E53D4D8F7E240391E26E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504231, "uuid": "c37e54bd-071b-463e-85df-f263d7ee441e", "value": "86b76e29e8cfff69525744de68799022", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504231, "uuid": "78978fec-c062-432e-9f67-7b9524494737", "value": "24576:OdXCS/MhpM3Gr33xUIffTiHcezOeJgI+yoS:OdXwxlT3qSyoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687504231, "uuid": "e4cd69b9-ee5c-4643-9012-f46a6022d3a4", "value": 1052672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687504231, "uuid": "14b81a04-2dad-4f07-839a-73f211430f59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504231, "uuid": "1acd97c4-6ade-44d3-9e3d-387eac19d7cb", "value": "Uhvlqsdglrgubo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1f3277-1195-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687504232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504232, "uuid": "538a351a-4866-4a14-a6e0-8e3b6be78557", "comment": "Malware payload (Formbook)", "value": "5cb73c42eaa178d35998f5adac576446", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504232, "uuid": "b86f8f16-bf75-41f8-b6f6-4a35013405ab", "comment": "Malware payload (Formbook)", "value": "1637228bbe3eed9da164033d8850a1e7cf98a1e1d7238ebf717e987de53ce101", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504232, "uuid": "8dbb0a17-1a2c-477d-8385-71d9716b9ecf", "comment": "Malware payload (Formbook)", "value": "c9b04bdab75a112c0c1c0c6ad9cd87ede9cf5cdf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504232, "uuid": "bd500ecb-668a-4757-8a20-a4e973771047", "comment": "Malware payload (Formbook)", "value": "cfdbd192fb63165e911551e0840617164ea13da7daa7ceb666cf8077fedd8bf963c5475aaefd30622fe88fc823f07957", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504232, "uuid": "35881b57-f2b4-4ea6-bea8-f9dedabba28e", "value": "T11ED4235DDA8D53235AA3F4DCDF2D630673AF1191A02BA854D49F043EAE5B3C5A324C2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504232, "uuid": "5886b560-88fd-4dba-8a86-a693de407622", "value": "12288:llXEiq1194zZYCa/gg6eTmjOu3ZvOsKLDKLFMozImhGWtQ5oO:ll0iq11OFYBoqmj73Zv2LDK+eImgYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687504232, "uuid": "78325a22-3e4b-4be8-8f43-654a1b00d957", "value": 623212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687504232, "uuid": "df6281f7-e2db-4a76-80ff-079f2f4884c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504232, "uuid": "3fb6ff6a-c22e-411c-ae95-199ba56ce65f", "value": "Uhvlqsdglrgubo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ff277c-1200-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687550212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550212, "uuid": "ec2f2745-1e98-45c8-ad6d-ba103fa2ef80", "comment": "Malware payload (Gafgyt)", "value": "ed55fdb7fac05449d7882eebbe5b994a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550212, "uuid": "9eb97599-fdd1-4781-9aa2-35d5c38825be", "comment": "Malware payload (Gafgyt)", "value": "1638e6886fbeaed2ff0079c4f118afaf38041e66bdbe37cb8a3aced160c7787e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550212, "uuid": "f998211c-7413-4c3d-9cff-8fa69bae6071", "comment": "Malware payload (Gafgyt)", "value": "1719f0ea16d9c5f619a00086e0dc06cabf7f316d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550212, "uuid": "28ba5134-dba6-4bf0-ad54-5a16c29cddb3", "comment": "Malware payload (Gafgyt)", "value": "628a9f53971f69473cdf151ccd804bfe57739359f2f90d9b4b94a91ca2d43b103539df3b2562efea3a1054df678ae938", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550212, "uuid": "b076a973-0fcf-4bae-b32d-29b5a4aec211", "value": "T1F1B30692F900DFF2F40AE67604C34B2566B0BF660F536A66B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550212, "uuid": "5a8104a3-1362-4a4b-a49b-14d5a257999c", "value": "3072:gLWUEK1FSHGfs1QbEE6QyPw8s/avcWVRm2pgYMx3IPtW:gDsGfs1QHyP3sSc2Rm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687550212, "uuid": "041d80f9-43fb-4ac0-8f9c-a1dbac6385d5", "value": 113759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687550212, "uuid": "ce535b29-1ab9-4141-af99-877ca660a291", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550212, "uuid": "cb48b3bb-dd4c-42ce-866d-92daad86c527", "value": "ed55fdb7fac05449d7882eebbe5b994a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4af2c2-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516638, "uuid": "5296442c-c844-4bc3-b90a-3347640e5562", "comment": "Malware payload (RedLineStealer)", "value": "f437227d2bfff5ed5ad60ffb06b8598f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516638, "uuid": "8a310eaf-4074-4f92-87b0-f3ed84c8069b", "comment": "Malware payload (RedLineStealer)", "value": "1662c68bd78117d2df294abca7ae65898dd69de78fc382142a6ba2968eef2a65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516638, "uuid": "b0b4d77b-0f74-4057-89a7-03705911102f", "comment": "Malware payload (RedLineStealer)", "value": "acda6ba24022152cd5616dc1e76ce67fe00e97c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516638, "uuid": "c3de2c3d-a6e6-4993-be26-735e193e262c", "comment": "Malware payload (RedLineStealer)", "value": "ed90164eb569a157f14c358e1b3c3a6ba52872513bd804c886870718461e8039c04cbc3414a08bffb6e648d43e7293a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516638, "uuid": "eaac110c-8823-418c-9512-da37865783ff", "value": "T172E401CA22804573CF23CDB2D4EFE9861F76B12247A287C7221D8BF58F042D5A55B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516638, "uuid": "e41e061d-0a38-4c36-9ab1-b3ff4cb441b4", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516638, "uuid": "c2bdd047-1c71-438b-af8d-43cb5b3fa233", "value": "12288:tRozOoTey5sdAXAwbhyKTL7j4N9wteLaAkukF3xBQJQmZ:tRoznTey5s2Qk1uOAkukJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516638, "uuid": "6a08c6ef-c9be-44fa-90f8-36f25ecf4d00", "value": 714048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516638, "uuid": "fe938028-40c9-48f8-8ae6-a0b6a6a3cf63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516638, "uuid": "b74240c5-b952-44e1-8788-55d059e8a9ed", "value": "f437227d2bfff5ed5ad60ffb06b8598f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59403969-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500069, "uuid": "aee426c7-d617-4c68-a8e1-60ce94bf1bda", "comment": "Malware payload (RedLineStealer)", "value": "6c89047587e9a464189493614e623c0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500069, "uuid": "356f0a36-3447-4274-82e6-885090827c79", "comment": "Malware payload (RedLineStealer)", "value": "174337b044eca9a2a4ec85989bfb11e64260d9b46c74949e868bc0a1a7ccce6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500069, "uuid": "0b854bcb-4909-4cc8-936a-71f1d6637fa9", "comment": "Malware payload (RedLineStealer)", "value": "3152091928bcfa2012e4675bd0a176c14ae7e8e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500069, "uuid": "264221c4-c988-40ff-b647-63a903a2b265", "comment": "Malware payload (RedLineStealer)", "value": "33d7a738c8f2472e14493186142d95f7585393f33b4a7e10aee80e6ead25449b0f0df9403827bac650f2cac9f22b9adf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500069, "uuid": "f72730b0-2526-4d5c-9b4b-28d4bd519e82", "value": "T17A443BFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA284CA19B90952D3530E4BCE798D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500069, "uuid": "740470f0-e20e-47c7-af84-499e7924198c", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500069, "uuid": "ed913e05-b4a1-4a46-9269-a61b0051f6f4", "value": "6144:A0ueQ8igt0poiRG/XvLNUgYhuE22oQJQmT:A0ueIgtAoiRG/fSvAQJQmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500069, "uuid": "3d83e868-76e3-4cc2-b6c7-6f97427cde98", "value": 276291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500069, "uuid": "20f9eb50-606b-4cc5-a3ac-4891c2a6c6ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500069, "uuid": "3e4551bd-5935-459e-9f2c-10d36feea6cf", "value": "6c89047587e9a464189493614e623c0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22d5dee-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499439, "uuid": "042f48a5-69f5-4a7c-ae9f-fa659be9ec54", "comment": "Malware payload (RedLineStealer)", "value": "06bde299245057b84e2769125c5ab033", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499439, "uuid": "49a21697-8b2f-4e29-aa89-d7bd1e9775f8", "comment": "Malware payload (RedLineStealer)", "value": "194cb8b725ad029ad4fb956faa7ca15da568563a1f34f794820aca0c1027f152", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499439, "uuid": "cfcdd70c-65b7-41ff-b87d-bb47370d7b6c", "comment": "Malware payload (RedLineStealer)", "value": "0a214e0cea9db6229c836efb0c759acdef786d31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499439, "uuid": "449d47af-e2aa-45c7-89b0-9575b830867b", "comment": "Malware payload (RedLineStealer)", "value": "76b414e0ac833fcf45434601ff5802bce6b30b6498a7308a0f4f948daf1a5a85874f2e231283d0d8dd921386a447c4f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499439, "uuid": "efb4fa7c-7ddc-44a2-ba76-34955be20f8d", "value": "T10FB4F1CA31404973DF63DDB1D4EFEAD24E79B0210B754BC7120D8AF98B442E4AA1B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499439, "uuid": "c697daa6-c4c3-42d6-b8a4-1cb57623da85", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499439, "uuid": "60e107f0-8c27-4c69-8d7f-785804cd77f8", "value": "12288:ytTsPTey5sNmtYACYnCxk8aczyBgWVvouQJQmZ:ytTaTey5sN2nUkJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499439, "uuid": "ff4fed72-9011-4fac-ab19-c234a9d875c2", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499439, "uuid": "94b574ff-fefb-4035-97ec-323d7ffbbc0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499439, "uuid": "58a454de-19d2-411f-a52c-f85ac4f9063e", "value": "06bde299245057b84e2769125c5ab033.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58486a1-11eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687541455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541455, "uuid": "d131a002-49ca-4de8-9718-e0fa89988f9d", "comment": "Malware payload", "value": "e6805c45e465820a0f8ceb4f639eeebe", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541455, "uuid": "f4ac08d4-25c1-40d5-90ce-5b0792a4e6b9", "comment": "Malware payload", "value": "1a6fa913c1c900605ac2a9d536891b4f7b3f73ffb551cfdd027196ec6feb4a49", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541455, "uuid": "a14a9e05-2579-4e33-a74e-e8d71a5009b7", "comment": "Malware payload", "value": "6de78d43c26d06d9695db4da2b678a914fc5125d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541455, "uuid": "6743516c-5335-4e0d-a49b-8db624c87828", "comment": "Malware payload", "value": "4d4dc08a845f9c46586fc7ff3059721494a350dcf16844ff6d8416271121de212ee456d31ac5b94f0f4405b064fdcf10", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541455, "uuid": "187a3cd2-e015-4525-9dc2-73fbe2403709", "value": "T17815C879698332334A5B207ABFAE64D5B77681A8034D90D4780D83A463D5F2583BFBDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541455, "uuid": "b9bc0b12-9656-41bd-b716-e29cbc75b526", "value": "24576:9Hti28t7FksL23C3z4UwXUbaivdM7CdFIh5xS8w7xr7kBK:Jti28t7FksL23C3z4UwXUbaf7CdFIh56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687541455, "uuid": "672ac267-137f-4ae4-a19b-c7cdc989f372", "value": 910146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687541455, "uuid": "517b32d6-0690-4f5a-9451-4b3a099f82fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541455, "uuid": "7823e533-af90-44d5-b223-60beeb87e459", "value": "ACH-23-06-2023.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c25e65a-11ec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687541788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541788, "uuid": "95ac0ccf-7065-4fe1-92e6-fca41d2a22b6", "comment": "Malware payload (Quakbot)", "value": "24b0f0a51d1c1f9b3b10463e9ef556d7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541788, "uuid": "bc175e4c-a02f-4faa-a787-40b0667bd429", "comment": "Malware payload (Quakbot)", "value": "1aa91398494318a34190460c5be2993a078ef977e9eea95e6c607a5bf5c5ba8f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541788, "uuid": "0644fe94-0abe-4265-837b-283deaeb8e85", "comment": "Malware payload (Quakbot)", "value": "ebd246e154efe174b2c9762aac13ebf11c5e4a24", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541788, "uuid": "69aca75f-3b0d-4141-953e-7bb158c857c7", "comment": "Malware payload (Quakbot)", "value": "975d62ea7b8d4d82a39a666a09db2678c38c2f9d8ef22d49b2b1e632ae755e7275fde603a3ad308717fbbfb44884bcdc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541788, "uuid": "6150eeba-dfdd-4862-8254-ab1dfa5b9b65", "value": "T1EE558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541788, "uuid": "1999bbd5-a0eb-4c1c-a04b-a81cb28443c6", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541788, "uuid": "c14fd492-bf17-4e64-b88d-03ac9dea2f31", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4yOQ:QbkS7XB1EsOSNPSp0EAt2bUeM4yOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687541788, "uuid": "86cc0de2-a726-44d0-878d-e72aff786a04", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687541788, "uuid": "481cd6fa-d76a-405b-ac53-fa8e3dc84278", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541788, "uuid": "611e9377-2b2a-4cd9-a4e7-8334eabdfce1", "value": "04qbot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81adae09-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500995, "uuid": "d0571007-1f29-4162-8b96-072fdc8b48f8", "comment": "Malware payload (RedLineStealer)", "value": "d40df2a5d86467b09a00b54f5062bd97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500995, "uuid": "a8697bdb-ac95-45d5-a196-b068a786e4de", "comment": "Malware payload (RedLineStealer)", "value": "1ab510c0f5b3d21010c9c733a65a68db4cb1c9ecf3a2e9e65e7a16d39b35b0cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500995, "uuid": "b80343c7-6713-4cce-8c8a-37b7a40160e1", "comment": "Malware payload (RedLineStealer)", "value": "689ead692d1f222c2b3c9aedbe1de2bfa4ba0bcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500995, "uuid": "dc62e378-c8f6-413a-bd64-b746bfa08bf6", "comment": "Malware payload (RedLineStealer)", "value": "5c62868315c1382117ed5002803d5ac1ee624051f7dcca0f6fc782f88392d82e7f233dd819cbd4cac753dcaf29a43b5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500995, "uuid": "810dd1b1-8d70-4534-bb9d-85aabb8b6b0b", "value": "T1EAB4F1C52A404973CF23CEB1D8EFF9D64F7571210B614AC7120E9AFA8E452D0A61B67E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500995, "uuid": "596f4c44-5175-4210-b3f9-588c0895ee53", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500995, "uuid": "72ef1064-1ae6-4406-9ace-85d42d0dda5c", "value": "12288:rEFHnTey5s27ZS+jG2EOoKD/06OO1NwIZdQJQmZ:rEFHTey5ssS+j26NfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500995, "uuid": "339e5efb-d913-48dc-a181-c3def623ea9b", "value": 540992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500995, "uuid": "11d08220-a71e-4dc8-9983-57df9832bff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500995, "uuid": "e483c513-3087-49db-9b0b-19c9207d8317", "value": "d40df2a5d86467b09a00b54f5062bd97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76dad919-11b9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687519875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519875, "uuid": "20541ee2-93de-441f-8930-457b0d26c184", "comment": "Malware payload (AgentTesla)", "value": "2e2755f000bb9f87f7c076d39ffffb3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519875, "uuid": "45e2fa7e-a675-4e07-a6c2-713a41a2e243", "comment": "Malware payload (AgentTesla)", "value": "1b21c2bec0bcf3df0a9d83d5c3e708d0a9590b8a5bf85371d9a826d7bba3b457", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519875, "uuid": "e84c9d1a-6208-4855-a0be-f9b757314c0a", "comment": "Malware payload (AgentTesla)", "value": "d57527747d01bbfa58f55881467d342c124afbb0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519875, "uuid": "3bfc6149-3985-4842-a7a7-493f0ad0be4c", "comment": "Malware payload (AgentTesla)", "value": "85506cf013da19a6e8345c1d27cb4243bdc90fdec033f74e66f71e497f2cd6398a789a930e11584965e92327c690d14b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519875, "uuid": "d1cf8e6b-b84d-49b9-96a8-51601c995d03", "value": "T15CE412EE72C40ED6F1689F300DA17238537929455350AEB98E82F9D93E91B120473EEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519875, "uuid": "c6912ea3-a698-4adc-970f-1879f70da2b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519875, "uuid": "92c8cdda-2591-4a59-ae20-0a4302f20448", "value": "12288:NKk54/mNUAnq6fOrk2Jn0nAc0Czb2t9fT3dRj1qmsoeARZlut7no3s:kk54/QUCmA2mA7gmlemA7no3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687519875, "uuid": "503dc2db-6384-4a2e-88d8-82023d146134", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687519875, "uuid": "a7d09490-106f-4a12-898e-11dc4ee28d28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519875, "uuid": "1d94b210-c97f-4531-bd56-5854075a1edb", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803c9cef-11ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687520320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520320, "uuid": "8123c806-738e-494b-adf2-702c3785f24c", "comment": "Malware payload (AgentTesla)", "value": "5f6bab9e5af009e85c557cdb4482b9ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520320, "uuid": "1015230b-3eb6-4bba-b5a6-0beb2b9e3d48", "comment": "Malware payload (AgentTesla)", "value": "1ba6f7ec607829c69af7e290cddbf57ac86c6776ea762fd32b89403fcad35c39", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520320, "uuid": "c88455a0-f249-4d49-9082-e549df35b64e", "comment": "Malware payload (AgentTesla)", "value": "733dda86e18a7f52aae4adeb8091ca07a765f6bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520320, "uuid": "32815368-71a4-488e-b0c3-9c81524dbc27", "comment": "Malware payload (AgentTesla)", "value": "a0bc45fe8dc1622e4e3ecc651bf3f6acd2bbeae708285b6059ed9890218d139e993b4ef648a51cfca77db81db6bb3a94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520320, "uuid": "2898aa59-94a5-4e1d-996d-110336d854e7", "value": "T152C4AF3467F44F26F2BE6BB5A5F310108FF4B689E11AE78E1D8018DA6853701AD51B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520320, "uuid": "15328fe1-e10f-42a4-9d5a-38108a500f06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520320, "uuid": "76cc43cf-e23c-4a4c-8358-af6d37a81dbb", "value": "12288:dbmqRZ89NNZDGiQ8CLG8T3f/k8yVqZGkN43rxamD:hRZMXDn/CLFP/lSki8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520320, "uuid": "7dec38f5-aec3-4cbd-9229-5238af8fce6b", "value": 590336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520320, "uuid": "b513c2fb-dc2d-4aff-8073-c963e8a82629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520320, "uuid": "21a14147-bc52-499c-8a47-611dcc9aaa51", "value": "S\u00dcTA\u015e GRUBU TEKN\u0130K MALZEME SATINALMA UZMANI'DAN SATIN ALMA S\u0130PAR\u0130\u015e\u0130_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0398059-11d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687530789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530789, "uuid": "ec1d4c0f-d2dc-45c4-8400-10a27f7953cb", "comment": "Malware payload (AgentTesla)", "value": "f01bdbc4e97c2a1886094c3fe2092448", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530789, "uuid": "be80af2c-9366-4d4c-aa30-9fb3dc725283", "comment": "Malware payload (AgentTesla)", "value": "1ba924a1929390c208baacddcfa9ad01b115234fb5e699848bbefa2144c6f9f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530789, "uuid": "ff68a4c4-413b-416e-b7a6-d183cc46d669", "comment": "Malware payload (AgentTesla)", "value": "4e33a3a1382c4804c12ef43868f97c73acf57f09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530789, "uuid": "a92aaf8d-eb5f-4757-a169-d24f021a9fb1", "comment": "Malware payload (AgentTesla)", "value": "60c982521c317561d71adbb51795a6e54c52c90d4763f2d5299ded0666c71c173abd37987e92516b6f9fbdedc0640e37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530789, "uuid": "8d6628c3-3192-4344-aa5b-46f42bf83785", "value": "T1F2E41219A9B44D74EA7A1FF991B24061CBF5EAA4F703F34E1EE431FA05A3B005A43653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530789, "uuid": "fdc9c6cb-7e7e-494e-8238-d9dbf263588e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530789, "uuid": "5ee3dd82-2f46-4e40-b39e-a33b83a52835", "value": "12288:gfM2iNh4/mNUA/JJpEEomkjHkapBLcypPddhK3OuhKBVInxoW:GM1D4/QUsEEcjEmBLcytxK3OuofInxoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687530789, "uuid": "0eac9c6f-95e7-466b-af45-472057ab3e05", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687530789, "uuid": "a50de30b-26f2-49ab-b1c9-2e81f6a9dfc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530789, "uuid": "830c131e-e833-4752-a13a-d0a21b3f4c2e", "value": "rPAGO_4536222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a5af8c-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499141, "uuid": "fb07c807-238d-4d55-a3f4-63abd203af06", "comment": "Malware payload (RedLineStealer)", "value": "0dcc76b35bcc696ae3e3a6521768156d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499141, "uuid": "83ffee39-b9b8-479c-b660-7dd0d52b9af7", "comment": "Malware payload (RedLineStealer)", "value": "1ccabf5964ce97fed57ef4518d097cf9771e1b4db3a9fcd4090dee6db88778bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499141, "uuid": "0f40f643-787a-4452-903f-619f8f8330bc", "comment": "Malware payload (RedLineStealer)", "value": "3f985a8fc1814772b557a9f28c576e7c35814034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499141, "uuid": "76a78b15-7e81-473c-8c81-09491cbf3351", "comment": "Malware payload (RedLineStealer)", "value": "8d7bf8de6437ec17a3d04f929c74a90b8d3b42329def2c999b57f89f782f518f0cd7aec3c4e85221a15139f71443ab50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499141, "uuid": "675edecc-d96b-4de8-8683-65008df508c7", "value": "T1CAB401CA25408963CF33C9F1D8EFE9974A7A70314BB24BC7120D59F64E052E4A61F67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499141, "uuid": "ce3beb05-27b0-44f2-855e-5aaca2d3343b", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499141, "uuid": "1021c693-314b-4508-a589-489cc4295a2b", "value": "12288:sxE/7Tey5sTyrTc71ebypVauoDUdGJmX7oqJ7QJQmZ:sxEjTey5sTZ78OvauoEGo78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499141, "uuid": "f18c96af-6866-4e17-9dee-aeea33e0696d", "value": 540992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499141, "uuid": "08c99437-b20b-49ba-afcc-1f66f6f075bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499141, "uuid": "18d191c2-07d0-4045-8738-40bd14ddf492", "value": "0dcc76b35bcc696ae3e3a6521768156d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8de0775-11bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687521301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521301, "uuid": "106411d3-3763-4e63-af19-e60ab812ad40", "comment": "Malware payload (RedLineStealer)", "value": "8f672718e1b504fd4bd3b8f158fa7011", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521301, "uuid": "371d5a5c-dd8e-48f6-a5ee-b4fbd0e58719", "comment": "Malware payload (RedLineStealer)", "value": "1d0734db421451d1ed079c72f1fb3147c510f5b0df01d75af1a023968fd804cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521301, "uuid": "c7f9c2db-ccc6-4258-9c2e-d91f92c6b6c9", "comment": "Malware payload (RedLineStealer)", "value": "954188cbca748c1889120d7fcbfdcd8ff8639d34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521301, "uuid": "5144331f-8975-4c68-820c-6fc35171af12", "comment": "Malware payload (RedLineStealer)", "value": "399feca2bb25df283621ff03776c608a1d6c7575666e4cf7eeca0b0e434fa42b26ddaae366b1bf4817b1a5f7412a1463", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521301, "uuid": "b5d15416-debd-44e2-9ad9-58f34a7f1bbc", "value": "T10304C568364B697EC9AF483D9C700CD1667C7CA71246AB078C8EF4E83D3A7919B151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521301, "uuid": "4b38acb3-77d0-45ce-b948-b772d59753af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521301, "uuid": "6f48d318-e73d-443e-a1e5-2f6e2901ff8d", "value": "1536:RuZXJp636sv0W7T+d39NnrHyFrYpJ97vvx7dxNEDYQ7pbuFOeK14Y5oz0GkRw8eU:UZ5p8gNNuZOP7ldxNhgyK35ozj8e8ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687521301, "uuid": "6174f1cd-07c3-4262-8ba3-c1ce164e315d", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687521301, "uuid": "bc53c7ec-7ca8-4385-95af-28f613c0902b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521301, "uuid": "c0c92175-8f25-463a-8967-e020447b80c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b051664-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687510326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510326, "uuid": "51b859b8-d233-4f07-9227-f3cc4745b2b5", "comment": "Malware payload (RedLineStealer)", "value": "d2eedcf74140ef4e37c5bfa07c728621", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510326, "uuid": "c5b6863a-627c-42b0-b881-f10f1547ceb9", "comment": "Malware payload (RedLineStealer)", "value": "1d61ce01a76c77bf21fd50558642cc009373538361de664b9ed12229e5a9ad72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510326, "uuid": "b1a47791-2abb-4a38-ab12-681539fb2d5a", "comment": "Malware payload (RedLineStealer)", "value": "07db35e7ef107771ce30f8c45e37f85da4fb45b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510326, "uuid": "cb18ca78-6e87-45d8-9a9b-d0d6adcc63f5", "comment": "Malware payload (RedLineStealer)", "value": "309fabe2de3a1682e97f7381900dd7a8ae969004cc9579d2de866c892dedb7cf12c0de0c1a01a03c45c8c434d6b1e7f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510326, "uuid": "a9492446-47fe-4161-b34f-1004211ab2cd", "value": "T1A4444BFB52D1D460DD0FA4B02C5EE1BDEE30B461DEA284CA1ABA0952D3534E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510326, "uuid": "4b5ddeea-b24c-4352-8384-8ae6d28b23ce", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510326, "uuid": "d6bdacc4-4114-4315-a2c2-0958240d2ff7", "value": "6144:tT2+chaigt0poiRG/XvLNUgYhuE22iQJQmB:tT2+cfgtAoiRG/fSvaQJQmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510326, "uuid": "0dfdbc91-8939-4420-a8bf-e72cfe2efc30", "value": 275266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510326, "uuid": "9774bf44-cec0-425e-b67d-9122f3e63f73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510326, "uuid": "1476f137-9530-43f8-8d32-209133803fbd", "value": "d2eedcf74140ef4e37c5bfa07c728621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72066188-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500969, "uuid": "dbee20e2-262d-4226-bbcb-c473bc507733", "comment": "Malware payload (RedLineStealer)", "value": "b858aa23b37a10296f27ca540ff03da8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500969, "uuid": "7978dfb2-e04b-44e1-8fc7-18ff106e2b01", "comment": "Malware payload (RedLineStealer)", "value": "1d9e25dd369761d9d17df77839992b0a68e0562ac6d87d53868fd29f79df5d2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500969, "uuid": "11bba82d-95a4-4fa3-94e6-a0c8e7631968", "comment": "Malware payload (RedLineStealer)", "value": "ff87aa211a7494342d6b0afc93475acfa29ccc9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500969, "uuid": "c1cf157b-72ca-4cbf-ab00-6d61be61aef2", "comment": "Malware payload (RedLineStealer)", "value": "3574683d18bb4125c6642215ee8a7720aa3695aad64a288708841dc7c5c7a4ec159f14488bdf9e2711557159b63f43f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500969, "uuid": "514bcb4a-0ae0-4f74-8908-602d35bf5295", "value": "T161444CFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA284CA19BA0952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500969, "uuid": "4607c16b-654f-4b11-a01d-ac4eda575859", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500969, "uuid": "3ffe7c1b-072e-4943-87f2-7240854437f6", "value": "6144:PI1iJigt0poiRG/XvLNUgYhuE22IQJQmp:PI11gtAoiRG/fSvQQJQmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500969, "uuid": "b2955e07-c06c-44ab-b424-27a520dc35a0", "value": 276292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500969, "uuid": "2b158fdc-ec76-4122-b0e6-059151905e44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500969, "uuid": "4833dbb1-574a-44ac-b1fc-d0f0eaf89f1f", "value": "b858aa23b37a10296f27ca540ff03da8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464908f4-11eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687541268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541268, "uuid": "56d9f1be-9f49-4563-8a9d-d20af82e3926", "comment": "Malware payload", "value": "c952bfb849e7c10b28ad2d5b2d8733ca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541268, "uuid": "acc45967-8a41-4d86-b91b-c224e96cc11b", "comment": "Malware payload", "value": "1f1061794ff11a606c58e656ada94bdf23fc554b2fe234855316a0814f861f66", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541268, "uuid": "ebd2b2fb-208e-43db-978c-f6fde96ec1f5", "comment": "Malware payload", "value": "f15577c2ff578269427231dd297d97e21bfc34eb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541268, "uuid": "497b4b7a-cd20-444e-be31-2e27807e8534", "comment": "Malware payload", "value": "22823ace72f4a850b353bf4856fc90f77eb3fe09f5113811be63c0ad06fb3931b349e6bafd5351efb353995aa7272306", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541268, "uuid": "9814d145-9b3e-4ed7-b621-92d924f43cac", "value": "T12BD4CF14F581903AE4FF053344BADBFA496EB9310F346AEB6384792D4E355C1BA32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541268, "uuid": "a0ada2ce-5c44-4e06-877e-3de4f8c91cb0", "value": "b725bff7062da427984bc99c9acfd057", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541268, "uuid": "c0ea953e-4218-4fe0-8437-f9a7d9a8fbe2", "value": "12288:aDi+LwXhjkPPwVlkeqQkQaRlclGfpbjPvcyD2cdTtWv86ykB:avwoPwCQsRlclWxncCv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687541268, "uuid": "07ff4dc3-d0d1-49d0-b101-b12afc3a46bb", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687541268, "uuid": "c645dc37-f62b-4d96-aa4a-c3a41b406380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541268, "uuid": "20af4002-b97c-4684-a333-4700a0b58116", "value": "SecuriteInfo.com.Win32.TrojanX-gen.3255.10540", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04081ed-1221-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687564693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687564693, "uuid": "5302fba3-8bd1-4af6-8468-95fe0ec95482", "comment": "Malware payload", "value": "abbf1ee343b1cdc834be281caef875c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687564693, "uuid": "c03c12fa-c8f0-4fd1-bc09-d8859edacf18", "comment": "Malware payload", "value": "1f479a220e41be1c22092d76400565d0f7d8e890d1069a2f8bbdc5f697d9808f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687564693, "uuid": "5de2e7da-90c6-4020-b2e5-2acd0174f934", "comment": "Malware payload", "value": "b72ffd7f63d4ad1de95783b7cf1ecb89cdb0056b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687564693, "uuid": "8b04f39c-009e-4bb1-9d59-30db93c46d8d", "comment": "Malware payload", "value": "33f225994535426ef6bb73500af49144cb7a66f4bae5545d6a53008234c5239f8952963e5f7d37dfc97ca3556d06ce83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687564693, "uuid": "afe8483b-9928-43b3-8c51-f59147fb2ed0", "value": "T11DB63343B6DF15DEC0488631C15A61C43881FDFECE77BA5D2B85BB08ADF5A28198B472", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687564693, "uuid": "dcf9d3a3-4881-43eb-9c2a-36cff194bc8c", "value": "f776710de15d02f8fdd34319cacae5d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687564693, "uuid": "47b588c7-9585-4c87-b284-7a71eb6894e0", "value": "196608:6mvX/qe0bIRa0IngHcCkIiwe7anEXQ8Lt/NF+:FHrQ/0IlCkCe7aDYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687564693, "uuid": "8517e0e4-3c77-418e-bd13-85133c85de0f", "value": 10816512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687564693, "uuid": "bde63576-0538-493a-b3e1-fbaed7cc9f0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687564693, "uuid": "da6f626b-96eb-4baf-a4db-30a8082d53ec", "value": "java.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edd855a-118f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687501876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501876, "uuid": "d8f07c06-5691-4924-9ced-175acbebce2b", "comment": "Malware payload (Mirai)", "value": "7473d5c668f807ca5a62b1fc97ae67f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501876, "uuid": "05698660-6650-4f86-85ee-ba03c324faa0", "comment": "Malware payload (Mirai)", "value": "20e864423d3e3107780118125f197d01119bec55d2f6862954e69ad1dec1e98c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501876, "uuid": "aa693baf-773c-4cb4-9fd6-55c46c33bd3a", "comment": "Malware payload (Mirai)", "value": "29af21d936c574d27c412bfc77a44d7ea1b2f3c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501876, "uuid": "4e60d620-548d-461d-9042-9a5d8cd28a2f", "comment": "Malware payload (Mirai)", "value": "b2d270edd6cb51fba0e663bed0e20396bd5adb11a70bd6592fb693eab9d4560e47169dd96a557d9bb503aaab0c90ec36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501876, "uuid": "b2777e90-66dc-4bdb-a9a0-8f78d04ab41f", "value": "T180D2D0AEE57441C9FD8D5C7E84CC3BA00E19E581231BEB5267228C4D5B36C5BF16A4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501876, "uuid": "23a30008-ac99-41ed-9b9d-4f6882c6f583", "value": "384:e8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjF59RWGVCz0Nv+:jMYHb62x4ahQ3CfdwLj4Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501876, "uuid": "4f42ac59-855b-4769-8c5c-fe193e256af5", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501876, "uuid": "3a917128-ed3e-484f-8b59-92effd41c99d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501876, "uuid": "be2a8f23-f07d-478e-8152-d74ab8757cea", "value": "7473d5c668f807ca5a62b1fc97ae67f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321e5d0d-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687510311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510311, "uuid": "b5d281a2-9570-419b-88b1-c1375bb7f51e", "comment": "Malware payload (RedLineStealer)", "value": "3004b1477e88ef2c194f3a57428fba2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510311, "uuid": "5d83e537-e446-4867-aa6c-33bdbdc5634e", "comment": "Malware payload (RedLineStealer)", "value": "21b2d45dc404f09feee230412dc45ddb12073b943bc24d1c9ff3ac5f19c210a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510311, "uuid": "efe9275b-233f-4501-99d3-3a2f21106145", "comment": "Malware payload (RedLineStealer)", "value": "4ff91aae6c10a9f393a685f4d68c9a0697164a24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510311, "uuid": "1dff98f1-23d4-462d-9f44-92b2d18effc1", "comment": "Malware payload (RedLineStealer)", "value": "43202c4aeb59f891ae82111050381c13234bb7a5634a292d166abcf638e927a97f36fdce95725ddc6d1083ead733dda1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510311, "uuid": "6dba82fb-141c-4149-9994-817768179e13", "value": "T19BB4F1CA21408933DF23CDF294EFE99B4F7A713107718B87120D49F64E551E4AA1BA7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510311, "uuid": "e3e8965b-abc5-4ef2-bda3-a5719e5acaab", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510311, "uuid": "afe384cf-7d57-4a6d-8c77-8a9d01666e83", "value": "12288:Y4mO1iUJR7Tey5sLxwcubJWB14HI6V94pFVvpkdvoNCnk8hfMQJQmZ:Y4mO1iUJFTey5sLxT2AOHI6V94Do6CkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510311, "uuid": "a40755db-dd24-4405-bd20-61460fda7017", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510311, "uuid": "89c274e2-cb98-46ff-b84b-db1504cbdfbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510311, "uuid": "c7fc9d6b-01f5-4492-b847-a00e2e1a12eb", "value": "3004b1477e88ef2c194f3a57428fba2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb16a86f-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516634, "uuid": "9187c208-594d-40ec-849a-ac316d1a1ad2", "comment": "Malware payload (RedLineStealer)", "value": "d4ab7c397f123d50624fcfff2ecc4ece", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516634, "uuid": "35ff0c2d-8e15-4d13-a699-372c1c22b4f4", "comment": "Malware payload (RedLineStealer)", "value": "22413d03ff00d237bebf7b269c7c6c83d1ffe79a341d9576e7f80fc2b42b066e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516634, "uuid": "9349d3a3-429d-4252-a8fe-11551657a640", "comment": "Malware payload (RedLineStealer)", "value": "3f6d846049e304db49fa517bb4b0efa834105dab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516634, "uuid": "b66b5973-7434-4e34-95b8-a341168764de", "comment": "Malware payload (RedLineStealer)", "value": "031eed40d0b57cf0be2817223080e7eb0b380b7b8edcd2da55489dfa0336df7c22d597e2035a8189c2de823c76daf4cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516634, "uuid": "2bc174a0-0670-4ee3-8f7a-54a0db0761e2", "value": "T1FAB4F1C925404973CF73D9F1D8EFEAD64EBA702147628B83220D4AF64E422D4E61B57B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516634, "uuid": "3d89d20e-a7bd-47a0-943b-f028c556d0b8", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516634, "uuid": "42eaecd3-b2dd-48ac-9e13-8c50b22ee788", "value": "12288:+U+XUTey5sAfPyqljGeux4jr1rc3/zk3fQJQmZ:+U+kTey5sAfXumrcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516634, "uuid": "018a4439-6fa0-4fdb-9ea6-dc58d39150f2", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516634, "uuid": "d8d266d1-1e66-453e-a035-37872a8c0b7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516634, "uuid": "71b2f354-b6d0-41dc-b2d1-e19c63fe026d", "value": "d4ab7c397f123d50624fcfff2ecc4ece.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbe89de-11fc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687548821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548821, "uuid": "bd3b00d7-4e1b-4404-ae2a-bf2551f7cc3b", "comment": "Malware payload (Quakbot)", "value": "89bfc874d4a74e2b353378e7505824b5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548821, "uuid": "96d03344-0ea3-4fc7-96a4-e68889e0a60d", "comment": "Malware payload (Quakbot)", "value": "2270d9b08ecb65e01b8a490dede9b1480431bdfaa052cecc54a1231fe56e655a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548821, "uuid": "b6bfbfc1-7828-481e-b949-7d9a2e9a91aa", "comment": "Malware payload (Quakbot)", "value": "80a8d82b5435e27e10dac56535c95cadaa8a55f0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548821, "uuid": "fedeca5f-3328-4394-a60c-6d56cb4d5e37", "comment": "Malware payload (Quakbot)", "value": "0f1f56d6c494e02152cc182055c08fdb7c62d78645e8d50ff032b31059deba3fdc49f21eaed2d794b37370676ae224c4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548821, "uuid": "4cd9ba6b-3825-457e-9332-75dbb7fc5da1", "value": "T12D74496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548821, "uuid": "ec6f6fcf-132a-4ae3-96da-3e9db3c3a1a2", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593a:fIS1xbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687548821, "uuid": "050082c0-7e02-42f4-b8f5-95c515402f83", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687548821, "uuid": "be0c8f34-3e71-4cbb-9c6c-f658b3606016", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548821, "uuid": "a7db3ddd-5916-48d8-8c8c-a3278103c2fb", "value": "BSN-131612313.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc0ca35-115a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1687478927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478927, "uuid": "a398e758-5cea-4534-bccc-a5e81bdd0027", "comment": "Malware payload (Stop)", "value": "4f4c45679ea2a51953fee311277fa4cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478927, "uuid": "d6192053-5b86-4cd2-b8bf-b601603faf89", "comment": "Malware payload (Stop)", "value": "23638441c0ede5ba7b8be3f63c2cc2d0d69882e7d01720116f94d56388eb0cef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478927, "uuid": "07988178-545c-497c-9585-4765d9e132f0", "comment": "Malware payload (Stop)", "value": "418cf86f4475ccac055853b308b85116befe98cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478927, "uuid": "2e777fbb-0560-4099-a831-9d82dbb337b6", "comment": "Malware payload (Stop)", "value": "6db3046216487bad75e3dd686966c7e28d88407f45257b79c797bae5b11b93b86d5be70e1a4e5615170c5599db6d4a98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478927, "uuid": "395440a1-1f31-4e30-9f3a-a8bd29bdc8d1", "value": "T144F4E117F2A23D90D916CB72DE1EC7EC7A1EF5618E597BAE22188A2F0470072D173761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478927, "uuid": "5ab51247-bb63-4a4b-a5c9-2b4b3481bdbd", "value": "b007a513e8535ccdc15870a09f4ce9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478927, "uuid": "4b871dc5-b772-4448-937a-042ae6acdbcf", "value": "12288:tKFUQmYTGYNbIxXQOkJPi+qEWEDWSkRiC/FK6OPuL2E83HcEL5F4/l:wFUQpCY2vmdqEWEDWSkQC/2Nrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687478927, "uuid": "b5798da4-1933-4261-b195-01f81d923004", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687478927, "uuid": "55709196-af13-4fa5-8c1c-07e39df84b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478927, "uuid": "bf7b3a51-8de1-4bd9-8185-559abe437e3d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0daf9b-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500369, "uuid": "af1a6e49-0077-4af2-b37a-cbc95872c7f6", "comment": "Malware payload (RedLineStealer)", "value": "9afca5d99fb01ef7db155c928a762f3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500369, "uuid": "69f25091-ddb5-4355-8a28-2d3c3a0d17b7", "comment": "Malware payload (RedLineStealer)", "value": "23d035fa534c2506800ada801a55d7bb224943c5adae862158c710a974039331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500369, "uuid": "d65fdfb4-5f81-4abf-a1e8-3d056c3d4272", "comment": "Malware payload (RedLineStealer)", "value": "99538e088efb091e3a3aae9d368aea664a645e55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500369, "uuid": "84fe8e51-8ea4-47d1-9703-6e7b94ab1798", "comment": "Malware payload (RedLineStealer)", "value": "d014f4420e5b49e1ede01625b4dc5930666f04a0e42540060501c15ccf48f4a0fadf7b0a3b1f77370045ec0b3dbc2a4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500369, "uuid": "e299c8b8-4bbd-4c02-97de-5d50aaaffebf", "value": "T1B7B4F1DA25804AB3CF73C9F0D4EFE8D68F3A61210B6547C7230D86F98E416D4A61B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500369, "uuid": "d280b45a-70cb-4a9b-ab03-ce495851c049", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500369, "uuid": "87c12205-87ee-4720-b1bd-e0c26ef5b7e6", "value": "12288:y4ruNTey5sIU+hywMyG5RhRr/Ydf7ffvdQHQJQmZ:y4riTey5sIUEy7yI9/kTvdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500369, "uuid": "63370e5b-bc2d-4b3f-a667-8768cc5d5204", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500369, "uuid": "92ff7e48-777c-4198-a734-28601c956453", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500369, "uuid": "5ef044fa-9a5b-4073-9462-37b09c95f0eb", "value": "9afca5d99fb01ef7db155c928a762f3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc154f09-118f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687501952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501952, "uuid": "65cab6d5-6cce-48f6-abde-8b0826b62141", "comment": "Malware payload (AgentTesla)", "value": "c66f802487934ad724d3eee407cf0898", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501952, "uuid": "803f939b-4397-4e9a-8205-c56c7497b3ad", "comment": "Malware payload (AgentTesla)", "value": "2404b8fb262a03afd37e6d702b0f821552a710608246551bdc280125a3afe8e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501952, "uuid": "8bce9be9-58f1-4add-bfc1-c667ebc82026", "comment": "Malware payload (AgentTesla)", "value": "90d437388160f4d03cc1a8cb73442d7dc5e2ff44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501952, "uuid": "56ef5375-a81f-4519-b88a-f7357d2cb8f3", "comment": "Malware payload (AgentTesla)", "value": "5c6be975ce02458e4fb11e48094865479485572b1fda704db6e7c78172206cc471a02f64bc576fc01e49a671552d34fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501952, "uuid": "9249dc03-44e3-49f1-9a9d-5f166ae73939", "value": "T1FA7423076D5475BBCB0EC44BBBA92473F98C5006910294FBBE03BA13F49565ACA71ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501952, "uuid": "59b67851-800e-4867-8c7f-09f03e024d34", "value": "6144:4DLXeSo5/HEAxwI0RdJ4VUkprKVp6SKLdr+m3n/hbDhOfC0Y7dGb7lxiXg:OXeS0EA6bfbRKLNBPdhOPblxiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501952, "uuid": "05787491-329f-4707-a218-4a6bd23da336", "value": 360904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501952, "uuid": "13900be9-b438-4961-a24c-1112185e43f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501952, "uuid": "edc57bab-0eb2-40a5-b68c-28d1083a856f", "value": "Remittance Advice MEDU2464960.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358fe8ce-11c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SystemBC)", "timestamp": 1687524490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524490, "uuid": "738ee621-aa78-40dc-8f50-6f69672cde02", "comment": "Malware payload (SystemBC)", "value": "e66dec71ef0ffbb33127f41b8ab1fe3e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524490, "uuid": "b56234b4-c0ee-4fb5-b804-689b5a575e7b", "comment": "Malware payload (SystemBC)", "value": "240ff64b312acf203a1498a58801bf79ad99617e7dbf961c6a289531d1b7b39b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524490, "uuid": "3a64ac48-28e8-40cd-93fd-6aa9e62358fd", "comment": "Malware payload (SystemBC)", "value": "719e12ef09b6e3ab747421946a57739a649cf483", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524490, "uuid": "7d49419e-381a-4603-b5d9-8a7c8fa92e50", "comment": "Malware payload (SystemBC)", "value": "0f906d0316a6e2f9d70ff88ef6a792c2ab0d66be95fce9a3c53919055591516933b3378a9a9948c6b03aeee745903f2c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524490, "uuid": "be920796-3c35-4086-9676-295376e238e8", "value": "T14365339C2960062FCD30957236FFF287ED97137CA58131AF7B453A3D8A2218F9A9495C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524490, "uuid": "0d5fc2e4-d05c-4b3a-8487-7c40df632187", "value": "7e60c38086d25d57354ecdf04c4b17ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524490, "uuid": "b7bb7e03-8ada-43c0-b953-09d4b69ab98d", "value": "24576:7UA0Aa/NF9BpvbxxQO/Wh5ChSNF3PWjdCXpKO7Yq8EMHOS8NdOBG7QTOTzgZrkQ3:10xlbBpvHb/Wh5Xv3OjdKKOj8ErRNdu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687524490, "uuid": "421a3c02-415f-4939-a4fc-00b698ca562f", "value": 1532800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687524490, "uuid": "606db73d-d9a3-4684-b72d-4784b75ddbbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524490, "uuid": "7613c892-77d8-45d3-b622-a24fdab7f00e", "value": "e66dec71ef0ffbb33127f41b8ab1fe3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd5e367-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687510307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510307, "uuid": "692b610f-4fd4-4712-abad-bea0f37f020c", "comment": "Malware payload (Amadey)", "value": "4dd02c4b87126fe30fe988f2b636bf82", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510307, "uuid": "8d59094e-1b07-4387-baa1-7e78bd2c047d", "comment": "Malware payload (Amadey)", "value": "2431c3837ebec51fb1d7ff14ee9e86a93302bd5e77808da655cffd2a75c86e60", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510307, "uuid": "c4740700-774f-48b9-8e61-dd513792a7d5", "comment": "Malware payload (Amadey)", "value": "cad98b9f30b132986177f5e7c04dd7bab5d8d1c1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510307, "uuid": "97d8a0b0-b0d4-4e57-9147-e39dd358dc01", "comment": "Malware payload (Amadey)", "value": "4631296c482c551107339518a7be84f38c9f36acea013c5463cf1f41855737edbda916437dc86751a2f339ce465970a5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510307, "uuid": "0e9de06b-66bd-4a08-8f82-e2dfbf9b2300", "value": "T1EFE401CA61808563DF77D9F2D4EFA89B8FBAB1210B3147C7124C49F94E046D4A52B93E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510307, "uuid": "2e3af919-a04c-42f7-908e-6090e9c972f3", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510307, "uuid": "4b1ea0d7-93df-4ee1-bcee-1897f385955a", "value": "12288:Aqm+wTey5sML8beM1LMxbTC8oTFvx2BYeN1wypKTylzL1aLXU4HE0Ew7FYQJQmZ:AqmbTey5sML8bN1KbOF5elN8rU4HEXwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510307, "uuid": "84484038-86f6-4695-aad4-367c11a0345a", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510307, "uuid": "c0ca5ceb-84a0-4754-bb39-ce0c41b7355c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510307, "uuid": "762cb15b-5860-480d-898f-8339aa295b78", "value": "4dd02c4b87126fe30fe988f2b636bf82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f88e24d-11be-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1687521957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521957, "uuid": "0c7ae001-14a5-4cee-9f75-f7307019b175", "comment": "Malware payload (Vidar)", "value": "b7d01a879e1cf999d877f6b3a57b5c6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521957, "uuid": "8a190aed-a592-4378-b7b1-2924dc436431", "comment": "Malware payload (Vidar)", "value": "24936d72b755bf71caebae9e63bd4344166aeb6671e0e7f20082aa1b43c9d0e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521957, "uuid": "7a58e4e3-3907-4610-b7c4-1d2c4d2997f7", "comment": "Malware payload (Vidar)", "value": "28d09de89eb97982f268a7cea9f3b51859744b3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521957, "uuid": "50ec2f30-db7b-4fc4-9cca-9c3bfc2a36de", "comment": "Malware payload (Vidar)", "value": "14659c8c3cacc3121fea64f3c8116f3e5073a0dc1cf70fa6c4e4523b9072ce0a2a72d9c7e89d52afc15d231b2ad93fec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521957, "uuid": "2a4f7c81-6207-4d92-a1a3-c8ada84a720b", "value": "T1D736129222014D66F2ED4E35B53BFEEC25B6CF95EA814436AFD1B8C6B171DC0A513823", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521957, "uuid": "db50f678-89f1-4bd6-868c-d085ae3a69de", "value": "7e7ed246286996734df66f59a698243f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521957, "uuid": "6b9425f6-d3ce-4f87-9b59-a53699cae0a0", "value": "98304:K3vIhtQ5HV+StW1RZ7fIS0Yjjk9bbOEVSGW4adB34k1CVn:ciKAS01R5QSPk9bbOEBWRBokMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687521957, "uuid": "25c37531-e5aa-4af5-a5ee-ad516c4d9094", "value": 5340248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687521957, "uuid": "c5f50ac0-f8cc-4171-8dfe-4ac018590ca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521957, "uuid": "247f98f8-6bd2-4f2b-83f1-afcf6e7f3ee9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622fbbbc-11bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687522417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522417, "uuid": "8543524d-1914-4706-b230-19c054f0108d", "comment": "Malware payload (AgentTesla)", "value": "7105b5afb5ab65cbe5a9ee0d8aa4d77f", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522417, "uuid": "d9e5111d-6d57-4a74-9027-dc888aba8ed4", "comment": "Malware payload (AgentTesla)", "value": "25ca238e8842564fad9b6fdbad3cfc91d17f806015225dce42e59732443de9e5", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522417, "uuid": "cf366cab-14ed-49bb-9f9c-a6cdb4a71b5e", "comment": "Malware payload (AgentTesla)", "value": "27bfbe5e0586a829a41c006265fc8917a68b02e5", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522417, "uuid": "57143766-a04b-4651-b9ad-b03c1ed237df", "comment": "Malware payload (AgentTesla)", "value": "cf39dc4e79b76414ef372d443a6b528cf5249e14ce349a9669edf0cc81b84f04828389448d93cde89bbceed35f87079a", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522417, "uuid": "4f675c1b-beee-4a3b-9bb0-9c1ffacec776", "value": "T147A2C03180790C6FC5C33C812F1BEBAF734969A9E564A75CC9C49C5DB259904BB358F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522417, "uuid": "7582faf8-15de-4048-8fb7-d35ebd2727ff", "value": "384:HbZepEJXTq5+EHu3ymTkgmoN2GzCtescCeqKTdtx2yneOI307cBbHiuQ7F:2ENnEHu3yAk+Tzik1dTdtx2ke1YF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687522417, "uuid": "cea5c759-3ed7-425e-b6c9-cc24e3d1cc37", "value": 22127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687522417, "uuid": "8b035b9b-c445-417e-82ff-092e4769c324", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522417, "uuid": "61432ffb-017e-486e-b020-ca758baf6130", "value": "nTransfer.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9e08f9-11fb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1687548049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548049, "uuid": "b10e909b-5e50-440c-889e-d7680bf1e914", "comment": "Malware payload (ArkeiStealer)", "value": "bbb008868de7f3705408df1a0c4692fd", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548049, "uuid": "5dbc1404-18b3-4463-b47f-33c3533967f4", "comment": "Malware payload (ArkeiStealer)", "value": "266c1f9e777b4ec933aed8ea08450a3cd66cab7b69feedbf7c9b879c207794b5", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548049, "uuid": "7c2b0dd1-7a80-4bb3-98af-478b1a9c332c", "comment": "Malware payload (ArkeiStealer)", "value": "3b64bc682b276ee93cdd406ac9ae3f092054fe4c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548049, "uuid": "140f6fd7-462d-47d4-8503-4328f936caf0", "comment": "Malware payload (ArkeiStealer)", "value": "75e3bc724d36cbb4ade1bbdaa05539810940661b8864e3bc2f8261038c96c1770797811d03258966b680e50ef8aeaa46", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548049, "uuid": "24182091-21cd-4b61-be2c-1a787103fd86", "value": "T17D848D03A2A07C51E9255E738E2EC6F8765DFA518F1937EA2618AF1F04B11F2C273B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548049, "uuid": "e6b4f69c-5385-4401-bf95-bb1ab8a2a8a2", "value": "731349064768cf8f7b6a5e7790c4d2ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548049, "uuid": "c05d1d67-7625-4c07-a9af-08204dc1dc95", "value": "6144:bKnM9HOPFudyoqXCVcR/r7s9GZd/WhBoQEHkro+4k:bKMJOPFQ/Vc9rw6/WhJEErZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687548049, "uuid": "36be8b6c-e8ea-4f00-b690-0c15b3ead30f", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687548049, "uuid": "9219b0be-34db-41f4-8a06-860fe998efeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548049, "uuid": "ab53cd64-1f3d-4f72-b88a-fcf9dc1c0007", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7907f01f-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500981, "uuid": "d4a4a169-5ee2-4508-8b13-fc15f47a665f", "comment": "Malware payload (RedLineStealer)", "value": "c3e1b9108727265f6d1ffe478ad428a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500981, "uuid": "ce9f0c46-8cb2-48a3-805d-5f45fecab41e", "comment": "Malware payload (RedLineStealer)", "value": "26d1a4c418e6d40b00650379f06e010cd2df24a4c35904615d6ff2af3c523b3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500981, "uuid": "56530257-2b17-46b8-8fc7-ed3808cf63f8", "comment": "Malware payload (RedLineStealer)", "value": "980b3c8f16ede876ecab8ada14746eeadc1b5a77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500981, "uuid": "977499f5-588e-4de0-ba4d-3dd7df35fc78", "comment": "Malware payload (RedLineStealer)", "value": "f63a5fc1e8dba6196a63c3455fb5563844a67f6cd54191a880065f1ed54eeb706662f0b2cd7e19a76f2f11b80cd93800", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500981, "uuid": "b08d8172-273d-4cdd-9abe-8310e705a62e", "value": "T1C8444BFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA284CA19BA0952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500981, "uuid": "a30720ba-22fb-4128-a684-aed79685dac4", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500981, "uuid": "09f83559-5319-4b6b-b1ff-9d463b386521", "value": "6144:tJqAx6igt0poiRG/XvLNUgYhuE22IQJQmp:tJqAPgtAoiRG/fSvwQJQmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500981, "uuid": "4a978586-beab-4887-b86a-beff82cc1767", "value": 276292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500981, "uuid": "4520538e-3a7c-4575-a58e-14d65e3b7ed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500981, "uuid": "e034bce8-fd56-4ce0-9c12-f0bdf472e61a", "value": "c3e1b9108727265f6d1ffe478ad428a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1611287-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516618, "uuid": "87212c40-0b20-489c-b4fc-7cfaa13ba791", "comment": "Malware payload (RedLineStealer)", "value": "7e6942bcbdcd0e8cbf907b5b9c261b6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516618, "uuid": "2c037db3-3b53-4334-b908-8f02c250169f", "comment": "Malware payload (RedLineStealer)", "value": "26e01ec987904bc991b4621b6b2b546831212dbadcd51f7261c3822d468d0522", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516618, "uuid": "c6c59106-1a19-4968-93c9-871b3e901137", "comment": "Malware payload (RedLineStealer)", "value": "9bade90e3ed56c98b0b7bc89965d1e64bea18f13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516618, "uuid": "76a1c7f2-9a3e-4052-8176-09ed32d4b987", "comment": "Malware payload (RedLineStealer)", "value": "c12cdacad8d69e3824cf48badfce8df17aad6740e3c3f0d0d8903295bae84dbfc704d1ecceddab5ab08526b7ffbbe40a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516618, "uuid": "32d91e5d-c0a7-49b2-8544-6fc1e095dbe7", "value": "T121B4F1CA32404A73DF23DDF294AFE8DB4E7A70210B614B87220C5AF54E455E8AA1757F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516618, "uuid": "55fb3f6f-f324-4d61-9ffa-de231a8f747e", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516618, "uuid": "096843d8-ffc7-4db6-b89a-b64630e851b5", "value": "12288:dPeIIcTey5sHORv/R2ZWp2EXCjDt0oQJQmZ:dPeIpTey5s2v/MZNES9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516618, "uuid": "358a399e-4ce4-411e-bbd4-f0c36f322c75", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516618, "uuid": "5648d2bc-aaca-47bb-8cf1-f71bf92c406b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516618, "uuid": "94d13cf7-dfbd-4b0d-a2d1-104100bdf06b", "value": "7e6942bcbdcd0e8cbf907b5b9c261b6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26fa4531-11bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687522318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522318, "uuid": "74542e2e-3147-4842-b89e-8061ae844b6e", "comment": "Malware payload (AgentTesla)", "value": "1286686847023fddf36525e00ebbc424", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522318, "uuid": "f2e7dc53-cd5a-487a-8d0b-c56d03193441", "comment": "Malware payload (AgentTesla)", "value": "2706b5e3328e52a1395d3d7877f577c39a2bdb553f707e9c42861e91441dbaba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522318, "uuid": "591e8b74-caa4-46f3-8bd7-9c3393de365d", "comment": "Malware payload (AgentTesla)", "value": "2ce702b061002a16c1a9e238d203502f0814e368", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522318, "uuid": "0237e55a-dbf4-4044-92e9-b301e4240461", "comment": "Malware payload (AgentTesla)", "value": "cec2e562edab79c18d06e49a79efc097ce9a2e3a5d0dd51732904bb10a33ac1ad33334bbf044b5a8a6262175f113ba17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522318, "uuid": "c39b9b04-2cfb-4131-be8e-6fbce0535c27", "value": "T11FF42309566F1017F0BB0B78349113B2437AAEDDB04AA0678F6773EAD5FA6C34671293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522318, "uuid": "a2b5294a-9458-4e80-bfc1-64ceaebef079", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522318, "uuid": "4442af6c-d84c-4683-9747-2e139b7213db", "value": "12288:9M1JCIQfNsVcuoQHT2iNoxnFPR6i171BcXEInvnmnOTnBsjOZLe:u1KNoT1iFFPp+dPzsjoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687522318, "uuid": "7481320a-b35d-4ae2-a8ee-c284495c3e5e", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687522318, "uuid": "ce707a6a-a4d2-4539-93c4-378bab70b1cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522318, "uuid": "1d04e3f3-e251-4c6b-a38a-0ceed9cf5843", "value": "r844633_37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6d866d-1194-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687504209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504209, "uuid": "997cd1d2-dbb1-448a-9106-c03ffac34877", "comment": "Malware payload (AgentTesla)", "value": "2fb3915f59e56ce44042d6e356e2d19e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504209, "uuid": "739910c5-6520-4358-bfb1-b55b1fdbb527", "comment": "Malware payload (AgentTesla)", "value": "270c725317f2b853d6881e7d7bab116fca000142390eeac19d9dd50d8b8c10ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504209, "uuid": "b437732b-ddb3-49ea-a312-43e0971edbfd", "comment": "Malware payload (AgentTesla)", "value": "b94fe5afdddf136e89d403d6130800b7254688e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504209, "uuid": "60b8dcc9-b24a-49d1-855d-36bd16be2662", "comment": "Malware payload (AgentTesla)", "value": "6b355bf325c78b2cee57e27f4cd87690650735b336d19867a2b0af7ca53ae35cfbb2f2d3ddcbda1e4d6a362b633e922b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504209, "uuid": "01e7c4d8-ea2e-4fc6-b654-b0ff63aa14e6", "value": "T11125D150766AAF51E47E8BF6086152705BFA2A6FF43EF6094EC3B1DA2570F118920F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504209, "uuid": "7938caaa-0037-4c2a-9a41-5f412378f77d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504209, "uuid": "fafa10eb-fef1-4cd4-bd0b-9e648d78d758", "value": "24576:Q7MyuyF1ILjwJ1KNouJoSIfJp3HAl9Xbm8yPKHCd:Q7MyuyTs0J1KNou6SJl9XbmJKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687504209, "uuid": "0684fef4-24f4-4228-80eb-e785f0970559", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687504209, "uuid": "be9972ff-3525-4c09-a97b-0d934907e7b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504209, "uuid": "54314a75-d35f-4a7c-a53b-579709b1ee25", "value": "QUOTATION 9982.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e5e44b-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500999, "uuid": "41e9e362-824d-486f-85eb-d35030ea8197", "comment": "Malware payload (RedLineStealer)", "value": "b3e8c773733bbf4529ab915ab5cbfa8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500999, "uuid": "11012c99-c098-47f8-a660-f10255a5f572", "comment": "Malware payload (RedLineStealer)", "value": "272aa7ceaaacc1d91cd8ba8b5185ed931ee9ec9939b6c6c40d12b6c2ef3c6cc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500999, "uuid": "db864e6e-f320-4f05-84fc-3130e52d8efb", "comment": "Malware payload (RedLineStealer)", "value": "687bfc6c5c36c42b189ece5c1110890402c8f14f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500999, "uuid": "d1d38627-e826-4128-ace0-75b7048950ca", "comment": "Malware payload (RedLineStealer)", "value": "b7b64a3212b1836feffc0610f518bb1a2cea68905094dfe1650f808046ec786f1ca0ef7f45b62809cd0a4bd426f665a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500999, "uuid": "7af5876b-5af2-4b2b-b699-69c61b6f527b", "value": "T106B4F1C665404563DF23CEF2D4EFE9C64E7A61200B714BC7230D95F58E026E4A62BA7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500999, "uuid": "b56b1ecf-ad75-477e-a5d7-9544b842c0e1", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500999, "uuid": "6eac7a8a-096c-47e5-91f9-215b3812e5b5", "value": "12288:Be5PvTey5sYmXqS1WeEn1hFI6noFbCjQJQmZ:Be5nTey5sVXqqbAHI6oFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500999, "uuid": "9f38e645-0deb-4aef-bc09-a638234755cf", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500999, "uuid": "6eecc0f1-fc42-4217-91f8-da5ae17733ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500999, "uuid": "49c74210-113e-458e-bc72-d0285d5fb164", "value": "b3e8c773733bbf4529ab915ab5cbfa8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e447e6-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500979, "uuid": "c1e4e212-6d16-4493-b680-c0ea286a1022", "comment": "Malware payload (RedLineStealer)", "value": "963c3eeee6d77bb996e6afc9ba04b462", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500979, "uuid": "77f202f9-4d58-4082-be5e-5a048ef3b5e0", "comment": "Malware payload (RedLineStealer)", "value": "28beb8c09ba72c04872625a105cb62cc5a75b9195d14e36c462dcf3c94b6625e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500979, "uuid": "9e03c76d-8fcf-4b36-855d-bc5dc20a7588", "comment": "Malware payload (RedLineStealer)", "value": "4b748e40899c3feaf2642c59324d4aeadd1bc3ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500979, "uuid": "461c76a6-9ce5-495f-b5c4-1c2238a884fe", "comment": "Malware payload (RedLineStealer)", "value": "818882c3f083fef3ebf44222400ca7db04005a72aaaa5ab7bc36dfd72ade8f78eee79c5d87362f059f79afe3186db675", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500979, "uuid": "cc4f3580-b972-44d3-9e63-4b8d6b69c2d7", "value": "T113B4F0CA21404963DF63CDB1D8DFEDD74E7AA02007724BC3220D8AF68E555E4B61B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500979, "uuid": "e452aaf1-d9c5-4b11-a8bf-18a7bdd2f953", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500979, "uuid": "b8c179e7-b560-4cfc-920b-b8a8f972616f", "value": "6144:RUJJ6vhHJuqwePpsyJfso+JWk7XNQ9VNF0oORB3rlL87ifzAAgePcIpHkCZQJQmZ:RUJo/Tey5sgyXNQ9Vby92szuI5ZQJQmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500979, "uuid": "d2dc6575-639e-4a16-a855-4ee5b928dd4b", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500979, "uuid": "921334a1-025e-4786-941b-3ec5434b6996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500979, "uuid": "4185efcf-3c21-4e78-847b-204747f2eb6d", "value": "963c3eeee6d77bb996e6afc9ba04b462.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9875afe3-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687500604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500604, "uuid": "9b2a351d-27b3-4fb2-b950-a6812ccda972", "comment": "Malware payload (Formbook)", "value": "5ed7bfa43d05c376974eae695710ed88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500604, "uuid": "e60b0895-b917-42fe-bbc2-97c72ab61187", "comment": "Malware payload (Formbook)", "value": "2946528b4254f25d435788aa8d8f565624898943dc6861aad8f732dcbb4f1051", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500604, "uuid": "d6b1a7f6-2b29-438d-b342-67d497062b53", "comment": "Malware payload (Formbook)", "value": "519f9aa260ab7b75bdca6773b601af6774dcf763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500604, "uuid": "35e6828f-b025-4a89-970d-c6ab7002f18b", "comment": "Malware payload (Formbook)", "value": "d946aab3fe6e2e19f3033c6f1a0e52e2a93745f1232a91b4855d65cb45e539ff15b935ad14be1302d8ff685e3532cc01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500604, "uuid": "f889c0ce-ad38-4ba6-b778-0d1827225fec", "value": "T11F25D050325A6F60F4BA8BF60860527057F66E6BB43DFA094DC7F2DA25B0F118961F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500604, "uuid": "e7cb976b-e4d5-4760-bc2a-3e4f5ea4a98a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500604, "uuid": "129bce1e-4f20-4e55-b132-42c9a9a7f1eb", "value": "24576:X7MyuyF1iGRxwJ1KNoMvdDD/MK1Xd59+AMqTQw/zyTobDqJiTy:X7MyuyTvuJ1KNoQdDzMGtmqcgzyT4Wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500604, "uuid": "04706c65-d447-4064-8fea-f2aadc5cfe1a", "value": 1029632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500604, "uuid": "e9e55c20-db0b-4602-af63-ee825085dd64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500604, "uuid": "57f0b1d4-990f-4352-87e9-93c20513490a", "value": "Mirus Packaging GmbH Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e220201-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499137, "uuid": "b9cf1edf-9f14-4081-91e9-5c09ced72547", "comment": "Malware payload (RedLineStealer)", "value": "0ae67b6c067fa4a756f5abef0f68e828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499137, "uuid": "4e56ee68-361a-4a43-92c4-b95c2d7b4979", "comment": "Malware payload (RedLineStealer)", "value": "296ec3017d31612227a96c93b7a753452ce266a2e5301809d5cdfa0b166dc53b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499137, "uuid": "a74f310d-e27c-4b80-9792-e466a5fa1a6d", "comment": "Malware payload (RedLineStealer)", "value": "12af83a358a4c0efa1bf0812a4d3c33a0b0c5aff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499137, "uuid": "50d4dbe1-0b58-4108-8af9-fe5b13e79916", "comment": "Malware payload (RedLineStealer)", "value": "ad6e92e5d2174a83dcb7f6f3135e3d7d34da0845beb8f56f5291dfe51f4293a0544745a70d312510f2ecacaf59d8ab91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499137, "uuid": "b88e6462-9ecc-44c6-b978-97cc64f6c68b", "value": "T118E401CA26800873DF23D9F1C4EFE9D65F7A70210BB64787020D89F58E521E4E65767A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499137, "uuid": "6f474c6c-3f6e-443f-a51a-79ac694772c9", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499137, "uuid": "a9cd919d-364b-4e3f-8546-b351b749dcf4", "value": "12288:vxEAZRmTey5spaQrKZaGkoOeMpHbwGKhsdBTTJ4D4j3ggTwOVQJQmZ:vxEAyTey5splKkGx25Bx4D0gQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499137, "uuid": "2cd354ba-6a55-4c45-8c86-6b3d73ecfd80", "value": 714048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499137, "uuid": "6ad19233-6c55-43b0-b5e7-ac4cb279844e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499137, "uuid": "9c0df426-b96a-467b-8216-166a7789df8d", "value": "0ae67b6c067fa4a756f5abef0f68e828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611dbb40-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500082, "uuid": "1ab4c23a-6ff1-4e17-9f0e-3cf5dcc180fd", "comment": "Malware payload (RedLineStealer)", "value": "6dadf1f22fcb9d68aff50ea58853ce22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500082, "uuid": "a81b5ec8-9d1d-438b-9ac7-92f131799cb9", "comment": "Malware payload (RedLineStealer)", "value": "297d0623468ae151eb4d3bd07fd191911701537c91be82bb653d9e31cf676d2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500082, "uuid": "ad292c3d-17d3-43cb-913c-2ad7d53f4de0", "comment": "Malware payload (RedLineStealer)", "value": "f94001e1d8ffb5d221aa0f17e919064363785b95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500082, "uuid": "76367519-5507-4061-847f-1ccee740135b", "comment": "Malware payload (RedLineStealer)", "value": "c7ae2e0c08515c032caa16a73cfb872da16454fb1ecbfb22d9cf041c2bfa30260b9e8449940aa08c88a3b1d79eff5346", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500082, "uuid": "993b8ea7-59d3-49b7-96e5-da7da1298a31", "value": "T189444CFB52D1D460DD0FA4B02C6EE1BDDE34B461DEA284CA19BA0952D3530E4BCE798D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500082, "uuid": "207a4a63-b3c1-4ffb-a44d-8b7651d0f64b", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500082, "uuid": "dbcf3b2e-076b-456d-aa34-903fe518c62c", "value": "6144:2tSKJigt0poiRG/XvLNUgYhuE22qQJQmL:2tS9gtAoiRG/fSviQJQmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500082, "uuid": "a5aac079-abba-438a-9425-d47d13d4f051", "value": 276293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500082, "uuid": "cca28005-9520-4c11-a015-ae4f4b5c3525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500082, "uuid": "c0ad0f6d-04f9-47df-b958-47b5e26da2fe", "value": "6dadf1f22fcb9d68aff50ea58853ce22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8d3fb9-1193-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687503401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503401, "uuid": "22a97b32-7f18-46cf-bbd8-0c5ef0806d47", "comment": "Malware payload (Amadey)", "value": "eacea6fa53a2d2bce2ad2ed5498ec906", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503401, "uuid": "466ac10f-08a6-4435-9cc8-a3f3b1c443f5", "comment": "Malware payload (Amadey)", "value": "29aeb28e68495be840534fd011575c0f88985e1d82b3884936356af63d0f4e82", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503401, "uuid": "d67ec535-61ed-45be-b15d-6d1297d53ec1", "comment": "Malware payload (Amadey)", "value": "a7b53c50156e0de1b91402a682a143a0aa126297", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503401, "uuid": "6b401b6e-7746-4b1e-9f79-5edfeec36098", "comment": "Malware payload (Amadey)", "value": "6698c6ba58558636f10c0a3c3870a2ff4a0491b164d4f1ba52ec3c6de4079193ac664b12cf3afdc9a17ca35cec62c19b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503401, "uuid": "437ead10-bd1b-4fa2-b6dc-558da79ea1ed", "value": "T1C5B4F1CA25404533CF63C9F2C8DFE9D65E79B02207664BC7120D8AFA8E465E4D51BA3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503401, "uuid": "ae361761-421d-44e6-ba3c-5a4022a80244", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503401, "uuid": "aa920c8b-26a7-4f8c-8e5d-639733cc6c0c", "value": "12288:d0ghjeTey5sCvxnxO11UZJZzi1r2CbfDBG/3ffdnLQJQmZ:mgh6Tey5sSpx9ZJZzN4M/PfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687503401, "uuid": "9e55b361-d145-4f57-b541-54fe086b1827", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687503401, "uuid": "55fcb89c-48ea-4053-a986-c8c75c011a82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503401, "uuid": "73dc909b-84df-42c2-b329-effb6ac0e1ef", "value": "eacea6fa53a2d2bce2ad2ed5498ec906.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11940830-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500378, "uuid": "23ff207f-7133-43a6-bd96-4a8e8ef5c63e", "comment": "Malware payload (RedLineStealer)", "value": "9857b4a4d516bac1f02059dcb5629d48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500378, "uuid": "a74c65a1-bd64-41d4-8eab-e9f63a463dec", "comment": "Malware payload (RedLineStealer)", "value": "29c8056f1550e9276e7596119c7d2fc17caa0948d9bd888c2742782e18329668", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500378, "uuid": "8881a9de-223e-4afe-95b3-9a6071b52757", "comment": "Malware payload (RedLineStealer)", "value": "436e6dbd5e1e5395142407f01ae3a040232c2505", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500378, "uuid": "ac05994b-984b-4a77-b96b-90c24208184d", "comment": "Malware payload (RedLineStealer)", "value": "5924261c77dd80ebfbdbc8423eff298ffb9c4af270b7b062ea5504eab5a957c0ef1cc721465463c54755c90c3a576085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500378, "uuid": "3b09d93d-9684-4b07-bf4a-8bf5f3a75f14", "value": "T167E412CB25804973CF27C9B2C4EFEDD64E7A31310B760B8B160C9AF54E455E8A60B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500378, "uuid": "f041c398-b8ba-40e3-9c96-8f6fc3d95b2e", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500378, "uuid": "fb10c645-3767-445b-b262-cf9a3638f1f6", "value": "12288:VEgjETey5scm+7OdwpbsHV+JMJecuwuL3VBgqnDHWDFQJQmZ:VEggTey5scZ6wpbSJurVBjqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500378, "uuid": "c869d5d3-e4fd-4161-92c6-996d3b272793", "value": 714048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500378, "uuid": "272a774a-fa1e-44ca-ad94-83657437c507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500378, "uuid": "7f6ef223-2fce-46f3-a128-728690ba9bfd", "value": "9857b4a4d516bac1f02059dcb5629d48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a02bdef-11ec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687541731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541731, "uuid": "a8b5e118-dccd-47ab-8412-b170755bd799", "comment": "Malware payload (Quakbot)", "value": "c4c8ab9f62e434ceabb0416f9be2bc19", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541731, "uuid": "00a92a67-8c9e-4359-a350-7ceb4d1efca8", "comment": "Malware payload (Quakbot)", "value": "2b67128c9767fae1bbc4bd04f3a85199328b637f188a71ae6be836a81a064a55", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541731, "uuid": "52102983-ebdf-4953-8476-21e0029ab07b", "comment": "Malware payload (Quakbot)", "value": "8844f993bbda24134e3ffd91bc0da8c372741416", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541731, "uuid": "857153b9-9412-46e7-a3be-00272a835c71", "comment": "Malware payload (Quakbot)", "value": "e86535cf347b64eaef35530202e63e60a65b75252bfc934efcc18e07c669da098e1ea473ecb13af8eefd860df17595d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541731, "uuid": "7b658b09-386b-422b-a2a5-fe8db38694a3", "value": "T1C6558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541731, "uuid": "ae0b74e9-a519-45d9-859d-57881c61aa42", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541731, "uuid": "1862fe31-4f1a-4439-b64c-888d7cb218d7", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4yrQ:QbkS7XB1EsOSNPSp0EAt2bUeM4yrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687541731, "uuid": "f71bc149-dd07-47fd-afbc-f35e36d9f81d", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687541731, "uuid": "ccf27dcf-74b5-431f-9b13-824cb3929e90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541731, "uuid": "0d2c3e52-151d-44b9-a28d-e866bc1da08c", "value": "02qbot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f2a872-11c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687524140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524140, "uuid": "0030c655-df25-44e4-9560-8ba7b9fbcf7c", "comment": "Malware payload (RedLineStealer)", "value": "a27ccd52b85d602a373abc0b7b31ddaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524140, "uuid": "4c9adddc-ad8e-422f-b382-c3ca623aea97", "comment": "Malware payload (RedLineStealer)", "value": "2bc2dfe39f0054c249a284392db3dae03ea44605c08104b4c95d8c6ca884e61e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524140, "uuid": "31222a83-1567-4bb5-b80f-c7e93ae92deb", "comment": "Malware payload (RedLineStealer)", "value": "fb41141d4568a64ec2494c277b22cd51223be08f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524140, "uuid": "6b40d1bc-c6ad-4eb2-9278-013ab5e9eb05", "comment": "Malware payload (RedLineStealer)", "value": "a111b25d19607dd0c46d8bb385f5faff8374cf3b53419d3727b039f6279ee8036f53c74905ff498470bce85416649136", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524140, "uuid": "5c38c65c-51a9-40f2-aa5f-969dc5b28e4b", "value": "T12EB4F1CA21404A63CF63CDF2C4EFEDC74E7971320B614AC3130D99FA8A556D4A61B93A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524140, "uuid": "f977f144-4754-4cf3-a22b-6979587c29c1", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524140, "uuid": "88866d21-e02e-4eee-afbc-1ce2fcade85e", "value": "12288:4e5y9Tey5snD6dRkGDgG855R4hyE/iBsTbQJQmZ:4e5GTey5snWdRkOtEIyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687524140, "uuid": "a0ac5a77-bbb4-46ee-9e6b-3c0eadd17a80", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687524140, "uuid": "9f30a037-c782-4e13-9626-a4b11ffc448f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524140, "uuid": "b83aa318-204f-4892-844c-82f5c94dd88a", "value": "a27ccd52b85d602a373abc0b7b31ddaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991deba1-11b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516926, "uuid": "ce7f8371-b1dd-4aaa-a26c-8d7f199ea76f", "comment": "Malware payload (RedLineStealer)", "value": "f7e9b4fea0f9ed350c6b18ee59eba91e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516926, "uuid": "6e2eb6a3-e075-4dbc-a40c-4da4805fbf35", "comment": "Malware payload (RedLineStealer)", "value": "2c91155570a6ff17048613605a1e281037cc9f6c14e9b179c4bc929c67e63aff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516926, "uuid": "ff5fe029-9151-46c2-be74-96ede8b42453", "comment": "Malware payload (RedLineStealer)", "value": "70dbe073e7a1524200446e69414f68c1f01e3db4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516926, "uuid": "437cbf8d-ef30-47cb-a496-8dbef016bdc4", "comment": "Malware payload (RedLineStealer)", "value": "2e16cf35cb300076cdc605be170d71fb084ee9b3d59c258c7efbe3656120602ae83eb0e8d2d0f4532d8a17f955f89f3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516926, "uuid": "3d76772b-395a-4ccc-a64a-7630b5ea383f", "value": "T14DB4F1CA62800963DF63CDB1D4EFFDD64E7A61220BB14BC7120D96F54E045E4EA1B63A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516926, "uuid": "3f7f9033-694b-4196-b750-06c36c59d978", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516926, "uuid": "35f65e64-8602-45aa-98f8-962f88e1c3b9", "value": "12288:POm87Tey5sTz8w3NHHoRc4qFj/Pgd/M68lgXnZD68a0tQJQmZ:POmCTey5sTz8w3NgDqj/PgHnR6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516926, "uuid": "4955a739-3f77-45dd-87d0-a49b6077a73b", "value": 543040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516926, "uuid": "4084862b-8a07-4aab-b021-e2c240d9aa32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516926, "uuid": "d7b17d08-6b83-43aa-8892-db9be4f748ff", "value": "f7e9b4fea0f9ed350c6b18ee59eba91e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49214635-11ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687520228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520228, "uuid": "45b30013-e658-46e8-983d-e0ed0ba51daa", "comment": "Malware payload (SnakeKeylogger)", "value": "7c61259d514e2ceaf39cc924df1fd1ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520228, "uuid": "a128bc68-2d3a-4641-baf1-8d0a1390111a", "comment": "Malware payload (SnakeKeylogger)", "value": "2dbb566e1dce36409f2f8a3e3fed3737c4b286b87c2dc87d892ff4d0e0367562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520228, "uuid": "11adc744-9d15-4e62-80e2-03c223860756", "comment": "Malware payload (SnakeKeylogger)", "value": "c455b3124b28390b720be35dd3dc8865b85c20a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520228, "uuid": "6d9d36b8-d5bd-4b59-829a-37ff97b828d2", "comment": "Malware payload (SnakeKeylogger)", "value": "20c1d907414b854db78675ee20d229fb5cc1ad24fe743e3b53ce10a79017526812240472000bc27b4588b542ffacfbc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520228, "uuid": "7a276a79-607c-48a6-ab76-96a85c092bec", "value": "T1E2C41275766BCF22F27A03355DA2018807792D587425D60EFFEB3ECA56B33486B42923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520228, "uuid": "44c7ee10-b2c9-4239-b2cf-2ffd72ad5268", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520228, "uuid": "0c1d8200-368e-422e-9ae3-f6c6129fb26a", "value": "12288:xk54/mNUAkwNuPv/FVRO5+Mxr8ef5Ka/TKFYFB8DHz:xk54/QU5wNu3NVRFMyaKX2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520228, "uuid": "6e83d10d-4264-4bf7-87e6-91b3882a50ac", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520228, "uuid": "f98f329f-55f0-48bd-8bb0-92ee0d8b1ce5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520228, "uuid": "57076fc6-56fd-4794-bedd-cf1b5ed65629", "value": "doc20230623514.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfd26f9-11d4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687531349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687531349, "uuid": "b4c74515-6871-4693-bd6a-9f91214f4a01", "comment": "Malware payload (RedLineStealer)", "value": "47e8caecda783990441d58c1f47c5bbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687531349, "uuid": "92891a93-b78c-40be-8a25-23b25582766c", "comment": "Malware payload (RedLineStealer)", "value": "2e84eaf7bb4ffd6916ad23f53e320ee1584cc3c60dcbaeed2acdcca05801ae38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687531349, "uuid": "be71426d-dde4-4d48-b728-015f32d8bbc2", "comment": "Malware payload (RedLineStealer)", "value": "2296f10537fec2441241821a8ccfe54be3cf449d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687531349, "uuid": "a500d7e2-8cdc-4609-a6a2-088ceda92968", "comment": "Malware payload (RedLineStealer)", "value": "9e164a8305121f118e110fd6ecb8912a5a53b1519d1b24d80959185afe3c9e7f2a130c2b2bfee35e6e061c099741c417", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687531349, "uuid": "df21f5a9-54a6-445f-840b-ab608e4a6d3e", "value": "T11F3612392A48D973EBDB36B0C093856FC918297096DFB84D63731CEE796B9BCC460644", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687531349, "uuid": "799f6bb1-57f5-4317-a212-0e07948e99c7", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687531349, "uuid": "f5b0968f-e101-43a2-93f8-444871acea47", "value": "98304:fn8cUvJehNK5BaGL/UC50PzYMuWsphe0YrfcAoHKD9nj81f/538FWDWEfWrEAsSO:f8cUBehNK5BzwC+UMuYFrf1DRkf/538U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687531349, "uuid": "e714b938-0b9f-487b-98d4-30e1f720dffe", "value": 5179392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687531349, "uuid": "56b7de14-3de2-4728-97f5-5f76bff69c5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687531349, "uuid": "6fc1f88c-e48f-40f4-8a9c-35dbd8c2ade0", "value": "47e8caecda783990441d58c1f47c5bbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925bdf4f-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499735, "uuid": "2e97800c-ce11-4ac9-8d22-0bd5552a49f4", "comment": "Malware payload (RedLineStealer)", "value": "3c648545976baf4cf1038f4dc74402e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499735, "uuid": "f8223c7f-ff9f-4c6b-81f0-ec723ae5a7af", "comment": "Malware payload (RedLineStealer)", "value": "2f236c136921e91f5c665e4b499002b80e1a987efbd4a0a5aa6522652d8c14cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499735, "uuid": "1a7cca66-2925-40c0-9d5a-aca493b95dff", "comment": "Malware payload (RedLineStealer)", "value": "040113462c38846cc5ca30ce4cad005e7d4afe0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499735, "uuid": "1695c56c-b2b6-4222-bcf3-94f2266e296f", "comment": "Malware payload (RedLineStealer)", "value": "9ffdf33a55d735f2744e1c7f52b0758eb2155381ae74a54f76760b29238379928534a468998430692afc0bf8d69e6a5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499735, "uuid": "e46d7ffa-882c-412c-97f7-3bb84a718ea4", "value": "T12B444BFB52D1D460DD0FA4B02C6EE1BDEE30B461DEA284CA19BA0952D3534E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499735, "uuid": "124e9956-2098-417e-a73e-72100da662b6", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499735, "uuid": "ebaef840-4f31-4244-8859-5da4495ffc6d", "value": "6144:g7Ukvw6igt0poiRG/XvLNUgYhuE22WQJQmp:g7Ukv6gtAoiRG/fSvuQJQmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499735, "uuid": "ed4dbbe2-9899-4e8a-9837-47c878edc1fb", "value": 275780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499735, "uuid": "c22d0c36-b2f1-486a-bad1-e8a33767dc50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499735, "uuid": "f072c42b-fd03-479e-9336-3e81ebe98285", "value": "3c648545976baf4cf1038f4dc74402e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ca439f-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687499125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499125, "uuid": "8c19f186-a0a1-4bdc-ae49-910ebcae813b", "comment": "Malware payload (Amadey)", "value": "071f1ef38dbd40c0b807ac6ca1715795", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499125, "uuid": "a075a648-530f-4a81-bde6-f1d29a71ca79", "comment": "Malware payload (Amadey)", "value": "3007b82659038d1262c1f3758c883f9cc1115a66a5d519c8cff47ab1f6f0c650", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499125, "uuid": "ff4c9c9d-f514-4d11-abdf-7b4499a9df2a", "comment": "Malware payload (Amadey)", "value": "b3140e8ae89aec4394a05c0a7a077770d450c1f6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499125, "uuid": "06224ee1-c57d-4434-9f8f-4389e71b227e", "comment": "Malware payload (Amadey)", "value": "a660067fb3dc510140e532bbd9db4fe836af5f940bcee1b901f82275fff4bec5d87e4c4a01c3b5128ba2f564db6d352d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499125, "uuid": "85af032d-c2a8-4f24-8453-d821663fc57c", "value": "T19AB4F1CA25404573CF67CDF2D4EFE9C64EBA71210BB24B87130C86F68E152E4A51B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499125, "uuid": "6674d516-7e9f-41ae-9d72-1f96723144e6", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499125, "uuid": "118058a8-36c8-4afb-b117-13e819c55f0d", "value": "12288:q6eIxjTey5snjphux6pZad0iC/IkjIHv6OPZOtQJQmZ:q6eItTey5sn202dGk7PZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499125, "uuid": "aa443e16-608d-4b8a-a83a-6ef18b87a462", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499125, "uuid": "d74f760b-8094-492e-800b-88cc348d6225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499125, "uuid": "a8fadb9d-bb6e-4836-8042-f4211f7b17bd", "value": "071f1ef38dbd40c0b807ac6ca1715795.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9a205d-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501309, "uuid": "f6fef90f-0f23-400c-98b3-3d62feed1c03", "comment": "Malware payload (RedLineStealer)", "value": "e7d51d7673fec914b3e87a8d0d981cdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501309, "uuid": "5b56e176-2d5d-4994-b82f-5c4078af9ce5", "comment": "Malware payload (RedLineStealer)", "value": "306d75f3ee4916847addf6416b62ed9858ec7550e1995c748963732d62cb87b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501309, "uuid": "ccf08289-074f-4e48-85c3-551ae40d3445", "comment": "Malware payload (RedLineStealer)", "value": "47c0b2198d6152e10fd38aa8b66ae2cd9c2796d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501309, "uuid": "2be67f28-a796-45d2-b249-4792a202725a", "comment": "Malware payload (RedLineStealer)", "value": "46e751a5dcb8762aac190ec75cde9999a6ad9ee4556247b2d1af12aec7af0a4143ac838368937f1d95dea92c80eeb4ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501309, "uuid": "8816de0a-8dee-478a-9e95-a42379d707c3", "value": "T14AB401CA25404673DF33C9F2D8EFE9DA4E7A71210B714B87130C46F58E466E8A60B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501309, "uuid": "d8c37401-a016-424e-8a94-1121d483e1ef", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501309, "uuid": "4aa27efa-a98e-491e-a8c9-6d667f7f5229", "value": "12288:gQh+aTTey5sqjNWl8973MFhpAcK/hfVUEPHiyRWQJQmZ:Lh+sTey5sqx+8SFDAcgF6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501309, "uuid": "be42fae2-084b-4b0b-90ee-38affc1c290a", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501309, "uuid": "b78244a4-9183-421f-a67f-be7ad16fcfe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501309, "uuid": "c37cbb7f-8991-4c02-9e6d-ed81f0f3f9ea", "value": "e7d51d7673fec914b3e87a8d0d981cdd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db624378-11c7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687526057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687526057, "uuid": "74857256-1223-4711-824a-4ff74768b14d", "comment": "Malware payload (RemcosRAT)", "value": "f1acd5fc0da5ac95753273c304bd12c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687526057, "uuid": "59f92231-982e-4a17-a12d-f7be41026b89", "comment": "Malware payload (RemcosRAT)", "value": "3100c2815280c4d4ccb7719c8a2f2cc150c80d53c3675a5070b9499028dafacc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687526057, "uuid": "cae63b4e-f5f0-4c85-b197-b862ae1849ea", "comment": "Malware payload (RemcosRAT)", "value": "5a389f4fb54ad4e26af46c77c389d3f73725ad02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687526057, "uuid": "61c78d02-5758-42f6-8f98-bd63d09b1c9f", "comment": "Malware payload (RemcosRAT)", "value": "3061c2468a73e5b1777d8d4f147dd927010e8ee0e397488829ed4d00ae8d34fdab150d833e93414b47fc748baefedee0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687526057, "uuid": "811648c0-a80b-4907-bbb4-1027754f7f2e", "value": "T13A25222452A40D19F03BAFB695B85050C7F8FE55A612E31A7EE620F20173FA19F4735B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687526057, "uuid": "ba84143e-9ca1-4f78-b6b5-e3317dbb0768", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687526057, "uuid": "d1a80383-b307-4f0c-b829-99edd4367342", "value": "24576:t1M4/QUmPnUegFvgzbbmE5OYmqaCNVBU7HeusJA:t9/WPnUegFYzbHmUqsJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687526057, "uuid": "85c7c658-c8ea-439d-a242-679087edd24c", "value": 980992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687526057, "uuid": "a51a6575-b7f4-4c30-a13b-ec22804129a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687526057, "uuid": "cd2a34f6-7ebe-43de-b24a-04d8884aca08", "value": "JXP 0RDER 225 80587 STS PPT 903793.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4031222-1190-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687502449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502449, "uuid": "f21e0889-da65-4ba8-bf99-d19bf4f7e3c7", "comment": "Malware payload (AgentTesla)", "value": "a22259ac39ff1994898f66528aa1bb69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502449, "uuid": "5cdc9e02-c1b3-4ef5-8c70-1feae2e89558", "comment": "Malware payload (AgentTesla)", "value": "3128342e14d0e3fdf92828d146cc86bc6f52520cd792b043f72e20eddb022e10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502449, "uuid": "58e4fe61-36c8-4d7a-b43e-0cb75e3bcec8", "comment": "Malware payload (AgentTesla)", "value": "393758e3aacf67b649401b5262eb899c26d2701b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502449, "uuid": "c68098fd-e8db-4f69-a445-ed48e401325c", "comment": "Malware payload (AgentTesla)", "value": "a686dd78556298cf9d0a23ed5ac08b6ff873805cefdb4cf9e8ed01f2da2550d987f6021de39038e29d76f5750d8e6c1f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502449, "uuid": "5a7ffebe-94ce-4f63-a4e3-5ce17d602487", "value": "T10FD4224F32442E66E1F89CB844AB120423F55B396017E7999FE138D27EC66C51F90AFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502449, "uuid": "9cc4b251-60dc-4d2c-b560-b07cbe228475", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502449, "uuid": "a4e454c2-a282-413f-b816-bfb77534e642", "value": "12288:lAk54/mNUAMpyMPX9VsWKFkKx+xvR49OWhkCA5BBRYqcQI:Wk54/QUdpygPsTFXDo8bAjBRYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687502449, "uuid": "181ef439-60d4-4164-a735-5b215d0da8f4", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687502449, "uuid": "530316b6-3ca9-4d6a-8536-0bbd7611ed13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502449, "uuid": "3e5586a7-504c-41ca-aac2-9b9d6dd9025d", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77727ba9-11a2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687509998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687509998, "uuid": "6e71df11-8141-47d7-9480-76b5b04aa63f", "comment": "Malware payload (RedLineStealer)", "value": "08c28324179b6bb20cee61bd8ea4707a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687509998, "uuid": "0b348045-bb13-4298-be6e-fba612e73af1", "comment": "Malware payload (RedLineStealer)", "value": "316dc8cb3bc886f8a4246308c9f2620d8ba58916660241898723c9a31962c4e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687509998, "uuid": "719d63c0-d7ca-4abc-85e4-bbde3ad7e5b1", "comment": "Malware payload (RedLineStealer)", "value": "d5bb00bdcb445dff145517d9711f3b3ad46afab1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687509998, "uuid": "f4486fff-c60d-4620-b4f7-e47262a27439", "comment": "Malware payload (RedLineStealer)", "value": "913350d409a941ecb8f1bc0ec43440dae6eb4380257d7a3a773775fef66a3fde356ad218dc8aedf1acc515a84357dd19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687509998, "uuid": "9828b773-bc86-429f-b0fb-710999cf9462", "value": "T146443BFB52D1D460DD0FA4B02C6AE1BDEE31B461DEA284CA19BE0952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687509998, "uuid": "a6a0ec43-6740-4644-acd3-2c1aefeee357", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687509998, "uuid": "c713b354-f5ec-4080-aa7f-94784586246b", "value": "6144:70ueQ8igt0poiRG/XvLNUgYhuE22aQJQmp:70ueIgtAoiRG/fSvSQJQmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687509998, "uuid": "26aed0a1-166d-45d2-b6a2-e27c8f6fc6a3", "value": 276292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687509998, "uuid": "253a59b5-653f-42f8-b2a9-21ff6e3240d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687509998, "uuid": "987ae1ee-880b-4d20-86d6-cb17733cb87d", "value": "08c28324179b6bb20cee61bd8ea4707a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e703ca5e-11bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687520922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520922, "uuid": "cec0f09d-68b0-4787-a019-6d6ab3f4f4dd", "comment": "Malware payload (GCleaner)", "value": "18a6451ce361ae5c04ce066da7a6e62e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520922, "uuid": "7a585fd1-e5ed-4fa7-9746-168e57342f5c", "comment": "Malware payload (GCleaner)", "value": "31af520b509141499eff433c6cd1dd38761fb8098017c90316c7e11d7a123643", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520922, "uuid": "3e020f81-06d5-4a81-b330-077c8eb247d3", "comment": "Malware payload (GCleaner)", "value": "21b3d2d7fc0f96a9a1aa79cf53cc9901d1ffb49e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520922, "uuid": "2fb0dbb1-b6d7-4340-b780-c6801b1799a5", "comment": "Malware payload (GCleaner)", "value": "7fb5490498dc13c7c99281f66824bb9db11729bb4cd0eb6003e3f5ab57a6b08ad4ccfc7c0f15aeb4b0837de8c9e1c9c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520922, "uuid": "32a5fed4-0e71-46a3-832c-a1266f5c3834", "value": "T1F2949D03B2D16C61E521D6728E2FCABC361FB5604F197B9F66589A7B0A701F2D233316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520922, "uuid": "582bc612-922b-4798-b22e-33fb93de7e45", "value": "07720bcaa56246faffb2a5e7dbc39f3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520922, "uuid": "de494745-b4a0-45dd-9a61-b12f2803e1d1", "value": "6144:ZRmkVRe4MlKC68Gqkli6orBclnCXisCB36+cjC9mUWpzTIW4:TRe4Mlj6Dqk5c8YisC1lN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520922, "uuid": "653640d5-8b50-412b-b878-206967162038", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520922, "uuid": "df7ea1f9-2e5c-458f-86dd-95f0b78b85ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520922, "uuid": "ae122a66-b8ca-4e6d-9db2-be07e669b3e3", "value": "18a6451ce361ae5c04ce066da7a6e62e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd63b53-11b7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687519024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519024, "uuid": "05d7f02b-6736-492b-bbbe-721e06f92a9e", "comment": "Malware payload (AgentTesla)", "value": "a51cd19552a652c9059f84649f2455ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519024, "uuid": "b695ab04-df79-4bd8-a2c1-e01d2f216832", "comment": "Malware payload (AgentTesla)", "value": "31cc68f5423b08e95d1099c3e5f1ee1883a3b118c3cd2f51b8175d501505e92f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519024, "uuid": "0c3960e8-1740-413d-b951-76ee65404873", "comment": "Malware payload (AgentTesla)", "value": "0d453e49ae84357c8a14ae1c141982e2ffd79642", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519024, "uuid": "44b35ca1-4431-4cf5-b177-e2ee3d13409b", "comment": "Malware payload (AgentTesla)", "value": "541a1005efe879b7d609513356365209e67ca50da8e8d239c95286521bcbb9a121faf590153cede1964a93ab3187d3d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519024, "uuid": "738aa83f-4b9d-4e47-8f71-f7a2506c83a7", "value": "T1A1052354AB3A4615D57B4FF628A423B1869F8E8F7056C307CDFB33BA7935B9005602A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519024, "uuid": "9a7d9330-efad-4578-a2a3-0755766624a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519024, "uuid": "a25d40a8-83b4-4802-a430-318f80072dbe", "value": "12288:YM1JCIQfNsVcuoQHT2iN788PVmKUD64LkPw5oEGXuuUubzShNlLtWQ19POpD96u9:B1KNoT1BrUG4LxGbXbz0lLtl19QM//y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687519024, "uuid": "5350e170-b247-4d4d-8976-f1095229f01a", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687519024, "uuid": "558eb151-ec28-456c-a00c-2a9b645ff90c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519024, "uuid": "293f48fe-2ebf-41a7-b403-7f35e14bbd8b", "value": "a51cd19552a652c9059f84649f2455ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2dcc20-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500052, "uuid": "3e4e9d28-f700-4713-bc79-1a49c1ddd3e3", "comment": "Malware payload (Amadey)", "value": "1e88d98ae438890fd09f64b3bdd453b0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500052, "uuid": "9931c542-013f-4d31-a96e-b75404776a0c", "comment": "Malware payload (Amadey)", "value": "329acf443af5767180ee6459ede08105753a066ed41593420513f181e019825f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500052, "uuid": "e9e6e967-cbb3-4ae3-b109-df26ef068813", "comment": "Malware payload (Amadey)", "value": "74de6423561c2a2ab6b8f4ab3ced5c0c8441603b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500052, "uuid": "0f3a2ffe-3f84-4988-a79e-a1272ab7c476", "comment": "Malware payload (Amadey)", "value": "bbebc56a9eac1faad05222436f285455e916fea0104a8aac88341041d9a231493235da656bbf08adc0033de4315e3909", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500052, "uuid": "6ea727bd-45a0-412e-a0c6-e6d95ab5f8fd", "value": "T1FFE402C220504573DB73DEF2C4EFA9D68A7A712107B287C7120E9AF84F495E4E61B53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500052, "uuid": "0fddf4f7-4436-4b72-b5ba-261fa5e60000", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500052, "uuid": "4123872c-bb02-497a-bf6f-7e89fcb0fe86", "value": "12288:Yz4mO1V0uenyTey5sqRlVIIqSFStPyL5C7DbXnjTvw18WTEXZIHtqDXCDjo/dFKu:Yz4mO1V0ulTey5sktqeStPy2X28WTEIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500052, "uuid": "3df0d3d2-e3d9-424c-97bd-fbb55745780a", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500052, "uuid": "ada6157b-77ca-4d71-8098-f18d76fcdfaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500052, "uuid": "c8ab40d6-3bd8-43f0-b767-d77ea9f137a9", "value": "1e88d98ae438890fd09f64b3bdd453b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f481a67-11b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687519325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519325, "uuid": "4930d26a-e0a2-4c79-a5be-799819145762", "comment": "Malware payload (RedLineStealer)", "value": "1418cf870732f4312320b6362ef73d9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519325, "uuid": "74197ef0-f515-49f8-80bd-b79f96b2c82f", "comment": "Malware payload (RedLineStealer)", "value": "32c3f57fd706aa2f5384cc3adda5007e7c28dbea002d0f5dcc0958f60cb1eedc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519325, "uuid": "5345151a-e59e-4637-ab50-6cf58ab494a2", "comment": "Malware payload (RedLineStealer)", "value": "8cdb32887ca1b29ec1ed07bf415638aa2dd88afa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519325, "uuid": "a7185478-c72f-45ff-9e48-f650d43a7633", "comment": "Malware payload (RedLineStealer)", "value": "ad755c7de51d2a381075ea4cdae72fa71444ba3f77e033599950ef992861b2d2ca186fec71ba80c6b79964a44bcbc576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519325, "uuid": "253de69b-b09f-4a06-bc62-ea138769991f", "value": "T16E444BFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA284CA19BA0952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519325, "uuid": "db87e44c-3ed9-45de-968f-3cc16ed163cc", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519325, "uuid": "d8f636c5-4d06-4aa0-9bc8-bcfe73694f81", "value": "6144:2itSKJigt0poiRG/XvLNUgYhuE220QJQmB:2itS9gtAoiRG/fSv8QJQmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687519325, "uuid": "1d7ae8ae-f9f7-4ae6-842a-19c4389ce19e", "value": 276290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687519325, "uuid": "0ca347ff-119e-4409-8410-226eb0d95d8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519325, "uuid": "bb085f29-ffc7-4c7c-ad25-3f8162231c9a", "value": "1418cf870732f4312320b6362ef73d9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b787a0-11bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687522341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522341, "uuid": "ee007e81-6859-4301-927a-f249b8613b42", "comment": "Malware payload (AgentTesla)", "value": "23e214080e01e75bd41d98555abc58bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522341, "uuid": "d86f3628-3d06-44b4-8b4b-9121497d0fa5", "comment": "Malware payload (AgentTesla)", "value": "32d504f5a1c52ac26cd08e12a4a21c1685efa55b3558a0745ed4fbc5ed973377", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522341, "uuid": "e6c7143b-9fdb-44e8-94de-c4e3f8c61cf6", "comment": "Malware payload (AgentTesla)", "value": "e387af4103b8b4f2832a2548ede07911032a9b4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522341, "uuid": "0dcb6da0-f78d-40a2-9cfc-7e1e85ae2fcc", "comment": "Malware payload (AgentTesla)", "value": "ddb3d98c0f585a9c4ab9903655e955651b0947436b438293bf9e22ca8cb604a9201743922d70be14e08db6f972fbd035", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522341, "uuid": "17111db4-ea6d-415b-8118-2c6a51e855b7", "value": "T178F423528B420223C88F0FB524E097B0B7AB4E4FB555D6179DEF77BDFA6A2061160393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522341, "uuid": "eb0cc447-eefe-476f-9661-3b0a1383a9c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522341, "uuid": "f6398aae-2b64-4637-bbc4-c175a7a6e638", "value": "12288:rM1JCIQfNsVcuoQHT2iNRkco4V/0FOQCC1/vpwYsUTa4X/q8jmRc6wkcqYUWckic:I1KNoT1Lko/9QFvT9XXC8KRqkyUWnip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687522341, "uuid": "5b4fdee6-fc21-4595-9fcd-1abc539b1ab0", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687522341, "uuid": "8dfd0e62-c7cf-4a47-8305-8190364a1248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522341, "uuid": "434a0f97-746f-4b73-a94e-a7073fe8a261", "value": "rCotizacion4002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67efa3de-1192-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687503100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503100, "uuid": "bc8b5f3d-a9fd-4fc3-afbf-fae688e7fbaa", "comment": "Malware payload (RedLineStealer)", "value": "bdba69ff21030d0d52e9227588141198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503100, "uuid": "b32fb3c5-b09a-4878-a0c7-43b52d88fbe2", "comment": "Malware payload (RedLineStealer)", "value": "3403fca65042a5ae331ba942661e3e74f2033090311e0da1ab794e8aedc8c399", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503100, "uuid": "1a455650-13c2-4fb3-b6b8-a9a187198dcc", "comment": "Malware payload (RedLineStealer)", "value": "e9d34b2939fb61080711145fc6fabf0f57ebeeea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503100, "uuid": "cd2074aa-5b3a-4a37-9174-fa58944c0825", "comment": "Malware payload (RedLineStealer)", "value": "7b467ac20aa2478e0096bc6ea6144a4d95d51b72d76231ab93d1bb513984def93b1dbe14e618eda11fb791840f3afc3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503100, "uuid": "e6c47908-c6a2-4bef-89cc-508a59afb905", "value": "T101E402C965404A73CF33DDB2C8EFEDD64B7A60200B624787220C59F58E565E89A0B97F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503100, "uuid": "ffe5aad7-20c1-404f-9401-808a601f3b01", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503100, "uuid": "633e70a0-e1b1-46c5-9ea2-17c64fad1810", "value": "12288:iegKgTey5sAYowCCwFCtgZbgEUfRTkhST5wDLqxTgM/ozpGHQJQmZ:iegDTey5sdowpwALRTVoM/Cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687503100, "uuid": "0205bc27-4fee-4d68-bad5-fc725b3770e7", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687503100, "uuid": "4cb7b4fb-cd5d-49e8-8d5f-f0d68684d624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503100, "uuid": "e4016e40-4e15-47e3-bc57-1a8c2d0a9bf5", "value": "bdba69ff21030d0d52e9227588141198.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc91f255-1181-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687495940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687495940, "uuid": "9ba694e7-786a-41c9-b5ea-7f06bc7f85b4", "comment": "Malware payload (Quakbot)", "value": "71e4345aa4c17e6b13221a83b7f55133", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687495940, "uuid": "6beacf34-6d41-4da3-9d4c-cee64756e6d5", "comment": "Malware payload (Quakbot)", "value": "343b47b007316dc36eab02a9bd81233aacf303fd11585b1237fc9eb4080234e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687495940, "uuid": "f4b9d8fd-97a8-4993-a560-6f0be556d74b", "comment": "Malware payload (Quakbot)", "value": "a22e256e86322431f81e622ba4a169493ae2b96c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687495940, "uuid": "46b8e2f1-e6a6-401f-8487-17405b989e6a", "comment": "Malware payload (Quakbot)", "value": "62520ecc4f18040953e80b68b7368142e0ee7963b52197d8f3989904bc20f61b2bf2321a04dde79c39b6b31051b07632", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687495940, "uuid": "563593ec-6e4c-4099-b110-46bc1e4b5a39", "value": "T16074496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687495940, "uuid": "f7dd258d-2e4c-4e02-a5d5-01562b7201ab", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593m:fIS1xbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687495940, "uuid": "cdea0f05-8650-412a-9a9d-2f78cb3ba869", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687495940, "uuid": "9b8250c8-e5ea-485b-9f04-17fe812232a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687495940, "uuid": "71eb933a-e85b-4c6c-8f1b-9ef463dfae71", "value": "2_qbot_downloader.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4bb48d3-1191-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687502799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502799, "uuid": "65b4fa1b-d6e0-42d2-8606-388ca48a992a", "comment": "Malware payload (RedLineStealer)", "value": "67871ec8e88fb57b53903809a1ad9a86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502799, "uuid": "e0fc5e63-a0a6-461c-b5e9-9af95ff94929", "comment": "Malware payload (RedLineStealer)", "value": "34fa74244f7e85327784ea40ef0a8a28536d053e95c2642e83bfd961e1ef5e07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502799, "uuid": "44a1a3e7-9839-452e-92ae-644b75b1954f", "comment": "Malware payload (RedLineStealer)", "value": "59d563dcf7d77611f13ee832f5fcd36b6929310b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502799, "uuid": "065d2c34-f6f6-4668-9ea3-5c5f3ea54ba1", "comment": "Malware payload (RedLineStealer)", "value": "3fe3d39f39aca3af568265a66da8f2a20e7d9eacdd5113b65d1fa2efa52570ce0dd747c3ac374634b23048abcc8e6c82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502799, "uuid": "bbf4988d-b894-4cbc-8457-a962125603fc", "value": "T105B4F1CE61904473CB73CEF2D8AFE9D68EB930214B614BC7130D4AF58E416D4A61B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502799, "uuid": "95baa10e-5a4d-4f44-8f5c-3e568f9fc00b", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502799, "uuid": "ce4c781f-2430-4d4d-a174-99fec56d08a7", "value": "12288:SSepQpTey5sfvjpGBkn8e3V6F+PLglp2MTUQJQmZ:XepoTey5sFek8qV6FmgyML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687502799, "uuid": "06b1c04c-3efa-4a5b-b395-c293b6e1324c", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687502799, "uuid": "11631645-7e2c-4efd-9fbb-2820d6c272b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502799, "uuid": "ec1191d4-8535-4fe9-866d-1995ad09cdfb", "value": "67871ec8e88fb57b53903809a1ad9a86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45f82bb-11aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687513509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687513509, "uuid": "99a7894d-3a4d-4f1d-bb6d-1233e391a704", "comment": "Malware payload (AgentTesla)", "value": "b3c484cdb4ed360f07d79c33a143ac4d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687513509, "uuid": "efcc899e-bf38-47b5-bc02-6350df49ba64", "comment": "Malware payload (AgentTesla)", "value": "353433967d9ced20eadd9e8ca985c4e02318c7cfbacf261ada082007349a2b84", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687513509, "uuid": "a768e549-100f-4186-b149-fc511836d95d", "comment": "Malware payload (AgentTesla)", "value": "2e47330e7cbdbd2976ab7cf8fe3de0c774b0a2fb", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687513509, "uuid": "605c47c1-9082-498f-aee1-a05cbefb7a14", "comment": "Malware payload (AgentTesla)", "value": "36ea9d8f5488363b5de211b240eff776db6f5466f3819b809b17ae208869f82b74ffade504d011d981a55529cb20259b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687513509, "uuid": "b3dfc4aa-e0cc-45be-b244-54f9048266b8", "value": "T1E0C423FB5C3E0E24BADCBD7124BBB5EDC26B87927A1B6A143B790038C118D5108A7375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687513509, "uuid": "699e1568-87d1-41d9-b0fa-b05951e49240", "value": "12288:auHPdjbNCqVYba9cHCZvhvV+H/4+UizOWleajcenNoQG/bY:aONPVYm9cA5QHgIXlev/bY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687513509, "uuid": "b1f3f477-9b86-426c-8570-988e736b4424", "value": 592091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687513509, "uuid": "46cdf30f-41bd-414f-ba8b-0bc512305850", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687513509, "uuid": "3547e1b1-7c98-49c7-87da-d447fcc0098e", "value": "Invoice # 10623-27.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f0027e-115a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687478912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478912, "uuid": "a846dfec-d749-4a8f-b427-b888daa80132", "comment": "Malware payload (Quakbot)", "value": "931b5662d212bde1061ba758fea679cc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478912, "uuid": "222e39d3-52e2-4b36-9d57-eea1803281c6", "comment": "Malware payload (Quakbot)", "value": "35c2d1f252df65ff027c2bbd8abb9913ddb476b57814968515bd5d8036b203b0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478912, "uuid": "8417fc83-de02-469f-adc0-e2c1d17c4ac7", "comment": "Malware payload (Quakbot)", "value": "21dfba2a2b6da6d00e9ec85722664061732c58aa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478912, "uuid": "f1408a9b-e541-4138-bd16-fa270786ecd0", "comment": "Malware payload (Quakbot)", "value": "9fa9de5138ebf6d5041e313b40004eee00aa2fdc9361aaaedc28d50c4346e5c72b7595baf4394fe40358cccbe88d10af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478912, "uuid": "6d92dcd1-fe15-4fb0-9790-781e0b06a181", "value": "T134558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478912, "uuid": "821c821d-8451-4299-bce1-4f9e7dd37eda", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478912, "uuid": "abe74f98-1e77-419e-91bd-60df495f4718", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4yqQ:QbkS7XB1EsOSNPSp0EAt2bUeM4yqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687478912, "uuid": "8b7f05d0-f593-48ce-a177-52abc28e87b3", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687478912, "uuid": "86a42526-f3cd-498d-95a3-df3128e3e313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478912, "uuid": "6dcf533e-286f-42e5-82bc-11ad7a8402ae", "value": "05qbot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5183760-11bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687522583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522583, "uuid": "eb6e90e9-283a-4a4e-b4cc-2e579c7f8d1d", "comment": "Malware payload (RedLineStealer)", "value": "85681700ff7770a4edcf99bc4bfd4443", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522583, "uuid": "a535e774-5036-4062-a8b2-a5897fd7beb5", "comment": "Malware payload (RedLineStealer)", "value": "360021ebe6b8431bb0a7b27b6ff4a5c0998728edd3619bab81d067194afffad2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522583, "uuid": "277906d2-e7d5-4a71-add8-341aa1670f6c", "comment": "Malware payload (RedLineStealer)", "value": "2884d4561db066a89fa3bee697ef94a6969e99ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522583, "uuid": "d18c6e69-c436-43ba-b407-3f40946d5c71", "comment": "Malware payload (RedLineStealer)", "value": "169dddb415146dc2bad401cdf62aa5fb01f8e40656913839bfd13ac3a32d9794c0b04e57d19d98846919a4169ae8fe63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522583, "uuid": "b5f0a674-0060-41f5-b328-13565e82c8df", "value": "T103857EF4946F40D2F80B5ED1A828BA96077271B3DDD60834236D76088F7FE992949E4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522583, "uuid": "c2ab40ac-df87-4ad1-ad60-1ca6683b8d3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522583, "uuid": "2064e04b-5584-4e8a-be3f-87f52743d2fe", "value": "24576:yPpZl7Uqac00eScNWvPQwHAJUR0QlpgQfnpsdr:67G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687522583, "uuid": "576cf71c-4369-4972-9176-539094c6da13", "value": 1793288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687522583, "uuid": "5dd06326-d3b6-422e-ba74-10229e47ab47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522583, "uuid": "91764a7d-5fed-4f0e-8d46-3b9823274064", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd477a5-11ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687520528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520528, "uuid": "651aca52-d399-4be1-8507-a2084fd056d7", "comment": "Malware payload (Amadey)", "value": "dc509b6afd9dc26e04b78962cb53ea76", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520528, "uuid": "1a2e607d-b6bd-4d97-ba16-3c65b22d9330", "comment": "Malware payload (Amadey)", "value": "369fbc17d28849b2f9f33f5d761d348bd69ceb864e64970c9c7db0cdc1b421d0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520528, "uuid": "c9197984-c80f-40fd-8074-a4e1fbc50152", "comment": "Malware payload (Amadey)", "value": "85083b7a70ac8e1b2ad36946361a61469cfea443", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520528, "uuid": "ba3668fd-0c41-4ab8-ab0c-575a11de46bd", "comment": "Malware payload (Amadey)", "value": "b6627b958e02a880b3253bdbca35154b9bb35d4dd79423f181c2a12e1aab4c5772404c37b071df5ac124c5851d084b55", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520528, "uuid": "04818a2d-442f-43ce-b17a-779842fd379b", "value": "T17AB4F1CA22404973DF73C9B294EFE8DA8A7970214B714FC7120D9AF64E462D4E61B47E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520528, "uuid": "33b45e14-cb36-4675-9648-133b0ed01157", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520528, "uuid": "0cff1aed-16ea-4935-be5c-fd37736726cd", "value": "12288:NuqHL1Tey5s3xuIBS5GL667NOMc8GQJQmZ:MqHpTey5sBh6MhJOBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520528, "uuid": "55e1ed9e-869f-4e42-b77d-c11a5d3b3527", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520528, "uuid": "77534a2f-3e7f-4b71-afe2-d1f60085608a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520528, "uuid": "fcf68bcd-b801-4dbb-9ccf-f991939e120e", "value": "dc509b6afd9dc26e04b78962cb53ea76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43243e8e-1195-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687504326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504326, "uuid": "c6ccfb5d-ad8c-4189-8330-22bfe010157d", "comment": "Malware payload (AgentTesla)", "value": "e16c18a44f3206043cd36f7f0ad6c03b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "convergentinterfreight-info", "colour": "#D08CC0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504326, "uuid": "1a5d4ac7-ad28-4d5b-8e49-accdee89b939", "comment": "Malware payload (AgentTesla)", "value": "377ecccf20a10a0f9fb02b2d614ae682826322aabdaf217b1cf0f9b0ff14ece4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "convergentinterfreight-info", "colour": "#D08CC0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504326, "uuid": "407df71c-24e4-4642-9619-3af6363c21a7", "comment": "Malware payload (AgentTesla)", "value": "dc837b0355e75f4d578cc464dc46564fc1d5d30f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "convergentinterfreight-info", "colour": "#D08CC0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504326, "uuid": "07e712a1-15b5-44e6-b707-f3049d5c492c", "comment": "Malware payload (AgentTesla)", "value": "98b1dca3d6a7cffec0117fdb773e38840fefbebb91b36368a3175631c459013f5c41e9f6a62ffe4cec65a5df097db33c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "convergentinterfreight-info", "colour": "#D08CC0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504326, "uuid": "4fe426e6-f4fb-4195-b067-ccced5bac717", "value": "T19CD4127E56900E04F53B6FF915B94040C3B6AE909A16F23B1FF961F10663F429E2276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504326, "uuid": "0f63eefe-028f-4bb1-bd2f-02640ec416ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504326, "uuid": "14a40cfb-8e6b-4618-b947-005dcd2a67b8", "value": "12288:92iNG4/mNUA6dIzhYHd1tfKYhKNSwpeQOL66vrX8D:91M4/QUQUvBpYB3O1vU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687504326, "uuid": "e6a62c82-227b-45ac-b226-cbb26ef60623", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687504326, "uuid": "dedfca4d-d7ea-4508-bea0-9d62d82f30cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504326, "uuid": "c5b3b214-2cf6-4b63-9882-4fac67daf121", "value": "SOA 6009832115.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034d554d-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500354, "uuid": "11d41ef1-e5d7-46d8-8aed-479c477480b7", "comment": "Malware payload (RedLineStealer)", "value": "819cbdad2a646cdf3226e2572353c6df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500354, "uuid": "9b87c71c-1a8c-407d-a80f-a6df360d1a15", "comment": "Malware payload (RedLineStealer)", "value": "3905cf78405ad249adf367473ba1132d7fed797e908a6ba432204869a61a663e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500354, "uuid": "d3fe641d-9486-4fe8-b681-6c3277a0f436", "comment": "Malware payload (RedLineStealer)", "value": "741015f8b88cc1d5b5983f169929556449682cab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500354, "uuid": "f1da4828-b96f-47ab-aa48-64674618489d", "comment": "Malware payload (RedLineStealer)", "value": "1dfeeba6b2db0f5eb03ab323abc70937471ea536e3cd89c08eb7823b1312907644b76e291fe16aeee60b326aedae3919", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500354, "uuid": "d7eb2ef2-dc24-4511-8ac4-2b77b9413674", "value": "T1D3B4F1DA71804573DF63DEB2E49FE9C64E7A70200B6646C7130C9AF98F011E5A61B93E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500354, "uuid": "bd1109de-ca76-4eb1-b112-fbfbfd67f4a8", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500354, "uuid": "21912bcd-fe8d-42e8-8df2-06c0aa1616b8", "value": "12288:ERUd3XTey5sAkqtFznmBGemHXUlOAkbvBmWb/QJQmZ:WUdHTey5sdqzmOHkM3FmWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500354, "uuid": "cb101518-caef-425c-81ae-b3604a9289cf", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500354, "uuid": "154f716a-28e7-4afb-ade5-7a738ab1afe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500354, "uuid": "e10fc45e-6890-4411-9ec9-01a021136643", "value": "819cbdad2a646cdf3226e2572353c6df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c25a421-115a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1687478974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478974, "uuid": "063791d1-c627-4981-a22a-0ffdc9ced2bc", "comment": "Malware payload (Stop)", "value": "2a3f36cc1fd1f55dc98fd6592cd5d80a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478974, "uuid": "cdee709d-3962-42bc-958e-8b1f52bd9be9", "comment": "Malware payload (Stop)", "value": "3981a6763de8b685c4529b42046da372e8f6b95abf63f6eeb91be8e55ec0f35d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478974, "uuid": "fde4531a-40c5-4762-9b13-ca4a05c4c208", "comment": "Malware payload (Stop)", "value": "9eabc031f809f6afd46f12de051a6b903952db7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478974, "uuid": "c10ac8f7-0fb6-4c34-96f3-31017c347012", "comment": "Malware payload (Stop)", "value": "60a1528a5daf2bf7b950e64f4b6074541d0848d3f3c7b06ed8323eb3cada98f43e5d91344eb3a19ed1d8788e856bd353", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478974, "uuid": "d8f43f55-5c1e-41f7-a918-32dfe963e7a0", "value": "T1EEF4D053A3B27C94E525CB729E1EC6EC761EF2608F597B6E321A962F04B0072C173761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478974, "uuid": "e7998c63-d170-4794-856c-4711c4ed463e", "value": "b007a513e8535ccdc15870a09f4ce9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478974, "uuid": "4b3f2aab-031f-4365-84fb-4822eae7b5fe", "value": "12288:N2hvRjVMQ6CJysXa9mWI3FNCIoJIMxO58w6FCUMWYhbJgc4v:4tVMbCJysXa9mWI3WAMxnA/fJgxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687478974, "uuid": "4f8eda84-d356-4fa9-8e61-728ccca07735", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687478974, "uuid": "7481e60b-f7c9-47be-a1d6-02dd5af8a0c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478974, "uuid": "6c2ec251-e9e4-4451-8111-6a1edfa76d9f", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641e43db-11a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687512113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687512113, "uuid": "8d99eef3-25a7-4e66-b4a7-1fd7df0671a6", "comment": "Malware payload (Amadey)", "value": "4ace9ab23a9a8917e8956309f4cefdbd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687512113, "uuid": "4dbdbfef-0d9a-43a7-9e57-fdb4573e80c7", "comment": "Malware payload (Amadey)", "value": "3a290e55182cb2a1051081e495a5aa4536d46b2c96c8e2d77021a562bdc0b7c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687512113, "uuid": "f3e69e0c-d8e4-4de4-a75d-51c7731b5bbb", "comment": "Malware payload (Amadey)", "value": "8de90fd928f86faef75b841fed8226d3bb3fe094", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687512113, "uuid": "3f6e9404-2cb5-4d19-a9e3-ed9afc6350e5", "comment": "Malware payload (Amadey)", "value": "906f7788a5670b4d2ad9ee959f991714f473a7a2717319d42b2ecd2e3639ce5e6be866c2b1305900feb585d651aaf6b7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687512113, "uuid": "deaf8dab-5c01-4525-8cbe-c5086b038a75", "value": "T180B4F1CA254089B3CF73D9B2C4EFF9964FBA712107A24BC7120C86FA8E415D4A51B57B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687512113, "uuid": "cb1aad10-f02c-4f1a-9d1f-f365f7241a26", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687512113, "uuid": "821673a8-d897-45f9-bff9-7ea32573eae3", "value": "12288:Y+OemjTey5saACOPsyBabrGyI5CRxn6+09ksW4QJQmZ:Y+OzTey5s5syBSrGyIwRxnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687512113, "uuid": "f8ded67c-f40f-41ba-ba59-d9d3b4964b4b", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687512113, "uuid": "d857d33d-77e1-458c-b75a-79ee7601146d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687512113, "uuid": "b90221c3-12b1-45f8-9a0d-8d6a1c718204", "value": "4ace9ab23a9a8917e8956309f4cefdbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cab7f10-11e8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1687539910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687539910, "uuid": "d85e570e-d55a-46b5-b0d2-404bb32017b9", "comment": "Malware payload (njrat)", "value": "b57297d567af7aecb7ab30789a1205d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687539910, "uuid": "a42dab9c-94ba-4b6d-b5a1-5cb4ffcfbbf9", "comment": "Malware payload (njrat)", "value": "3ac5b866a3d8d5dbfeb2267dc534e28304176d54905a7fe0b3e2ef030ea8fcdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687539910, "uuid": "ecfae003-c8b2-445d-8b6b-4fd5251514c6", "comment": "Malware payload (njrat)", "value": "42c78175138f895c0198553b127ffbdcfdd8168e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687539910, "uuid": "2ab40584-136f-4d81-b9d2-1bbb00f2c2cf", "comment": "Malware payload (njrat)", "value": "ab3ae5358d7593ad73f5734826b8811de632996b25b0ad00f5abe2cc9efb0308643eb16efc28998590ca35932cf70377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687539910, "uuid": "6f72dee8-039e-442a-a87b-db0dab21ef8e", "value": "T1C6432844BFEA4A05E2BD8F3469F655150634BA23E532EB1F48D668EB13327C58C40FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687539910, "uuid": "2fa037fa-5378-4bf8-b724-9c4ad441aacc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687539910, "uuid": "b455f33d-8fe6-428a-be5a-6cfa92c74b01", "value": "1536:awjs4DnAN7jytFADRwsNMDAXExI3pmGm:JI4DnA2PADRwsNMDAXExI3pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687539910, "uuid": "723a7606-235c-47f1-b0ed-6d59f43cb33f", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687539910, "uuid": "8dd37fb5-9322-43f2-96fc-3d9b52abad32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687539910, "uuid": "0550289d-ee90-4df8-8e46-14c152483e8c", "value": "b57297d567af7aecb7ab30789a1205d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630ddf0f-11ca-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687527143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527143, "uuid": "c0cb0dd2-ea26-4999-a855-db4f66caf021", "comment": "Malware payload (Amadey)", "value": "2d5545fc202e1ac2dab20a1284e0cccd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527143, "uuid": "27b65fd7-b09f-4811-9c54-4467e08b60b5", "comment": "Malware payload (Amadey)", "value": "3b6586fe783767efcb3190f2965c718a636f85a152937dff883dec56b2bc9e5a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527143, "uuid": "d9e1bbcf-a05c-4411-acc4-0e8bee8b3b4a", "comment": "Malware payload (Amadey)", "value": "3c64d36eb8b4b745c01e6428c8e2d139ddc246ec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527143, "uuid": "859862a0-0f2a-4288-b075-0a494e19d651", "comment": "Malware payload (Amadey)", "value": "76e47c0da60a97e6bc874be1d185d04ba8be23e70c8ff4a3f1521ce05fa308fbe3b0a2d88cc897d73ae7c254470bcfa4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527143, "uuid": "616a3222-f735-4a31-b71b-32679c04f80e", "value": "T1090612782A41EA33DBC72572C6A3902F085D76B1115FBC85BFA35D2799670ACC438BE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527143, "uuid": "12eee5d8-d275-4e8a-af96-cabd8a252a2d", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527143, "uuid": "22704d19-5506-4974-b61d-48a463ccdcaa", "value": "98304:zX4B/ujBR6t/B+HTXr5lh/CiMFsfTp65+MQB10JjqTCYxCHdcFyx8kKqT1edeNKZ:zX4eSB+HT1xMeI+zTCYx+dQyx8ZO4deM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687527143, "uuid": "1b14cf0e-51a1-4040-ad02-242450f8327f", "value": 3748864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687527143, "uuid": "a065ce80-4ab5-4376-b445-a82c8baced5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527143, "uuid": "53b08f33-0019-4519-a1af-e1be71b07e6f", "value": "2d5545fc202e1ac2dab20a1284e0cccd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7aa0e50-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501596, "uuid": "03bd3830-b027-424b-9850-6c299576339d", "comment": "Malware payload (RedLineStealer)", "value": "f8fd78bca97488fba21d017edd3e9e56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501596, "uuid": "eec8b49a-80ba-458b-8d0e-abdae1d9fc48", "comment": "Malware payload (RedLineStealer)", "value": "3ba71119e7da8a90083932b81d5564b79b09d454011000f7b9d437f55c2d5a60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501596, "uuid": "b20cc07e-d525-4663-82fe-03a85411c237", "comment": "Malware payload (RedLineStealer)", "value": "3847d17e970a7aff186f247d5b34b27b6e01f738", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501596, "uuid": "26f1dea2-7c90-429c-8964-9f7fd5267056", "comment": "Malware payload (RedLineStealer)", "value": "8cb3071bec98b65349590c4df189a01d824fe4b68d9a524635dd7006f9b977eff15bac448de9bfb84d0de39bba1538c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501596, "uuid": "a938ff72-8bbc-4c6d-b269-260cca4d29da", "value": "T1ACB4F1CA368045B3CF63CDF198ABF9C68E7A71210B744BC7130D59F98E411D4A61BA7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501596, "uuid": "a4c4c794-26c0-4e2c-b4d8-ea3770b30807", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501596, "uuid": "b959e2f6-1ae0-49b2-9295-2c1c2dad9416", "value": "12288:ueihzTey5sKRaCESJhSl9tB3lBz1izumP54N5JSQJQmZ:ueiFTey5sKRaDHlbB3lBbL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501596, "uuid": "5bf037dc-e262-4a40-afc4-ef6288bb77f2", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501596, "uuid": "a9f1c446-bf14-4ecb-95b6-160b0c9e2e4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501596, "uuid": "46e2e9c8-213d-469c-bbc4-b09ed2a84b3d", "value": "f8fd78bca97488fba21d017edd3e9e56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9536ff-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500074, "uuid": "e76aad53-9025-4899-9f31-382dd1668028", "comment": "Malware payload (RedLineStealer)", "value": "718ec0223e2895b99b4b7d07792ff3df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500074, "uuid": "92fb3a9a-0e2d-48da-8c81-1c9211bc81b7", "comment": "Malware payload (RedLineStealer)", "value": "3bf9cb6bdd353d79f397855b168256eb9b70aaa4975afcab8a96b3899efbfedd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500074, "uuid": "25af7ab7-219b-4ba0-8a83-2df684c38df5", "comment": "Malware payload (RedLineStealer)", "value": "067d7dd7b58d271b7ee4fdddca4c58e9d93223b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500074, "uuid": "5dc7f27f-0230-493b-bccd-d7764d249e57", "comment": "Malware payload (RedLineStealer)", "value": "a4abe3a4ea572e57ef6796bf2377deb3484d0dac958994d157750cc99e6cb76bb167d0d11536791c0110a1c7b3e45425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500074, "uuid": "f892d413-a18c-490f-83cb-7fc4dce94dd3", "value": "T1D9B4F1CA21404973DF73CEB1D4EFFAD64E7A702207714B83120D5AF68A415E8E61B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500074, "uuid": "8d39947f-dfa0-420c-9305-8902e4151f15", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500074, "uuid": "c9800f1f-5efc-4a3e-b52a-ce69516a5988", "value": "12288:2E9mWtTey5sGfvv32MLb7a/7T9pLlEAEZfrC2no8hGaAZbQJQmZ:2E9myTey5sGfXmO+EAEZTvVGa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500074, "uuid": "2e0db071-b78a-4877-8f11-b6923d23af1c", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500074, "uuid": "5d914c0a-bfde-42ab-97fa-a76741814687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500074, "uuid": "f76c16d9-4174-47cf-a361-37c9f9a042cb", "value": "718ec0223e2895b99b4b7d07792ff3df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61465531-11df-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687536160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536160, "uuid": "6512cc8f-0776-4fd7-a126-12f9336d2dbb", "comment": "Malware payload (RedLineStealer)", "value": "b40b405f929b78247af411863bfa9ade", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536160, "uuid": "302bde5c-d3c0-488f-813c-ff1d109594a0", "comment": "Malware payload (RedLineStealer)", "value": "3bfa0107c919b679913bae710049ad72c96862a5e10a3e941ad4c21f5d397865", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536160, "uuid": "04ee13d0-5389-4543-9671-1113e7736469", "comment": "Malware payload (RedLineStealer)", "value": "79dee3e9607f7f0a1975cb72e3d3905d78b5baf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536160, "uuid": "be75e5cb-081c-4672-b52f-6fb869d46b54", "comment": "Malware payload (RedLineStealer)", "value": "e86d8e56faa75b86ac6afe1af201e3e8d07608f910f3f3b23146327cebbad10be5896cc8aafa5fb541d7524e8ce25c66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536160, "uuid": "da63a05a-3987-428f-b8ba-74132eb5cc2d", "value": "T1150622362A04E233EBD7293AC4A3969F485D6AB1191FB8497F670D379A635DCC034BC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536160, "uuid": "ed0495b1-7830-4ed0-a4bd-318c2a2bbd3c", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536160, "uuid": "82831254-018e-4039-a263-6e091764155b", "value": "98304:Fr024Im7zrfo3d+CgSsz3GEyC9lwERIpad/Y62GrnXdMQz3m46l+InOOxDs+3U+q:Fr0247rfSd+C+7PyC9agIB96Cs3mr9Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687536160, "uuid": "16e9bfa7-ea58-4c7e-9648-e47d9b677ed4", "value": 3785216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687536160, "uuid": "1b59d664-7980-422f-945a-b638af69ac1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536160, "uuid": "5450e3df-ab5b-44ce-98d6-2e59536142b4", "value": "b40b405f929b78247af411863bfa9ade.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0dd4030-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499759, "uuid": "a8245e13-cd48-4d2c-bb99-5f540a763582", "comment": "Malware payload (RedLineStealer)", "value": "2ccc950267890a87259eee43a8ed1acb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499759, "uuid": "2495fb9b-d2a3-45c1-a880-38b98b1f0217", "comment": "Malware payload (RedLineStealer)", "value": "3c32399d55660396f7c669fd7c0b344a43bdcacc5919036736d732abde23053b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499759, "uuid": "2c7c88bf-7400-4e29-8036-d980b8eeac91", "comment": "Malware payload (RedLineStealer)", "value": "324443f3ec8541399c59344b4c28a5b5a91f3d68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499759, "uuid": "5303205f-1d2b-4e4d-b38f-f2c1f3fae952", "comment": "Malware payload (RedLineStealer)", "value": "aa352ade99b03080da2fb9a06279793394544577105c9b1989d9763539cdb737599e8ff4b9d20f2152010333ab981f22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499759, "uuid": "ef070195-a756-4cf2-84d7-a847b3a6fe0f", "value": "T1FDE401CB25800937CB23C9F2C4EFF9D64F7971210B750AC7220D59FA8A156E5D22B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499759, "uuid": "0330411e-a496-4d8f-a974-3e9838b20e2f", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499759, "uuid": "e89e4619-a1c8-403e-a33c-32381eba3db0", "value": "12288:VqA7qTey5sHVmB28l7CZbGn3gRfPr2jLwjNks5jDHqWXzD3e4QJQmZ:VqAuTey5sIBZ7CmA3r2jSjLxj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499759, "uuid": "864ebacf-2a47-4834-97b1-2644ed6e0776", "value": 715072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499759, "uuid": "61b0d253-517c-4985-9763-8818b8c9f379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499759, "uuid": "e284e885-5821-422b-9464-1cf1e2f3cef7", "value": "2ccc950267890a87259eee43a8ed1acb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920f3502-11bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PrivateLoader)", "timestamp": 1687521639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521639, "uuid": "4c767aa2-b948-4392-8723-a87c15ed2ab1", "comment": "Malware payload (PrivateLoader)", "value": "45cc723231d7020b65f78a669f186e85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521639, "uuid": "4022fd4f-9431-4d2d-ab7d-f1e1d585dc5c", "comment": "Malware payload (PrivateLoader)", "value": "3c755f1a6e43039854120e7cc2d88f52c2bb6471a18aa47b18577de86f76f160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521639, "uuid": "71fc54bb-f763-4857-9079-b199c65a399a", "comment": "Malware payload (PrivateLoader)", "value": "122b684df000a3b967b1b812a8ffcf03fde0cf01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521639, "uuid": "3408feec-7244-4cc5-8098-d5fc1e732ad4", "comment": "Malware payload (PrivateLoader)", "value": "04ba9ce08258c278eb30035d2a24e781484c1211ff13ffa9ccdc99bb3a129a9fb667a29e9443788178c3c89e4b2b12e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521639, "uuid": "8a5a6953-3483-4370-a6e5-8eb53a1b31ae", "value": "T177762382715204ABD2E18E394A3BFFF076BA1F95F4824472B6E0BDDBB5B2854B503471", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521639, "uuid": "5d5b9f76-080a-4806-8121-49774d7aa533", "value": "00143c7843a6bccd9702bb42aef6cd34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521639, "uuid": "c71eb6d2-7bec-48d3-9a87-502617f43029", "value": "196608:HH/BLZY3LEG0j9t9KVuCVUozVPSXtZI5UotJ:51KLajtKTNVPatZIiot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687521639, "uuid": "9d697ea7-50cc-4089-bede-9f792c4b82a1", "value": 7748096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687521639, "uuid": "f6647aa0-ff9b-40d1-beea-c7b9ec754f31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521639, "uuid": "556b0da7-e3a2-40cc-8764-94a724e12d67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5daa75c1-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500076, "uuid": "ca620f17-105e-4b03-9f47-64347ea50d53", "comment": "Malware payload (Amadey)", "value": "715087b630db3a1b35aaf5838e81d6db", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500076, "uuid": "99d3a7cf-5a41-40af-bb31-36afb6cb7e6c", "comment": "Malware payload (Amadey)", "value": "3c8391009481b80893bbbad5be184c3499fe28dba309666cd90d87783e5bea04", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500076, "uuid": "8a6bcb92-de6a-49c4-90bc-ebabfae094c5", "comment": "Malware payload (Amadey)", "value": "425fe956e8e1fd76f4cbd64699325e91ae88b053", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500076, "uuid": "6b375ba7-68a0-44b7-8114-b2adbe419a81", "comment": "Malware payload (Amadey)", "value": "4179bfa8fee90419a1e7d30b5cf2886579121f11826b938369969b98b0363b40658ee63d575c90a829c06866dcf46938", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500076, "uuid": "43bb3f57-3eba-4706-82c5-45bc78f18161", "value": "T17AB4F1CA22404973DF27CDB2D8AFEA968F7A7021077687C3120D4AF64A416D4F61B57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500076, "uuid": "ecb5ca34-09a2-4667-ac66-29f9be8bfbdd", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500076, "uuid": "cc9ee737-bbd4-4580-8365-102eb76b839f", "value": "12288:AeIVdTey5sKitk00iXTGN3UfiDg8cndYNjVaPY4QJQmZ:AeIvTey5sKibYkak8A4j+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500076, "uuid": "66625b8e-f588-4c87-b84f-f570f4458dd9", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500076, "uuid": "0427cb74-21fa-45fa-916c-c71614c3cee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500076, "uuid": "da1b8f19-437d-4723-826d-71036aaefa1c", "value": "715087b630db3a1b35aaf5838e81d6db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd5e41b-115a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687479162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687479162, "uuid": "17a5f8f0-2a54-48f4-8d49-7aaf1690774e", "comment": "Malware payload (Quakbot)", "value": "86fafbdba370101f32581922ed84978a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687479162, "uuid": "4d2238e1-62b3-4290-8664-b5649c963256", "comment": "Malware payload (Quakbot)", "value": "3d1d163b85b2b117b66584438959a3edd259c6a996080f02ceba4ee251ca9c88", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687479162, "uuid": "7713ae05-f55d-48f8-8f98-36eb63c40ae6", "comment": "Malware payload (Quakbot)", "value": "3e2b68c38694d05f1851941e204dd61a33548206", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687479162, "uuid": "483106b5-e2de-4342-83b1-add6c46121ce", "comment": "Malware payload (Quakbot)", "value": "bf471151ca67fd240838c74b370839a9364c38575086f3916b97da0ea19656fd624d1f3f0d2701786931e03da160201e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687479162, "uuid": "e6faeefd-6bdb-4702-b2e9-a720abb52fef", "value": "T1FC74496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687479162, "uuid": "f446282d-c9dc-45af-b080-484e945c9c72", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ5936:fIS1xb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687479162, "uuid": "b51847cf-4a36-4799-9a6c-0814ddbef943", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687479162, "uuid": "8b0fe321-b253-4ded-8e74-245b8c65e600", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687479162, "uuid": "ebdd2dfb-edb8-4ce0-a47c-91c5969f3d09", "value": "BSN-72270641.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e321bb-11eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687541422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541422, "uuid": "f763bccf-7a92-4045-bfd4-0f3b472015c9", "comment": "Malware payload", "value": "dd04837eabe356e5ff7264fff875e5b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541422, "uuid": "d3f87d5f-2cd2-4e11-97eb-bb28d99eddb7", "comment": "Malware payload", "value": "3ed2e75343ea0e5c8c6fc4de3b20f86b65e59a2c0cc91a35796052b2e1e7b389", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541422, "uuid": "4ce04594-6a56-4550-aaf9-93aa9efc3c93", "comment": "Malware payload", "value": "673eedf5f187377500031b068e44d990475ea447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541422, "uuid": "8873f4da-a7fe-443b-b429-2f3f14fbc0ff", "comment": "Malware payload", "value": "ae4a0446dcbac61627a0b6e86dd564e770ee9cfa801803d734a12c640c15acebaf4a4c6cc8adf68ef73db3c1c095bdcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541422, "uuid": "c5bc1285-7da2-44b0-8193-769f29aa639b", "value": "T193E43A55ABB514A9E9F2C17C8A534A37E3B6F41413309FCF0661893A0F17BD82B3A758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541422, "uuid": "d4a9a4d5-f6e3-4011-94a3-97fe71b5210f", "value": "d43c0febfe7d9daede851a726111adf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541422, "uuid": "6e0a39e5-1daa-4d30-b6fa-b5239f6a77d6", "value": "12288:GiZ2R7X+9iOJI76AUi77oizFCEeSUUE9NYJe44lYWvSwkU2lvzGtp9:46JI76Pf9Nn4MvSRU2lvzSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687541422, "uuid": "f77a5c8c-4dfc-4790-a8b2-88b54a85ad1c", "value": 712736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687541422, "uuid": "5fd0a9d5-1fa3-4a5a-811f-7235b5b2c1e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541422, "uuid": "64906f53-628b-49e1-88cc-fe704ac17f0b", "value": "1210.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8a5bf0-11b7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687519027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519027, "uuid": "1472e9fd-9794-4ff9-b0e4-7da5651be6f5", "comment": "Malware payload (RedLineStealer)", "value": "c52619f4a2d52c9204abe148b9b1ff89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519027, "uuid": "4487553f-555c-4129-bd19-5f42b3ebac58", "comment": "Malware payload (RedLineStealer)", "value": "3f9a832c49bebb92e348443f52d4e3c3be4daf98c82eb0e0999ec90b49930d2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519027, "uuid": "2462c66d-9b29-4a30-8671-2a22392ee0c2", "comment": "Malware payload (RedLineStealer)", "value": "e25419d6d67d677a3d73b6ec8618a751cea72a8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519027, "uuid": "f64bc6a5-c9c6-441a-903a-4f4794462dbb", "comment": "Malware payload (RedLineStealer)", "value": "60b9ccbfce8613df3abb9c328edc616816a079c8ff4e638c8b6cfb30a76ea0df1c03a9f13639e3c0254580df5d6692db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519027, "uuid": "01da541b-d8b3-4456-8ef8-9a667bad7a58", "value": "T1C7B4F1CA61804973CF63C9F2D4EFEDD68F7AB0214B614B87120C85F58E452E4E61B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519027, "uuid": "95c118a3-db10-4029-9277-8905cbddb783", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519027, "uuid": "aea84b2a-d599-4e80-b86f-8b0d068b7458", "value": "12288:yeOFsTey5s4tJ0VSxYgCUNu3+71YVb/JvQJQmZ:yeOWTey5sUMouoyVbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687519027, "uuid": "e59448da-6963-45ba-9f4e-e12cc8abb4d5", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687519027, "uuid": "ce83d75f-a21f-4ca2-90e6-784f7f3805f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519027, "uuid": "fd0842ea-1689-4baf-be4d-e3f68da9f3bb", "value": "c52619f4a2d52c9204abe148b9b1ff89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a53e7f-1188-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687498821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498821, "uuid": "de0dbf9c-1890-41a8-ba22-2b8d705e8aa6", "comment": "Malware payload (RedLineStealer)", "value": "16f2fac849680ec6b8a014d82c448bca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498821, "uuid": "32bd12af-45fc-4695-8897-be7bcfb82f54", "comment": "Malware payload (RedLineStealer)", "value": "4047e6b32f4dfe52915aa35b654cc753cc025abc4a70c083b8cac99b0a49fab9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498821, "uuid": "0e107509-89f2-4326-abf9-fa10e2e41e70", "comment": "Malware payload (RedLineStealer)", "value": "1e7917bc5b31ab7592d61594732a105640950bfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498821, "uuid": "ea7a55d2-bd60-4f54-b542-814f4e936fb4", "comment": "Malware payload (RedLineStealer)", "value": "cdcee0cd65e9f774658121ee22ffb8572742b7c1e4112769a10da467ec3bb147ac6730d40b74786ffbfa570c32807665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498821, "uuid": "a835fddf-f5a9-4e04-a361-11bbdad109ef", "value": "T110B4F1CA25404573CF73CEF1D4EBE9DA4E7A712107254BC7030D99FA8A486E8E21B53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498821, "uuid": "76d64d73-0775-4840-9db2-cb71bd22f47d", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498821, "uuid": "ee3cbff1-9382-42e6-be80-bd5147cf9715", "value": "12288:bQkvqPTey5soz/yYZENe8s7ital141L6NrYQJQmZ:Ekv4Tey5soDyoENe8sOH2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687498821, "uuid": "af339578-4ccd-42b0-9c06-97644b54c943", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687498821, "uuid": "2d01b55c-fc66-4733-b59d-e870a8c74f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498821, "uuid": "2aba2868-b0a7-4a6b-a885-6cf9da137de2", "value": "16f2fac849680ec6b8a014d82c448bca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa552ca-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687501628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501628, "uuid": "c3cfe9ef-2b99-4d2b-9119-d8eb0390855a", "comment": "Malware payload (AgentTesla)", "value": "7b092289e0e677475e883564cd814197", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "convergentinterfreight-info", "colour": "#D08CC0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501628, "uuid": "a70fa37a-0bef-4291-99ae-a5dc5b5e6edf", "comment": "Malware payload (AgentTesla)", "value": "40f75c27639dc3bbf3922273ebbca9da330874fa3e9d6f4c1a9b0aacc18fdf3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "convergentinterfreight-info", "colour": "#D08CC0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501628, "uuid": "fb894964-9d77-4e86-93ff-e6b2279d1621", "comment": "Malware payload (AgentTesla)", "value": "84162ed15ad7c1d43a31a97dbba8f8455f8b50d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "convergentinterfreight-info", "colour": "#D08CC0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501628, "uuid": "1cf632c9-0f4c-4f0a-9d1b-4018a20e9a9a", "comment": "Malware payload (AgentTesla)", "value": "a76fe13821c548face5f60dc737eb978de23e87ae75c01e981f80e0b525a7032d6cc35fa0e283e857af472fefad23cc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "convergentinterfreight-info", "colour": "#D08CC0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501628, "uuid": "b52951d3-2c43-4275-bced-3f75c2dd81c4", "value": "T15D25E010766A6F60E4BA8BF60960517057F66E6BB43EFA094EC3B1DF25B0F018961F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501628, "uuid": "5c818428-5b86-49c1-8866-944da4c20f04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501628, "uuid": "3503aadf-f76c-4066-95a1-cdfdadc5ad82", "value": "24576:K7MyuyF16HWzwJ1KNoIiqexBs0P1lxmfMT/x:K7MyuyTFEJ1KNoIiqh0vxmfMT/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501628, "uuid": "2e88f982-ea79-4c28-b705-2237fab53a46", "value": 1030656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501628, "uuid": "3ff29cf2-ab72-4326-a7a2-a30e32cbe30b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501628, "uuid": "45aa8d2f-46cf-4c79-8bde-c5404e7b4a6a", "value": "PRE-ALERT ==HTHC22031529.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01c2bc2-11a1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687509771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687509771, "uuid": "ab3d0de9-73d2-4704-befc-99fdf0c995e6", "comment": "Malware payload (Formbook)", "value": "36b0d70f7a9f2a51bd2884f0e31ac873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687509771, "uuid": "5fbf8896-19c2-4ce2-83b5-3f3448036901", "comment": "Malware payload (Formbook)", "value": "412c6188c1ab56d9a41bc91aa4b39e664ec9346a718a7ae9bf495618230d7c2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687509771, "uuid": "58fe4ce5-8c92-4843-b6aa-b7ee5218be3b", "comment": "Malware payload (Formbook)", "value": "02488206754da10406ba2582a8bb86a2a25f1a77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687509771, "uuid": "c5093ba4-b681-488a-9507-fe4340e03130", "comment": "Malware payload (Formbook)", "value": "b67ca9079e675721f441a96403d1d47f79b1a182aed26ec9c3d7213aee7b24a6057bbb4628636792338b16cfcfff4b5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687509771, "uuid": "8e0b8747-0d11-4bd1-9a99-dcb2aea11de1", "value": "T11D15F11022784F13E13E87FD1461267093F8A69A706AD34BCEC7B8DE6F66FC10259A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687509771, "uuid": "a2108da3-db1c-4aa7-a7fe-ac48274c5c93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687509771, "uuid": "1b3821b8-9e02-4134-a542-b9a97e6f5860", "value": "12288:12qly+7PM7q6bpw4dcZda/ig8rJdpc0SKHhTDC1Q0xQlXBi+ENP7UQM5VdfTqYo4:jSzu4CZdO4ZPHmQlXBi+6P7UQOAM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687509771, "uuid": "e7847923-23d6-4294-bbdc-138add8ff59a", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687509771, "uuid": "30efe314-a91a-4d09-8beb-1cd1f717bbb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687509771, "uuid": "6179c322-4292-4cbc-b36b-42dc0d851873", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3449b404-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687510314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510314, "uuid": "254a35d8-55cd-4d56-8350-c5bda0f43a04", "comment": "Malware payload (RedLineStealer)", "value": "1ccf3f2e3c9de29aa086a5da460428dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510314, "uuid": "9e3f8bc2-7fb8-4f1c-a3e6-4f846865573c", "comment": "Malware payload (RedLineStealer)", "value": "422c2977acd9f122bd239132a53ff3bed17034aeec5dbe636f3a1aecb61d3bee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510314, "uuid": "cee3038a-2100-4564-8a2f-8da523eb069d", "comment": "Malware payload (RedLineStealer)", "value": "da7fe03657dd8d82fe9313b72b6da73519d873c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510314, "uuid": "e95cabb9-dd56-4762-8139-d6a23dd3d9e3", "comment": "Malware payload (RedLineStealer)", "value": "6d16a48cae78346a17f384418200b87b9d31188bb1e8120cee5d05093bc91b22221f62d3483b11b0422fd726feabe089", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510314, "uuid": "c6919cf5-7be5-4ebc-918d-521206924e7b", "value": "T14EB4F1C621808573CF33CDB294EFE9EA8FBA70210BB14B87120D99F64F156D4A51B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510314, "uuid": "cbe93a41-f9ed-4ba7-a910-d8650a04c942", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510314, "uuid": "8d33dc66-1421-4298-9b80-9948972916ad", "value": "12288:P4mO100OuVTey5s8TcsvBG4QMLiybVxnYxQ7+5pl2y86kxQJQmZ:P4mO100OqTey5skvyMLiy/nYPl2t6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510314, "uuid": "858c665b-408c-49ba-8012-960b4389891d", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510314, "uuid": "542f718c-f4af-42f2-85bf-2de006438537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510314, "uuid": "a072c855-a39a-4a26-9ab2-91b87ebc224e", "value": "1ccf3f2e3c9de29aa086a5da460428dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb18703-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500663, "uuid": "aa923a51-393f-4fdd-a445-972b0e7ac791", "comment": "Malware payload (RedLineStealer)", "value": "a5ea72a5dea23fb343e1a0a895c1c7e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500663, "uuid": "9dbc3e94-9d1d-4e6d-bc1c-eb6362ac19c3", "comment": "Malware payload (RedLineStealer)", "value": "425a1af68af7c0b9a3e414ea5ca2f8a618a84903938fb232b7b06d69a5da3db8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500663, "uuid": "402e0a49-38b1-44d6-a760-698e19437ed1", "comment": "Malware payload (RedLineStealer)", "value": "79ccbc8d134ed8142bbc74ea3fecece416b57e06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500663, "uuid": "eea5f7c3-b9f0-43b1-a830-f7cb1e7b708a", "comment": "Malware payload (RedLineStealer)", "value": "f945ab5b0e8b0d896be0ba1907fcb67f7384d28023f781221fc2818306a3d320fb5296005596013088569997fdb9911e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500663, "uuid": "309bd2ab-0df4-4f26-9599-f0e455d08899", "value": "T15CB4F1DA62404973CB33CDB2D4EFE9DA1FB9702107754AC7220C9AF98F152D4921B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500663, "uuid": "c868a5d1-4d2e-43ef-ab41-f154b9503f8e", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500663, "uuid": "44870505-560d-407c-95d2-3bb6adb6bdc9", "value": "12288:joA7XTey5sLy3jSZVfFihC+bxoxck6QJQmZ:joA7Tey5sLy3+ZVfFivdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500663, "uuid": "8642c2dd-9098-42f2-b1ea-08ab7bab42aa", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500663, "uuid": "bb4ec890-d4ac-4f5e-8326-a5b3dad3716c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500663, "uuid": "b144afd7-41cc-4a93-98ec-bc3c3bb835b4", "value": "a5ea72a5dea23fb343e1a0a895c1c7e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57045069-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500065, "uuid": "e00fd5ff-1ad7-481f-9491-d8e50f0f3641", "comment": "Malware payload (RedLineStealer)", "value": "6a29a9a5eef9e7a0a3770cc2ce6daa1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500065, "uuid": "3cd544e2-fc73-48fd-b10f-f3a7cd3d4e5b", "comment": "Malware payload (RedLineStealer)", "value": "42ca8b4c71040ce845f65c9eb354784a5fe8b5dde7d847263f50a0e9a4025d2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500065, "uuid": "e03b126a-0343-435f-9bcc-54718b8206f5", "comment": "Malware payload (RedLineStealer)", "value": "d304ef7fb995f562f26f142577dffc2cfeed3894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500065, "uuid": "26ac02af-0e90-4c0d-a7f8-8d15fd6b25f7", "comment": "Malware payload (RedLineStealer)", "value": "3f439eeb5d7ece865f368b0efba6e97c7179d8ef90c48033c29683a3a09045106d70be13c12488ff636d56880421f638", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500065, "uuid": "71ad795e-e863-4759-a758-8f7a6156260a", "value": "T1D4E402C662804973DF73DDF1D4EEE9DA4EB670224BA243C7024D49F58A425E8E60B53E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500065, "uuid": "31ddd463-a63c-4091-ad6f-c088219be2e3", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500065, "uuid": "077c7412-7c40-40a9-ac70-16dc541038c6", "value": "12288:Txq3G+Tey5s3suQukNs5X7kPUhXl8T5wDTCRCxnrNgiq+uVLjtMPQJQmZ:Txq3dTey5s3suQun5L9o6CCFrNDMfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500065, "uuid": "6fad39fa-3356-4b59-9c19-4dc0becf3fac", "value": 715072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500065, "uuid": "d45bf002-9398-496c-9961-b341aa374273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500065, "uuid": "416e2cd5-295b-4277-8f65-3d1062381635", "value": "6a29a9a5eef9e7a0a3770cc2ce6daa1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957efa9f-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499740, "uuid": "b8d05251-8c5e-4e7b-b826-49734fd566c3", "comment": "Malware payload (RedLineStealer)", "value": "314955340cd564b1a2d1b267b18bb4ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499740, "uuid": "ca649308-567d-4e5e-b3a0-64a6b06136f4", "comment": "Malware payload (RedLineStealer)", "value": "430093cd7411306769bc9663a1dfdcb0cdcf8662f9b81839371745e13e54697b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499740, "uuid": "919732bb-a799-4319-95c5-3ebfd3eb269a", "comment": "Malware payload (RedLineStealer)", "value": "cad9ecde416174a4c2f84f66efe4b61bd3dee601", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499740, "uuid": "0793f3ae-a4c4-46e7-8ebe-12d4eca3f48f", "comment": "Malware payload (RedLineStealer)", "value": "1f2beece6020c00636198519be77be15851c3ca23479a8b8dc67193f46b831075f372af0862bd6e2e617eb03d992b6d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499740, "uuid": "b94c535f-9ca0-4086-ac57-4a3fbd1553b5", "value": "T11F444BFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA284CA19BA0952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499740, "uuid": "b6f6b706-6b6b-43c9-bf64-aa83f4489c44", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499740, "uuid": "8a1f3a23-edfa-412a-af0c-65fc817ff483", "value": "6144:GYh+Fqigt0poiRG/XvLNUgYhuE22sQJQmT:GYh+DgtAoiRG/fSvkQJQmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499740, "uuid": "3b2ace02-d4bd-4106-91c6-d9d4765287b5", "value": 275779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499740, "uuid": "c695d624-5810-4216-876b-daff76c8b6ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499740, "uuid": "9f1c0f3d-203a-432c-8199-38d382544887", "value": "314955340cd564b1a2d1b267b18bb4ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd9e3c5-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516315, "uuid": "e542fd1d-e92e-473c-bb3e-7ef25a408431", "comment": "Malware payload (RedLineStealer)", "value": "29b64e2e55eb55771f7e6169def32a9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516315, "uuid": "61e8ef54-701e-4a68-9c76-f7ebe71606ad", "comment": "Malware payload (RedLineStealer)", "value": "436367eea8cdb72064ad9c0e5797dc57399695d17db500face828183086e5f76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516315, "uuid": "7a0f071b-7efa-4aa1-b565-777defbcbc42", "comment": "Malware payload (RedLineStealer)", "value": "d93b7328e27e6b0b62d60fe4b1cf545b60653b3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516315, "uuid": "2527cb39-6e9a-4535-a830-bbaa526110dd", "comment": "Malware payload (RedLineStealer)", "value": "7f2fec900dbbbdb3652c23d487d6d1da38f4fd09ae9a4a4f8c479ae29be68ce0019858277561c8136b4c4646167347dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516315, "uuid": "cd6fa889-f8c6-445a-8033-855c7f881a61", "value": "T1F7B4F1CA65408973DF23CEF1D4EEE8964FB9B02107B14BC7220D55FA8E056E4E51B93A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516315, "uuid": "94b9fe69-7ed1-47b5-9f62-e775f54d6e6d", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516315, "uuid": "2b21c063-2903-4878-a401-eb552f6b78cd", "value": "12288:0ErZtTey5ss7xXwkT2x5b3FwiF1NtQJQmZ:0Er7Tey5sAVQ5Ciq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516315, "uuid": "551ef9fa-5689-4d9e-a0e6-2a6e17e1b66c", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516315, "uuid": "b68e0ab1-b08a-455f-8857-7413f4111d81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516315, "uuid": "f6816e18-eba4-41fd-9deb-e14ec46059f4", "value": "29b64e2e55eb55771f7e6169def32a9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbceccfd-11bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687521736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521736, "uuid": "810137fa-1808-4f75-b81d-befafe71b70b", "comment": "Malware payload (RedLineStealer)", "value": "ee455271cc14bc9e425f110ff3988f43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521736, "uuid": "8873db11-5a3d-4eb0-a20f-9545305a6aa5", "comment": "Malware payload (RedLineStealer)", "value": "436e47db6aeeca52cdf02f43812e8db6f46cefeb6707d797b4aaf32df9a1ec25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521736, "uuid": "c892d2a8-9645-4575-aec1-68216ec55ac7", "comment": "Malware payload (RedLineStealer)", "value": "aadcfc84c046224282439277e5995917f1677b27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521736, "uuid": "1e57c74a-4fba-4eb5-8f45-fede5e0d2bfa", "comment": "Malware payload (RedLineStealer)", "value": "89a11de36aa9a08cf7ff1b5e507c2ec281250261f4fb5285cfcb82d1e048dbbdc56fdb7c3c020ed1808a3bc840c3786b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521736, "uuid": "3ccf73e7-9072-4a68-8f11-55b984699cfd", "value": "T15CB4F1CA65808A73CF63CCB2D0DBFDD64E7970220B714BC7220D89F54A466D4A61B67E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521736, "uuid": "e22ae15a-972a-40b4-ae80-58fc273974b0", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521736, "uuid": "99793dd3-a71c-4f26-9128-2386460d85b9", "value": "12288:teIe3Tey5shK0IL57XMcB4IuPu1i4KraeXi8fXQJQmZ:teIETey5sLw57XlB4IOrNSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687521736, "uuid": "80c54b3c-5f8c-4351-ac30-9658165a811f", "value": 540992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687521736, "uuid": "94f25e68-82e9-4ef6-a89c-190684f37e82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521736, "uuid": "1f3eaa0c-e42b-49d7-957d-e04ec53292f9", "value": "ee455271cc14bc9e425f110ff3988f43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2cd08e2-11cd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687528646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528646, "uuid": "938e8875-9507-46d1-8658-25e8c45b3c85", "comment": "Malware payload (RedLineStealer)", "value": "73195dbd1199a50fc21cfdcceb768eba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528646, "uuid": "a519cd0b-8462-4c3f-905e-97ef5ac73ccc", "comment": "Malware payload (RedLineStealer)", "value": "4383ffe24e922f1a8b8290dba9faf02d52b17bdccefaa8f69c19db76bb537626", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528646, "uuid": "ecb574a9-f237-4b07-ada8-b6716feccad8", "comment": "Malware payload (RedLineStealer)", "value": "54afee2294ad28d247de964a690fb0f3e9e4bbee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528646, "uuid": "3209afae-2d02-4cfe-ae04-d560d171d227", "comment": "Malware payload (RedLineStealer)", "value": "45746082e5e022ee2f178b56538d961a118bc165d4976873df0653e64b7f9e96f6cc0b074833bc705cb63715c0bc2435", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528646, "uuid": "5274dc9a-c3c9-45de-b0e5-524557a29cff", "value": "T1780612392900E633CBCB2936D1A3951F495966B11A8FBC49BFB70C2B98B359CC035BC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528646, "uuid": "0dfd166f-5111-4aaf-b455-25e7b928499b", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528646, "uuid": "57ed796d-29e8-4f4a-a18d-6e24609668cc", "value": "98304:KSQLYActjzi8kqtW7etBLGZ2Y2N6cBFm1rkgXLHQR6+jXUrSbewmo4cY1/f5VwTy:LsUxkV7efFBFm1rkgbwM1S55q/xONKna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687528646, "uuid": "4e0eb812-17e1-4fae-8d16-ffb6e26c77ab", "value": 3773952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687528646, "uuid": "d19d73a4-3d47-48e9-946c-766ad7718d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528646, "uuid": "156fc7ca-30cb-4e34-94d4-7b37ab1b766d", "value": "73195dbd1199a50fc21cfdcceb768eba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840352aa-11bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687521186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521186, "uuid": "5ccb463d-d35e-41b3-978b-d0e88da2b79f", "comment": "Malware payload (Loki)", "value": "45c25c894875539b4523319cef25b31d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521186, "uuid": "003fe01a-7d2c-4c04-878d-396dd28ed09e", "comment": "Malware payload (Loki)", "value": "43c259140e721cbe2d4c3a2a032a2f991fcf726844d2d258fc1e91974239e350", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521186, "uuid": "7c0a02ba-bf73-4442-b725-3e811e41ae38", "comment": "Malware payload (Loki)", "value": "30f6e72927a91bfb00a0183fd505a594d9e8b0d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521186, "uuid": "15a4c0f4-7161-4bc2-9d86-73114ba82d48", "comment": "Malware payload (Loki)", "value": "e8b0d2930219051a132785020d400bbd6745fbb2f99ba621951f5db2732cbdc75396f8e10349603a55faa26b3e29a43d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521186, "uuid": "c98695c7-fb58-41aa-b8d5-064d3444346a", "value": "T14A54AF10265BFB62F308F938345FA5EFABB8AEE9D5344C65F1603B1E707A580654CE02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521186, "uuid": "48a3da83-5cb0-46fc-b7d9-715c6cddda82", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521186, "uuid": "23b82c25-5186-4974-8b6a-e2826f54f0e7", "value": "6144:kUj/wJYl/IP72zQvYfmcck2i3067yT7wOasp:kqKOQvGyY3QENsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687521186, "uuid": "1d56e097-e9d2-419c-92b4-95fe8a5fb884", "value": 291399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687521186, "uuid": "3f4ee32a-a7de-4556-b303-47d26e91f2fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521186, "uuid": "d13509a1-a235-4db6-900c-6cecaea1927a", "value": "45c25c894875539b4523319cef25b31d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0c6072-11e5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687538864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687538864, "uuid": "430791c8-254c-42c3-a81a-4df04b018279", "comment": "Malware payload (RedLineStealer)", "value": "8e5d383bb6de6e268b31cbcb9ed61061", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687538864, "uuid": "7f7c3c2f-a51c-45db-bc91-178fab9de5ed", "comment": "Malware payload (RedLineStealer)", "value": "43ccb79e6cf3521c6477c4ad90060a21865f5553b533ef58cbd1c68dbef0f189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687538864, "uuid": "d9168964-db8c-4dad-a52a-90805b859c89", "comment": "Malware payload (RedLineStealer)", "value": "82dcb1867dc6501fb6daab60f790a372c0fb157e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687538864, "uuid": "5f9711b7-8c93-4ef8-9d4f-5073288c69ab", "comment": "Malware payload (RedLineStealer)", "value": "9fbb3ffab47d7c2b979e227ac022ac7d5e52c5117725487bdc69db1384a9fbcfad0642add974a54363c7f6de5ae168cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687538864, "uuid": "34cb85ad-3930-4627-af30-30c004f74166", "value": "T11106123A2945D237EBD72A31C0A391AF48ADA6711A5FBD497FA70C3799671ACC1303C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687538864, "uuid": "83e0394a-00e3-443e-8cc6-ca387fa084af", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687538864, "uuid": "e1919b7d-f165-4449-88ff-526eba9fdfc6", "value": "98304:m8C+fHkQs9WmSxSN+7UXRLFi2RxAx2h/KmEaHG0ZQjbnGg4696E3pu3G+D2NfVQP:CPQs9J8UXRxLxA2I+unv469/3pud21VC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687538864, "uuid": "eeebc837-0b87-475e-b4c4-635363f9bcee", "value": 3766784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687538864, "uuid": "53ebb71f-512f-48a3-81de-b9ede02d3b5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687538864, "uuid": "9052d15b-b1fa-45ce-85cd-ace263451351", "value": "8e5d383bb6de6e268b31cbcb9ed61061.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e26fb3be-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516620, "uuid": "51a90012-3104-4c77-ad66-69beed370fdb", "comment": "Malware payload (RedLineStealer)", "value": "4f4983c77709caa3e3aa640955f32b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516620, "uuid": "24b03650-f809-44a2-9a9e-4d8734ca40c4", "comment": "Malware payload (RedLineStealer)", "value": "44b2591da49d1dd0cba85aa511a8018f90d76fbd458de5344f5fedcfdadef8e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516620, "uuid": "0820c2e5-b461-41cd-9f6f-d0028e42f52d", "comment": "Malware payload (RedLineStealer)", "value": "42eead6c49f02fc3e36ba6af81bea6a96d54829a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516620, "uuid": "18d6c6a3-e46f-4487-ac73-3faa697b4c36", "comment": "Malware payload (RedLineStealer)", "value": "354a04c7b767c22614b0bd0e1d1af8864d16082715a2e91adf1a5d097637c2036e0ce6a657a776d974613e8cdfb4a5e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516620, "uuid": "cffc5963-5b15-4707-b9d5-d1a6cf898ef4", "value": "T1E7B4F1CA22404573DF37D9B1D4EFEA964E7A70224B314BC7220D86F68B452D8E61B53E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516620, "uuid": "8af54411-8c00-4c48-bdf7-e72f85696469", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516620, "uuid": "d86c852e-5ebd-4976-a926-8e006ebc186a", "value": "12288:SiUtpTey5s639TSDSNZhnBlJrNu3GsQJQmZ:SiUjTey5sgTEgZ5Tu3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516620, "uuid": "8028b851-74d6-4236-820f-4cd72147c18b", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516620, "uuid": "be74acb6-bc00-4e33-b3da-d924ff691ed8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516620, "uuid": "de70244a-ccf8-4e82-a27e-4af3189eb792", "value": "4f4983c77709caa3e3aa640955f32b66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614785ec-11d8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687533153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533153, "uuid": "41623331-c3c8-46ad-a6f8-cb7f58220c11", "comment": "Malware payload (RedLineStealer)", "value": "34f7596e1cbd59728f4d38259c8f52a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533153, "uuid": "4bbf9e57-6bcf-42e6-bb52-915bdb22f5ca", "comment": "Malware payload (RedLineStealer)", "value": "4523c51cdd3cf606534f17a789fe7a0ca6b4ce190afcde67701f1de05f69505f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533153, "uuid": "fdf62eef-2013-4f10-a5e6-397c2b9f895d", "comment": "Malware payload (RedLineStealer)", "value": "a712a07451a78cfd8941895d97e7468116fc9268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533153, "uuid": "37bf9639-3da9-4adb-9a98-1dad42bc7d65", "comment": "Malware payload (RedLineStealer)", "value": "3c10ad1ea8daa7f3711d32bcb968be12cb2b11857e1edb01964bc95aa5ad922b562910c37c513183ae3a4281d20d2a24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533153, "uuid": "05fd2bf1-c9b6-48d4-8a7b-f34e33a8d5d3", "value": "T1FC3601352A80D973D7CBB372D057816FC91A293096EFB48D67374DEE696B8BCC920940", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533153, "uuid": "e5eba1ef-a2f7-4c73-82c5-e059148d426a", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533153, "uuid": "20f17291-a6ed-4fd4-a71e-6bfe4fc04e7e", "value": "98304:xg8E8DuIhnLnnEhROx50jA/uqf0bkvXzAdhpVLWIY6G4N264Q4b:m8DuIRnEvOx500/14k/UdM4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687533153, "uuid": "6ddf0aff-f47f-446f-9154-09e1bad7aec4", "value": 5225472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687533153, "uuid": "f35dc3c7-b3a2-471f-87b4-cc2650ddc418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533153, "uuid": "2064db64-16f0-4e56-8393-0bfc0320ca1c", "value": "34f7596e1cbd59728f4d38259c8f52a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63149a01-11d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687530150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530150, "uuid": "4766d2ff-fcab-4706-9aaf-710d949290eb", "comment": "Malware payload (Amadey)", "value": "ebb739af09a44905e84737a30224dc41", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530150, "uuid": "18845e86-5217-4c31-bce4-711ae7a2eb2e", "comment": "Malware payload (Amadey)", "value": "4549151241d618ee565a7a3d36a9f0c7b413772f8c2c509b3b41b3b51912ed10", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530150, "uuid": "a6e6a489-0a18-4764-b5c1-ef7a8ac34d02", "comment": "Malware payload (Amadey)", "value": "a139d8fd1c135b364702633cf1af475948dd22dc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530150, "uuid": "cb12a273-e43a-4849-bcef-2c769a64aee3", "comment": "Malware payload (Amadey)", "value": "2e8931981a5b8f7f99e8848a49757c2e71485da32c6a7a011e405f6cc9a5b7b06c09a5c46574b5274ef849f5f3aec5f7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530150, "uuid": "70abb2c4-d295-48dc-9725-dfeeca8001be", "value": "T1CC1612792240D2BBD3D32871E453954F4C1A29726AEFBA493793CCEA59A31BCC074BC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530150, "uuid": "7294c752-7b3b-44bd-9687-d9ce751d6c99", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530150, "uuid": "0de5fde0-b542-43dc-817b-cdd3375a963d", "value": "98304:P/bHGOxcjMtVacB/BF4/rC3v6+dxzZJi1h6sM56TYRfP+Z9oGSLrHNlxQKM4zqdU:CkcjMbxF4/rYDi36H5QCG6H7uZ4zq0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687530150, "uuid": "0b47e327-9bd6-457b-8e15-8d90e2f257bc", "value": 4107264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687530150, "uuid": "c868cedb-e850-4dd7-8315-9138b944daac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530150, "uuid": "3a44828c-b0dc-4535-a58b-788083bb6dd4", "value": "ebb739af09a44905e84737a30224dc41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29a0d4a-11fc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687548725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548725, "uuid": "b46855b8-9101-473b-afd9-0cc415388d6a", "comment": "Malware payload (Quakbot)", "value": "9f911dbf63e7dcaa7d4dcdc5c14d9390", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548725, "uuid": "fbecc7ae-f0ad-4649-845b-03e37f7031f8", "comment": "Malware payload (Quakbot)", "value": "457c622ba31de68f44d01c63de335b32cc7ef2cbbf6c48a2acdd868a28ddba97", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548725, "uuid": "481abf2c-a9ec-4fc1-8161-4c59f2f65319", "comment": "Malware payload (Quakbot)", "value": "6e3f22a89e96a1a2898f3faff53d4b8aca0e1ee9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548725, "uuid": "c5e7d6d4-0398-4523-bf55-caf8d6a6c3cc", "comment": "Malware payload (Quakbot)", "value": "b000fc591f05ea64c7c04f71711076e965b07781134ee5489cda96737b0ce8f8abc3a0a906653acbf224c311f145ac51", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548725, "uuid": "160fecfb-ac89-4d7c-a094-d81018ef987f", "value": "T140558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548725, "uuid": "05f8f786-d5ac-4ed3-a053-80670f231cc9", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548725, "uuid": "dcec3cc4-3c5e-4dca-98ce-b999684bd368", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4ygQ:QbkS7XB1EsOSNPSp0EAt2bUeM4ygQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687548725, "uuid": "0e81e58b-2411-4d8f-b2cf-ed1c1a950aca", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687548725, "uuid": "e6a28eb3-d5e1-42eb-9052-7bb602110212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548725, "uuid": "89b90373-9973-4793-8413-2003a809ce74", "value": "010qbot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b99a047-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499133, "uuid": "19443dcf-3e06-4314-a9b6-d3952d26f62d", "comment": "Malware payload (RedLineStealer)", "value": "085eeb86ff100d566dd92f915e4c65dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499133, "uuid": "3b7280ba-379d-44b3-a4b7-fa38f172f240", "comment": "Malware payload (RedLineStealer)", "value": "45af9db782ba1daf6d98a345ff83b661d2cd2433ce23afe5a9c6711557cb4ce6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499133, "uuid": "03879538-bc06-4492-87c1-52b88666d325", "comment": "Malware payload (RedLineStealer)", "value": "b9b65efd81840ba0101d6cdb3fe7b3a68a2c8013", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499133, "uuid": "db156a40-63e0-4101-bc56-58b903603752", "comment": "Malware payload (RedLineStealer)", "value": "31116cedffe1a9cd9ec6f1c39e18ef302d2d33d365e8f489dd00347e9df848dd9e9cb3e2fa214824c3e30ae242e73816", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499133, "uuid": "7c323ab7-09ca-4472-9902-1f0fad41d64e", "value": "T18BB401DA35408973CF27CEF2D4EFE8C64E766022077247C7220D85F98A552E8E91B53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499133, "uuid": "d2e33d08-c91a-44ae-98fd-9e249d8f4ee9", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499133, "uuid": "538c8657-6b33-4191-843f-cc37de575576", "value": "12288:ZeOyRTey5sd5I2+b7FOAMpaH2N022d8QJQmZ:ZeOiTey5sd5I2+VODa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499133, "uuid": "5d1cff1d-1a59-46a6-b102-5bc6b46384b0", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499133, "uuid": "df172878-32e9-4d17-80c4-4f9eb645bd99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499133, "uuid": "69bee1d4-1933-4042-b185-32f02a75003a", "value": "085eeb86ff100d566dd92f915e4c65dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93bc2d63-11d5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687531949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687531949, "uuid": "66456058-a00e-4af5-ba7f-64c0182f928b", "comment": "Malware payload (RedLineStealer)", "value": "5dcbf705760f20b4f7b8b402fb4e0c19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687531949, "uuid": "dc9d36e0-ba11-42c4-b73c-5f6b9de26ce2", "comment": "Malware payload (RedLineStealer)", "value": "460725b5a9a8f635e9e38fc0eb16560ef8d89a660d63530ce3059bd17d02d71c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687531949, "uuid": "05d67045-5381-451b-b536-9502a706b884", "comment": "Malware payload (RedLineStealer)", "value": "00197e90de8393a6a45cfd32507f7d7de99da378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687531949, "uuid": "8bfbe2f6-8762-4a41-8974-e082388ace4e", "comment": "Malware payload (RedLineStealer)", "value": "e47905535c34a7ffce3acfd72c1f881fe05385151a87c7274084ba593492bd23548d3ff3f9fe73f0ec0da97f247a5ff4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687531949, "uuid": "d27e9fda-9e8d-463a-8c80-0841d9270208", "value": "T1051612B42200D6BBD3C32971E453901F0C2A68726AEFB99977978DF619635BCC4B4BC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687531949, "uuid": "45b8f248-3a85-48ca-9dfe-3ca0e1e10736", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687531949, "uuid": "5d3c84a3-5691-4169-b927-ec3fdff4db44", "value": "98304:xFyizTmm1/q8tBLw3Oszd7tcPTlhXlvRuRSUIzgsLjQscH6S5Rv/lhAV5IlVhPma:yizTZ1VPLw397slJuRigHscHzvvsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687531949, "uuid": "a859c936-6639-42bc-970f-60c64bd04e95", "value": 4103680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687531949, "uuid": "dd5655e3-3c14-4f3c-adc1-8cdcb29f6b8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687531949, "uuid": "6bd86e99-c7d0-48b5-89f8-915fed1d417f", "value": "5dcbf705760f20b4f7b8b402fb4e0c19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8cbe40e-11cb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687527743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527743, "uuid": "f2526587-c339-4a26-86a0-83f0c2e90233", "comment": "Malware payload (RedLineStealer)", "value": "bf61fda545a4eeeafaa52e14eada0616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527743, "uuid": "ce2d56d6-9716-496c-8c81-d1d887cd6d5f", "comment": "Malware payload (RedLineStealer)", "value": "46b6d8f1e0b6848ad45b80f785a93ff2b10313c877fef91cd0e97735d28e4514", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527743, "uuid": "6b077b33-cc49-4f14-847a-446c59cc5238", "comment": "Malware payload (RedLineStealer)", "value": "be886ecaed38b5319bf1babb2da4a3a5bb806c66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527743, "uuid": "61f6ca00-7828-4f15-83bb-aa619135262a", "comment": "Malware payload (RedLineStealer)", "value": "f781a14a279d1880cca8c8cd694f6f833f17c3c659dfbe387b14bc9b7bf77a8d8c7b8a13714166408b1678b268979720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527743, "uuid": "eb85428b-50d3-4ef6-a9c4-5cb5f9be4d9d", "value": "T1C355AD83EF491973EA812473E92F77932882A4F1139FB0BAB35F0A96D65383D0574794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527743, "uuid": "e1937baf-d2d5-4cfc-8099-ded74a49a681", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527743, "uuid": "ca713e8a-3926-4936-8feb-7407ec11dfb3", "value": "24576:kjGCi854Nv8a5bMlg6BIVWDiH0379MyM0m87SfvOw2OZXviAtYCzNbU0OSXxwOjC:43z7+0ri7xL5Zn96Vv9G58BA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687527743, "uuid": "dda6c684-7f46-423f-a213-19c460632216", "value": 1358339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687527743, "uuid": "67a8e985-0c7c-4029-8797-9440e0868d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527743, "uuid": "11dbf98a-65ee-4406-bd64-a2f711a864f7", "value": "bf61fda545a4eeeafaa52e14eada0616.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cadbc11c-1159-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687478784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478784, "uuid": "204557a5-b4e8-482b-87f0-2a53c49de28e", "comment": "Malware payload (RedLineStealer)", "value": "1220dbd6d643c28c13ebbd356d098804", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478784, "uuid": "848b3ed1-adc0-42cc-aa68-c76a74b9521d", "comment": "Malware payload (RedLineStealer)", "value": "46bea4d48d3b80cfb79c21285dfe0a433a5193fdaa06ac796e858527fb17f503", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478784, "uuid": "e0a4eafb-4494-496e-91dd-c79166dafcde", "comment": "Malware payload (RedLineStealer)", "value": "b38ed3de906c30d64c06d54947dde783a0fad88e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478784, "uuid": "13abaa4f-8982-46d3-8a4e-06fb17bf7b5d", "comment": "Malware payload (RedLineStealer)", "value": "c742be1f09e62061f09e9e45ce108a34350dd49097df871eead3d3e01a24b3620ee77e067dd8046ee6c2a329056a22fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478784, "uuid": "f41607c5-9b58-419e-838e-90a27b07c531", "value": "T17CE401DA65404573DF37C9B298EFFD8A4FBA71220BA58BC3220D44F18E126D4E11B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478784, "uuid": "9ff11d2c-e3a6-468e-a605-d7d46d2d0293", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478784, "uuid": "6ad72377-8c8d-48b0-b188-0ae3426aa8b3", "value": "12288:OeJP4Tey5s/7sOgrCz74b2Q4t8nFj+AQcw7glGxNuk+fIGm0tBQJQmZ:OeJwTey5s/I1uz74b2QOSk+wGm0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687478784, "uuid": "209a82c6-9b36-4ac1-95e5-989d3aa4db02", "value": 715072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687478784, "uuid": "ae687890-250e-4e89-9bef-5f7530de6b16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478784, "uuid": "aeb814b4-0c27-45d2-a79a-05d16730d824", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b343eb5d-11bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687520835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520835, "uuid": "1c528093-6192-4769-89bf-58f72cd4556c", "comment": "Malware payload (GCleaner)", "value": "c5cf0bf1c6b23a709449ad5f39638de8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520835, "uuid": "a00902ca-84ec-40bd-bf7d-c5fd14300665", "comment": "Malware payload (GCleaner)", "value": "47507ce50460b91eb9a0842d5cc663d0c40b9a22b3d3a0378a796068f1eea85a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520835, "uuid": "70ce0f09-5d2a-494b-b20d-9b637a9761dd", "comment": "Malware payload (GCleaner)", "value": "a74e5fd4cb56240311b74c1c013a3c1438189d95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520835, "uuid": "6ec9e60a-c45a-43fb-8ff0-efab17bad49a", "comment": "Malware payload (GCleaner)", "value": "593b7df4ad2e2c3d7e2833c3ca5513a63387aebf1902fb429d2203617084eb495fdc1c12a9fd0166097f25ccfa9f04b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520835, "uuid": "27349d17-e3f1-4f91-a85c-f848f97a83ef", "value": "T101949D03B2D16C61E925DA728E2FCAF8361FB5604F197B9F66588A7B09701F2D233315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520835, "uuid": "c596eabb-86f6-44be-b520-53e04639bd12", "value": "30975ca995554273d21cf43969a39372", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520835, "uuid": "9c4dedb3-7f1c-4ff6-84ee-7de31a3820aa", "value": "6144:Rkth7J+pUQNLpTIC48KMzBXP51MIcDXvOncjC9mUWpzTIWe:Sh7J+q+LNIC49ghMIGvOXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520835, "uuid": "e19f5931-6276-4eea-b712-170914606567", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520835, "uuid": "3edb9ec3-81dd-438b-a8e2-4a5a62256f43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520835, "uuid": "15e31c15-7569-4a36-b254-3c31d48675e8", "value": "c5cf0bf1c6b23a709449ad5f39638de8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cde9f3-11b5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1687518071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518071, "uuid": "fa7bdfcd-884a-4cd5-a794-130bd0df13ca", "comment": "Malware payload (Rhadamanthys)", "value": "af6bab2a0baa66618bffa72fa4b9e0be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518071, "uuid": "42cdc8de-8912-49ec-bc2b-e57c548c3c86", "comment": "Malware payload (Rhadamanthys)", "value": "4793ba759b0cb43cb7639b3f573aa3c025e82ad172ddf2dcbb6003c617fa9cf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518071, "uuid": "bbedf1c2-1ab9-41e3-bbd8-0792c70ead94", "comment": "Malware payload (Rhadamanthys)", "value": "86fa4e13fb5373e9288ae35e1b3a72695a19dd63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518071, "uuid": "92c1341b-fa81-4915-908e-56d2af5bbafe", "comment": "Malware payload (Rhadamanthys)", "value": "eebb70dd16d919be08db9c231b3797e806cae98cbb2c585d77898b561aab02651b6ccc6efb2100b9601a4d13b31465a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687518071, "uuid": "1f0e185b-7bd2-40bd-a1a0-70a77febd238", "value": "T169145B617EF5D998CEAC33B3C4146BE506990B7746F2E38A4D282D92373E295871B13C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687518071, "uuid": "4919925c-b35c-4861-b540-b55b2c091f15", "value": "3072:SX+q2zE8DIjdjud2KlPVkX5btZm6rAtmI8lptMrf2sUoiQ+V:L/E8DIpjK28t4snQxlp3z/pV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687518071, "uuid": "ff048195-cc2d-4dc0-b550-eea3ed3d7d83", "value": 196146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687518071, "uuid": "11f95e13-f365-4c7d-bf1e-d3c71cf48dff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687518071, "uuid": "817b4a54-edae-4246-bdaa-2610458cf782", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc40e4c5-11d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687532554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532554, "uuid": "92184f2d-6427-4511-9d39-0eb0f00907d1", "comment": "Malware payload (Amadey)", "value": "a5d44e2f813f1b5ded58ee5591540b39", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532554, "uuid": "6dd6fee8-c64e-4a3f-9719-4856e529f908", "comment": "Malware payload (Amadey)", "value": "47b21912ba623340a9c569d62c9349a94d342c40e63ecc2fed16999854aafe57", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532554, "uuid": "158f12ab-645e-4355-88ae-35293ef9d49d", "comment": "Malware payload (Amadey)", "value": "9a2e9ff8316db6f41dda41526baca20595fa3c66", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532554, "uuid": "3d4a504f-6fc6-4792-bcfa-e8bef4c88c33", "comment": "Malware payload (Amadey)", "value": "d0c75ebc7202dc2f2069a307d5506732b968dbcb61b7f69bd8a3f147fe45ce468b1802a7d77bacc4dc3d2b920a5bd950", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532554, "uuid": "e607b91d-118d-4b7d-8924-6f26ae356977", "value": "T11F1612796641D23BC3C31972D883861F0C6A61B26ACF79497387CDE60A636BCC975BD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532554, "uuid": "26ed2830-dcc4-4b56-b7fe-557db8a88147", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532554, "uuid": "502e1077-8702-4da6-9484-347a968b11e5", "value": "98304:NyDqoQ20ufEdxN34F7m0OGaILeDcb84vopbn/9oaUjZud7Tx/1mkG428yje26dER:EDpQNkEdx61WGaILe4UiZc71/1mkV2Hi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687532554, "uuid": "bf07a8f7-ce87-4ad2-917e-b747dfb7986b", "value": 4175360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687532554, "uuid": "f0280788-52c3-4cdd-b269-62ea484e42b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532554, "uuid": "fd87147b-05ac-4b15-8081-5e964bf64c1e", "value": "a5d44e2f813f1b5ded58ee5591540b39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a5cd0f-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687510612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510612, "uuid": "f81901e0-22d4-4d7e-b3e6-d1654daa55d7", "comment": "Malware payload (RedLineStealer)", "value": "a30c3c9d2d4af4be150290f61151fb9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510612, "uuid": "33f1ca59-9560-4d08-81e4-db5de253ad27", "comment": "Malware payload (RedLineStealer)", "value": "4856dc9c8a75f5f467b509c61cbbb4218c6df5b4634155a5190ab0d7225d6b66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510612, "uuid": "f4116e5f-7fc9-499d-a84b-8c9852c4b43e", "comment": "Malware payload (RedLineStealer)", "value": "5355942aef5a49cab6594a2a7b1daff253ad16ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510612, "uuid": "c13525b2-463f-47ef-be76-8781ad704cb4", "comment": "Malware payload (RedLineStealer)", "value": "850f9608a1204233dc3a78ef2dda2e26b2e09b4812c81caf751ffe6575329a86518465f58188a9b344a0dea94c70c30b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510612, "uuid": "deffa56e-472e-4bc1-bb5b-a3510a22f7b0", "value": "T189E402DA69800873CF33DAB2D4EFE9C64EBA71310B6547CB120D49F58F466E4A11B636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510612, "uuid": "89746107-72ee-4cc3-bd97-93160874703a", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510612, "uuid": "a28d0213-807f-46f9-9608-41e988c2dbb4", "value": "12288:fevlITey5s/0YHXLE5ZCthBsRvJ6JT4wbD8AnEQCXiUz8ctQJQmZ:fevWTey5s33kZ+kR+HEQCXiUz8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510612, "uuid": "30a9741f-70de-4efd-89c0-b37e29b79432", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510612, "uuid": "b636af92-0e5d-4a57-91ec-b1d7b68cbe96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510612, "uuid": "cd5a78be-e89b-4a1f-8151-52c4ff39c8ed", "value": "a30c3c9d2d4af4be150290f61151fb9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7372e62-11e0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687536760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536760, "uuid": "288b1ed3-96db-4088-884d-7f8bc7cb47fd", "comment": "Malware payload (Amadey)", "value": "c13a6d2a9186ff528d6712c06a30d1dc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536760, "uuid": "714d2ec7-dc60-4408-a60a-69d286d2f7cf", "comment": "Malware payload (Amadey)", "value": "48632c3258862784d1f7c41381719d13b84a5a57250aaa379d11493de6b2022a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536760, "uuid": "04242b3b-59df-45e6-a329-21365b1ae135", "comment": "Malware payload (Amadey)", "value": "c7444c64f59e642ecdda2e26cdcb73a534df021f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536760, "uuid": "360bf286-9664-4399-ba18-5005c460bb0a", "comment": "Malware payload (Amadey)", "value": "aad4bdd91b1319548022201a89dda0442aec5ff55bf4c6c017dbf7a311470519cae5c25beffddda6e38bea80af7c4a9d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536760, "uuid": "1a03457e-5617-4800-986e-5b9bd47b2c89", "value": "T16F36117A2640D873D3DB77B0D097816FC82A287096EFB88D97375CEE29679BCC464604", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536760, "uuid": "1acddbeb-dd35-46dc-aaca-aa76439ea737", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536760, "uuid": "e3ec4051-a00c-41d1-9719-039a15fb31f3", "value": "98304:FCkrJFsB16SMO6ZsWS7weJLqVCtIOzl0P/GhK9tztFxPtLFfTzPlD3+oOFU7uLfj:FCk1FsmXO6KWS7DLqVCtoMctxFLlTzp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687536760, "uuid": "92e77788-e88e-456d-94da-f99aa4ea7cd1", "value": 5190144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687536760, "uuid": "5ef925c2-f8db-4ac1-a30a-f41e3d0db94c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536760, "uuid": "a804d005-d54f-40d0-b7ee-833647985b72", "value": "c13a6d2a9186ff528d6712c06a30d1dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4946ef4-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500678, "uuid": "27dc2053-1cb5-407c-9e18-f6117b75a313", "comment": "Malware payload (RedLineStealer)", "value": "a0c3efdaeb181aa1d8183871a7df32cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500678, "uuid": "406de423-5f9e-447a-9c0d-d80cf62767b7", "comment": "Malware payload (RedLineStealer)", "value": "486d00a24ce831d3eac68d3a5915e17436298dd3fb766280b9da624d4ac206a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500678, "uuid": "6600da5f-d97a-48db-bc81-896ad8fe91d5", "comment": "Malware payload (RedLineStealer)", "value": "7b21b360c4121fa23de8dc789fe88fc8fc864e84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500678, "uuid": "f76285a5-aee7-4e49-9239-cf1f6d91e204", "comment": "Malware payload (RedLineStealer)", "value": "556d9791ee994d40e33aaf0e6ad5546cb41c5e0e663902e160683dee9a5290907d327be0ddf8789d09fa8bcd48526574", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500678, "uuid": "ce28cd59-e3bf-4485-99d4-12ff1e448003", "value": "T115444CFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA284CA19B90952D3530E4BCE798D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500678, "uuid": "50865328-c6c4-4374-802d-ab41daec5b97", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500678, "uuid": "5715f586-0dd8-410e-8e72-819ff3f8962f", "value": "6144:yIUTncigt0poiRG/XvLNUgYhuE226QJQmT:yIUTzgtAoiRG/fSviQJQmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500678, "uuid": "14fc1653-09ef-453f-a9c5-5be4d47fbd48", "value": 276291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500678, "uuid": "3224d42e-ce1a-4e1d-bf63-0b267c766b13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500678, "uuid": "b9870d23-e7ef-40ff-9f94-3f6f1c43fb65", "value": "a0c3efdaeb181aa1d8183871a7df32cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d217bee-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500370, "uuid": "929dc479-8d1f-40be-8bec-0f7a8bbc179e", "comment": "Malware payload (RedLineStealer)", "value": "8c028c36808d779978fd306ddc4aa4b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500370, "uuid": "bf369bc1-29be-4174-9378-7343302608b1", "comment": "Malware payload (RedLineStealer)", "value": "48ba30a060a71f9bc7b11fbc734e2091f045cbce4a865c717d33179d867fb3f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500370, "uuid": "f67dc582-d554-49f8-b104-16cf542b1260", "comment": "Malware payload (RedLineStealer)", "value": "5c2aad7f7339ad5f43bdf3f2f54b6b0ee634c1bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500370, "uuid": "3197c29e-b234-4851-8f05-859fe5f8f572", "comment": "Malware payload (RedLineStealer)", "value": "faa685b6114219a938d49d3b012a2c10c8123383ae2474e9f7663f7026840960aaec9c9e5a6145785536650446199959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500370, "uuid": "c17f02dd-8f2f-4b25-a63e-243371420f6b", "value": "T1EFB4F1CA20404A63DF33C9F2D4DFE8D64E7A61210B724BC7220C9AF68E456D8F55B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500370, "uuid": "99346027-7598-49a7-89b4-b4187939402b", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500370, "uuid": "184b6c4b-9251-48f7-a265-a1bea7b9591e", "value": "12288:6ktepTey5s7yCI1ryeY+tIiyC6wegR4YDSFcmXZKCQJQmZ:6ktaTey5suF1uAWkeJYDYcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500370, "uuid": "a973d9d2-262c-432e-aaed-15abc46db315", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500370, "uuid": "eb632924-43a6-42e4-9c56-4d7db08987a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500370, "uuid": "5b5c23ea-be43-425c-9d79-478da9f08b29", "value": "8c028c36808d779978fd306ddc4aa4b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b758539-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500072, "uuid": "45b6c47e-4eba-4864-99ce-7033a323a73a", "comment": "Malware payload (Amadey)", "value": "6e1377911d54404555cf7401860fb894", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500072, "uuid": "f67f951e-861f-4cb1-85da-700b5fba1d15", "comment": "Malware payload (Amadey)", "value": "492fd9ace57f41d9c44e39fd5f5ee3a38d159bbecc49fb5f68a6960b65b47f2b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500072, "uuid": "5a6ab12a-acb7-4b22-b88a-e32207fb4829", "comment": "Malware payload (Amadey)", "value": "95cd7a1eeaf0129312cb1b194fcc6ab3159ad115", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500072, "uuid": "81193b14-a10c-46fa-9824-1110d6fcab88", "comment": "Malware payload (Amadey)", "value": "74701171509a83f758fc7536ec4b54465ae373497354ac87feac82c3896e7d94eb792f6761002a6812199ed4571fb286", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500072, "uuid": "fd12d3c9-f434-4aa3-a76f-d59a970620dc", "value": "T1E1B4F1DA21404523CF33DDB2D4EFE9DA4F7A71210B7247C7124D8AFA4A852D4B61B93A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500072, "uuid": "935279dd-5ccc-4171-81ac-7d9cde742b14", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500072, "uuid": "d59faf74-6622-4981-b741-8035c994ebd6", "value": "12288:LdV82RTey5s2CaF7jRm8JCNxvFAH/Ao9QJQmZ:LdV8+Tey5sX+7j88JUdi/AL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500072, "uuid": "959f5730-6b1f-474e-a0ef-13fde6681407", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500072, "uuid": "015a7544-76f6-47cc-a4ce-889fa47260cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500072, "uuid": "ee005664-e802-49e7-b67e-75ef9d298233", "value": "6e1377911d54404555cf7401860fb894.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965e114f-118f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501889, "uuid": "c72c5c77-52f3-49e1-8b7b-932d89e5128e", "comment": "Malware payload (RedLineStealer)", "value": "f138927f17953e9eccd38d5f8f367b0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501889, "uuid": "68e2ba64-8f95-4292-a0ad-17540f50a5dd", "comment": "Malware payload (RedLineStealer)", "value": "4b37e7bc3ec2a06024a6e9c1fcdd9dcc1bbf2a31015a09f117c418e52b8a8fe7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501889, "uuid": "6bc6b32a-a3c2-43a7-beae-4a6fde2c6357", "comment": "Malware payload (RedLineStealer)", "value": "9a1fbbcdeabc5b6b12f3174f1120b4cf3ad5a008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501889, "uuid": "5a053917-a254-43c2-ab22-f896b0826a4c", "comment": "Malware payload (RedLineStealer)", "value": "214a4c23d2c92adfba977cbde8d9a5532ccc07a6b6d059a294312e12a19cb1148356e13fa4c9ef63ec7f496b1dc5720e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501889, "uuid": "1ff4a466-fee6-4511-aedc-ea810c795331", "value": "T13FB4F1DA25404973DF63CAF2D4EFE9DA4F7A702107718B87130C8AF64E411E1A61B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501889, "uuid": "11b8bb3b-f6e4-4372-a67b-d353c961b068", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501889, "uuid": "2fbe0a42-5ff8-4030-a7de-8c8dd608ced3", "value": "12288:P+Oe61Tey5s6YAec+VD4K+tLj67HlCXEcVEp9xe5PqdQJQmZ:P+O5Tey5s6cRqj67LVJe5SU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501889, "uuid": "ffa56a89-6a63-4a0f-b83a-065a2b637f4b", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501889, "uuid": "fc34ae0c-e103-49a0-9c5c-933d03737ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501889, "uuid": "552655b4-f523-4bfb-a402-7ccf106a79c6", "value": "f138927f17953e9eccd38d5f8f367b0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb736a7-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499752, "uuid": "eedcb223-fe6a-4aab-96c9-adb6dfdd1cc9", "comment": "Malware payload (RedLineStealer)", "value": "45941398aa59232a1a92809d9c1b02f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499752, "uuid": "ae86f2b8-f8f3-4e35-a5e6-92d53f80b8ab", "comment": "Malware payload (RedLineStealer)", "value": "4bd7ec420a4f0ebe74a945370572a3895ca4e393ecd63c2384584b688ac7db31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499752, "uuid": "1ea97e13-1d81-4dcd-9a59-32b1821633f6", "comment": "Malware payload (RedLineStealer)", "value": "e01839733db53ecfbe1f5e04e39a37a0adc48497", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499752, "uuid": "0211248d-23f8-44b5-8fc3-58dba8b7abdf", "comment": "Malware payload (RedLineStealer)", "value": "f459a81982040e24b41b3a04604e16a45d56c46735a98a8c7b9f3364d72697b0ac7b2c34db736fcfcd8126f846f7496d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499752, "uuid": "42ee3625-ca3a-4841-a4ca-23171ba78c73", "value": "T136B4F1CA25804973CF63CDF1D4EFF9D68E7970210B710B8B220D9AF54A562D4A61B47E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499752, "uuid": "e361242d-ae13-4ddc-b3d9-7fc766624c33", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499752, "uuid": "7e2fc103-6a5c-47c3-a77b-c329f3295f44", "value": "12288:90OxdTey5slYdFU/Bd4Hmu/ei+26QJQmZ:90OrTey5slGzGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499752, "uuid": "6586bd09-b244-42d0-b659-cc07082467c1", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499752, "uuid": "9d2e09b7-d05f-4b92-9cc4-35d03cefa1e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499752, "uuid": "09ac7aae-be1f-42f1-aa7f-980a65c506e9", "value": "45941398aa59232a1a92809d9c1b02f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2235e0-1207-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687553224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687553224, "uuid": "e127d8de-9099-4063-b3e9-29b4af6a86e2", "comment": "Malware payload", "value": "7ac22865533327a95583f4e185c7bf36", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687553224, "uuid": "d5a9b3c8-b64e-4314-93f7-bc9a2a049bf5", "comment": "Malware payload", "value": "4cad3fb1d1f006f55fe46721313dcb8a674ffbe2de645497d03e4919cb7703fa", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687553224, "uuid": "58a840f4-343f-47e1-b63f-84727ccd2710", "comment": "Malware payload", "value": "d54ffa8294ea56f95e669ce57ee912b463fecba6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687553224, "uuid": "8ac9e09d-2bdf-4729-8eab-881a33e7ed1f", "comment": "Malware payload", "value": "d6249c0c35b5b82b1481e98fd2a266a7638968049f179158361099d8547dc41593ab31206cb7eef02269f51695c8654e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687553224, "uuid": "40d92f77-fc53-4e64-b922-3c7498dbba6d", "value": "T178F4332D79732186BF82C79A113281DE8F93F77DA0517F9D8C83F925490E9501BB81BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687553224, "uuid": "806cd6ec-22b3-49c2-a698-8386203eeb07", "value": "24576:CmvoQRU21b9LaC2zQSSoJgsNmwtwdgqX/DEY:CmlRU21xqESLtNmGwdJ//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687553224, "uuid": "b88ac54a-89ae-4ce7-ba2e-2454e867de35", "value": 790027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687553224, "uuid": "daedab37-6eb7-4587-a777-ec53054e963c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687553224, "uuid": "42b022c1-44fd-4714-bb2f-5647948876b7", "value": "Factura de proforma.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ae7327-11bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687521643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521643, "uuid": "400884c8-6f6a-4812-87e7-14da1795c156", "comment": "Malware payload (AgentTesla)", "value": "095e51c6b90881504171eb7a45c82f9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521643, "uuid": "d0a91aef-d2bc-44d0-804d-086cb7ce0662", "comment": "Malware payload (AgentTesla)", "value": "4cebd982bef6ec25021fecaed19441c39b1756dfd841d1527f38ef6a08974848", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521643, "uuid": "9fda0893-886b-427e-b209-55c0bb89dc19", "comment": "Malware payload (AgentTesla)", "value": "865ae0eab043c17bac77ec82c4b937a8c2726c46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521643, "uuid": "95160199-a243-4125-8e57-b97803a4abea", "comment": "Malware payload (AgentTesla)", "value": "2555e74f323a746e1356b81479c2b2eb937c015efd1be222fada6d51f3df6d7450f34869b6588f9f2c3664d65cf4932b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521643, "uuid": "035a9a94-f592-4002-a0f3-bd84f29edb6e", "value": "T1BA5412117BE0C5FBECD28571AEB1913A7BA1F81B117A520F53601E0EFD6B9858D1E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521643, "uuid": "675d647b-0585-44fe-8e0f-cef793d45801", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521643, "uuid": "260d37e0-0f80-4c9b-a94f-bc4293be6594", "value": "6144:/Ya6yTk0zdtrZO43eB2QzDvA7T7SukFSmDcCMnPH:/YUTfz9x3UXzTe7rbmDcRn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687521643, "uuid": "31378288-42fc-4a80-8a40-f970e31e0e32", "value": 289564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687521643, "uuid": "5b932cbf-d7aa-4975-868f-9f7f7287ae4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521643, "uuid": "a210fb77-0e1b-4774-acbf-69f98787e672", "value": "snr (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3344944-11c2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687523842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687523842, "uuid": "52bbd50b-f063-41e1-9023-bfb0cdfe39d0", "comment": "Malware payload (RedLineStealer)", "value": "d69a71e39d206da60f038df01c7f0569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687523842, "uuid": "deed2de9-cfaf-4ed6-a3c1-174c48ca0256", "comment": "Malware payload (RedLineStealer)", "value": "4d0aed47b69dc43c6e4d705471d172f0f152a9c1c2906b0956781c97e0aaa65f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687523842, "uuid": "0597de5e-aaed-4843-a8d8-73a6d7cb5f96", "comment": "Malware payload (RedLineStealer)", "value": "be82476081f5c2334a7832626927e00a9e1d6040", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687523842, "uuid": "469f05ad-7de1-4fa8-a060-09165c7d2ec2", "comment": "Malware payload (RedLineStealer)", "value": "dfb643742f1f39c8dc7166504998275728fc8aa4d5906a90703b6600fb3cf8ccc8b7f13bc4a99a5d621c45a7f347035b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687523842, "uuid": "3a320161-d0eb-46e8-8741-1f2b649e8efe", "value": "T16DB4F1CA25804973DF23DDF2D4EFED864E7A70320B714B87120D49F58E412E9A61B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687523842, "uuid": "cb0a8598-13f2-434a-80d0-191221a95c41", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687523842, "uuid": "779c9ccb-e19f-4159-9745-395c64a062e5", "value": "12288:C+cghTey5sObtmreNtue7uIt42AdZk5kv/Z5QJQmZ:C+csTey5sytN4xG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687523842, "uuid": "3e620946-e90b-4971-8edc-f9e814ae2b44", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687523842, "uuid": "5735320f-b05b-4aa1-9554-1979f238dca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687523842, "uuid": "ec507921-1d9b-449b-808f-1c43ea523bc1", "value": "d69a71e39d206da60f038df01c7f0569.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbf192c-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501311, "uuid": "de67932f-b350-41bf-908f-bcdc6ffba108", "comment": "Malware payload (RedLineStealer)", "value": "d813188e9f709a1f5ebd06921bf8460d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501311, "uuid": "c60de085-9349-4f08-8494-783e216c4ed7", "comment": "Malware payload (RedLineStealer)", "value": "4d1f08722d9de557c4a7e4ed965ae562c9ac1939b9ba3b73033e58c529ffb9e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501311, "uuid": "fdb589cd-4e40-4f76-a505-8d50f86852bf", "comment": "Malware payload (RedLineStealer)", "value": "0f10712c6d5376e1e5255ed7a72b15c2cce3f436", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501311, "uuid": "5fb61abd-9f6a-4cb1-a294-8ffc47f6ca17", "comment": "Malware payload (RedLineStealer)", "value": "feb14016b86e3a639d396c9094211e78b40915a2374b0903412b8113e8932bd607ae472bfb973b3c3eccc11472260df7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501311, "uuid": "39e16921-7842-48c8-8d49-96df169c697b", "value": "T1CFB4F1CA25408463DF63CEF1D4EFF9D64E3A60610B714BC7120C59F68E862D9A21B57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501311, "uuid": "b82638bb-0618-468f-ad18-6ce9ffd5c10a", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501311, "uuid": "3d3d4ebb-1dc4-467b-b07a-3d0a2beea5b8", "value": "12288:fh+BoTey5slgBWZYbiFdtEHOnvO0cRIbXvEQJQmZ:fh+WTey5syBWZYb/uDbXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501311, "uuid": "b2fb1184-8ec8-42c9-88b0-5b3b50888da5", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501311, "uuid": "97bf7116-cecd-4541-ab2b-5696055a431c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501311, "uuid": "7aa3e3cf-1e4e-40f3-aeb9-05b7f9433f47", "value": "d813188e9f709a1f5ebd06921bf8460d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34761cfe-11c6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687525347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525347, "uuid": "2373d593-4594-4307-9327-b72e798bdc90", "comment": "Malware payload (RedLineStealer)", "value": "1f75d325226e6a4ae5ec1fb827119996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525347, "uuid": "30c14f3a-27c1-4e1f-92c6-5d7687ca4cae", "comment": "Malware payload (RedLineStealer)", "value": "4e28195391e5033acb5ca35522a0205d5278e5cb0aeebd8bc78e8be9439c65b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525347, "uuid": "b5321784-375a-4ee1-929c-0f3556129539", "comment": "Malware payload (RedLineStealer)", "value": "e8c70368dfd9de13eb683ad917e2b95571326648", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525347, "uuid": "e682acd2-4e99-4c43-81ab-0fd221b5d7d7", "comment": "Malware payload (RedLineStealer)", "value": "f42ae4db469dc61fa60f8fae2e4586914328c8decf1950aa88bf64b3d57d31941e3ba8a2363dbd518d92c45a159a5e1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525347, "uuid": "6fb24795-7bec-418a-ab9b-278c970061de", "value": "T165444BFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA284CA1AB90952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525347, "uuid": "6c6efee2-7e17-4e6d-a413-adb5c99f47f4", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525347, "uuid": "b8f9ae52-6038-4ea1-abd9-df3344e5d35c", "value": "6144:GoQ+OeS6igt0poiRG/XvLNUgYhuE22kQJQmb:GoQ+OeQgtAoiRG/fSv8QJQmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687525347, "uuid": "a698dc18-c319-4ff7-90fc-6b7582835a6f", "value": 275265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687525347, "uuid": "3006b49f-14ff-4e09-9351-d3a0c4a57761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525347, "uuid": "0cb5eeaf-176d-452b-b468-5dfa5991ff48", "value": "1f75d325226e6a4ae5ec1fb827119996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8747332-1213-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687558694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687558694, "uuid": "e7c21bab-dd87-4e44-b34e-1dabf2875a65", "comment": "Malware payload", "value": "09a0040c44ca03727dddf81042dfc01f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687558694, "uuid": "bd867484-bb07-40f1-a015-4323d921a96b", "comment": "Malware payload", "value": "4e33ef521474163d0e6e3a01c29e7b449bac7f8df51af2f161206d0e73dbb151", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687558694, "uuid": "9da86faa-f141-40b7-9214-7018118f5274", "comment": "Malware payload", "value": "86f7e9636c762d3b5325ca9479a23780688b8e84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687558694, "uuid": "51b141d0-2f88-4b26-8f83-c54daeb91bd5", "comment": "Malware payload", "value": "c38d5d86e620103911b7b7df24b258c17afab11b4f84320fe887583fdf919b61d6c60556af16014fb6a3b93e57cbb1c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687558694, "uuid": "0b44446c-8418-42f4-9759-2bdacc963571", "value": "T16A63965D2E219FACFFA886344BB35E20924C33E626E1C945E15DEA011E7034E745FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687558694, "uuid": "87170076-a181-4a48-b1a0-9702a43eaef2", "value": "1536:58B83DOpSxUzpP+vntvnCEvnNY8QYdMWjSVrQRDjCTeJqmI:qK3DUSq5szSVrQRXCTeJbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687558694, "uuid": "3fd011d8-8a13-4c5e-8c48-032983da72d1", "value": 67564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687558694, "uuid": "d6f6b92b-66bf-49d8-a0ca-efc0a826dd52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687558694, "uuid": "db654739-8c6e-4454-b694-83c94841af23", "value": "09a0040c44ca03727dddf81042dfc01f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ae5d92-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500380, "uuid": "568dcd72-aa22-4aef-916c-481f0ad3813c", "comment": "Malware payload (RedLineStealer)", "value": "a2b8e6dac2c131301947b8c8b1e3d09f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500380, "uuid": "61e0297b-e4e2-4211-94d0-23414bede64a", "comment": "Malware payload (RedLineStealer)", "value": "4ea69ac6578e3ef49b2f450f927dd3e13f4788bb5095c32f7d626eef16b753cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500380, "uuid": "14ea1345-8c09-4669-bd10-ac67c717176d", "comment": "Malware payload (RedLineStealer)", "value": "c374ff31053e1847ecfe6358f2e0048914a663e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500380, "uuid": "56df6892-22f4-41d1-84b1-7e950de44788", "comment": "Malware payload (RedLineStealer)", "value": "4fefbe5502d287ccf06192d3e712b40dcb7dd9c8f21a575ded02d230536a1088b72d2a20b41dd2834751c1314ba655d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500380, "uuid": "96c0cad5-b852-4f7e-8be8-888f58583530", "value": "T115B4F1CA268049B3CF73D9F2D8EFE9D74E7961200B754B8B130C4AF59E055D0A21B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500380, "uuid": "b1878d4c-b590-4be3-bac0-c02ef30820af", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500380, "uuid": "1e3d2a2c-9f39-4c33-a14a-d74d90afc9d5", "value": "12288:3eIfTTey5s59Ij4+bdGCV1lhL2QbpxvLi2gLU2QJQmZ:3eIrTey5smxGgL2apbgLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500380, "uuid": "3e1583c7-2e2f-4e20-9ca3-f3c09d8e759d", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500380, "uuid": "d41a5602-0634-48ab-89b6-dda5ba113e9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500380, "uuid": "a8216d48-c47b-46ac-9ee0-7bd0ed879462", "value": "a2b8e6dac2c131301947b8c8b1e3d09f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a404fb66-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499765, "uuid": "307479fc-3866-4605-b4b0-ef557a63bd41", "comment": "Malware payload (RedLineStealer)", "value": "4874130a651c3b305d1d221d8b673913", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499765, "uuid": "3358128e-58cf-4e64-a1f6-40b1e2a9a0b2", "comment": "Malware payload (RedLineStealer)", "value": "4ece6604d3d952b8265c769022e1558590944f95b7540a4b72f76181f37e4b18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499765, "uuid": "325806d6-af32-4553-9d38-09ff2ebd3902", "comment": "Malware payload (RedLineStealer)", "value": "2303f8471a72f5ab4ac6cbcb03e89d6e23c96909", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499765, "uuid": "03276759-fa32-48b6-9500-80b72c6e9dc1", "comment": "Malware payload (RedLineStealer)", "value": "38d1de920901334d8f07d4d1591db1d75beb19676f8e3683c4176cc983c70daaf59d11ae3718f9ca775e110fb706cb70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499765, "uuid": "0284ee49-b7c0-4ef7-a8f9-d5dce6c8dbdc", "value": "T14FB4F1DA25404973CF23DDF298AFE9C64FBA71210B718BC7130D89F98E125D0A61B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499765, "uuid": "814596dd-7495-4b3f-9f11-e8d7c20f9e1c", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499765, "uuid": "d6c0044c-c205-4947-b0a5-69558c576563", "value": "12288:h+cZHTey5syHNKI4QwOPO5+JsOPr7VVQJQmZ:h+c5Tey5s91aOYCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499765, "uuid": "0e4518a6-82f9-47d8-bda3-7978a7db7de1", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499765, "uuid": "6afbdd7b-2b7e-4fd2-a082-23ee77840687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499765, "uuid": "81b86545-f2b1-4331-b328-1f3db40875d0", "value": "4874130a651c3b305d1d221d8b673913.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993d191e-11ff-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687549998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687549998, "uuid": "4640141e-6d74-45d0-839b-b2a9f7cad977", "comment": "Malware payload (AgentTesla)", "value": "85268d53dcf55a3799858f045fc8de4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687549998, "uuid": "904efdfd-2cde-4a95-9cf1-861b9660c2f5", "comment": "Malware payload (AgentTesla)", "value": "4edbfbe670bdb8f0b1d0f8deebf86c5bb3444fde69fbfb743ee56fbef2ac5d7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687549998, "uuid": "f6eda205-4ce7-46cd-b95c-e338a50f46c7", "comment": "Malware payload (AgentTesla)", "value": "9ae91c82ac042072da32645cedae779b7254b96c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687549998, "uuid": "c64c1637-44f9-40c4-ac86-24217f57d86c", "comment": "Malware payload (AgentTesla)", "value": "8569c6d35f6deaa2c60198fcf7079e6bd49b11a72ec30207bda819017d64ae6eaa595dad6a668f180805859287f94ee7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687549998, "uuid": "21f329ea-2a6a-4ba6-b08f-315bdb0e3dbf", "value": "T1AE2522022367AF93F0675FF91110E3F1432DADEB7832D21B5D83B9C9B992B4A1511A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687549998, "uuid": "d87969d1-2e62-4e21-91ba-09d2c63de28a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687549998, "uuid": "8ab34ab7-3ec6-4d04-b811-fc5202512e96", "value": "24576:azu4CZdOAwzUs+mLQPN/9wWvN5IywkBHy+tr3g0N:az6ZYAwQstLQPNdvN5IyhHy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687549998, "uuid": "f246b0b8-c134-4584-beae-37d1c93aef9b", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687549998, "uuid": "0652a2c7-5939-4701-b2c5-458866bc2853", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687549998, "uuid": "6575de85-cdb7-423d-8d3f-f086212fd2ff", "value": "OUTSTANDING PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076aef36-11bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1687522265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522265, "uuid": "5e5c4086-ea4b-4080-9ccd-889163eb2519", "comment": "Malware payload (ArkeiStealer)", "value": "cbcb8c0228ac1c0b62747d32631454ee", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522265, "uuid": "c1150b24-ae25-479a-96a0-3136b0ace898", "comment": "Malware payload (ArkeiStealer)", "value": "4ee2125bcf9c89c44a26fcf639bbb9106773c584ae95f2e62626cabcd7ba478c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522265, "uuid": "56a2e5eb-dc7f-40ca-9e27-e11d28fd3ecd", "comment": "Malware payload (ArkeiStealer)", "value": "5716fb0d674921344a50d52d63f200f070eac311", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522265, "uuid": "2e98ad98-3590-4dd8-9579-e190b09b0247", "comment": "Malware payload (ArkeiStealer)", "value": "a640138ab4903a99436f2661afe52de66de0fee45445dab6e64e14af635bf1a6612dc85191dc46f3c085e6628f7986af", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522265, "uuid": "592c8a26-e028-46b6-a8d3-0f104a9d985b", "value": "T112E4121871A0A037D0D60A3C6ABBC335097EBD725366D98BB6C50A6E8DA13C09F5D74F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522265, "uuid": "e3fc62bb-f2de-46b9-8bac-fdde5a4523e8", "value": "8ae60a5b3cb0a221123b4460b1328f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522265, "uuid": "23148da0-cabd-4693-9a42-a5b6e0bcf63f", "value": "6144:4qvleiNY2CNlgkML570jQbdaAKzxiYRA3vTZ8c4k8iUdoduW2VYDNgTWZ0xj:4qdeiNulgkML5K2KNxAfL41u06hgy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687522265, "uuid": "597bf94a-c2bc-4753-86b4-cfcf8c808ae5", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687522265, "uuid": "5c96e584-bd15-4285-b249-26110319e828", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522265, "uuid": "2b748dca-8c7b-4ac3-90fa-a5dce3694167", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450de5fa-11dd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687535253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687535253, "uuid": "f37bec84-36dd-4c2a-bb7e-d8c5d9d8e9bc", "comment": "Malware payload (RedLineStealer)", "value": "a2e2f442b621df2ff847b4fad327d57b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687535253, "uuid": "3462d0dc-f8e8-4f3b-95dc-710976ecf2da", "comment": "Malware payload (RedLineStealer)", "value": "505f1902e20c34ac4eab3ec85e2a31b567b99173e71c62ade9fd1a5b0ce8b677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687535253, "uuid": "72c16ff4-57b5-410f-853f-2bce08084db6", "comment": "Malware payload (RedLineStealer)", "value": "96aaa66a59fce3b7043d35c56670bee949a0f138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687535253, "uuid": "9f82720d-dc7e-4cdf-873b-977b128aab24", "comment": "Malware payload (RedLineStealer)", "value": "f22b920345c27fceacf0bf37405103313cca9554f35266bb38903a1b9f771b5c6dcc8e4c5b1ac55fcdaf34af046d2ce2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687535253, "uuid": "313d6c0f-f4dd-43a9-b8f1-0741763359cc", "value": "T1673601382290C933EBCB37B1C067415FC919267096EFB49D5B370CEE2AAB97DC965508", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687535253, "uuid": "683fc886-a2bb-42dc-b9db-88f422a12002", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687535253, "uuid": "b7780f42-459b-42f9-8658-44d3940bab44", "value": "98304:nY+KN/mTcTmgfUc+PS4DjaUgAoVpamtOkKKt/3DEiUjxFUTPOIgqby2uUKn4sXZk:nY3N/rmsUc+PS4DG35nKKt/oiUjfUiWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687535253, "uuid": "2b384a68-ee57-4270-b0dd-f6ae7c0b574f", "value": 5200384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687535253, "uuid": "e4750ba5-8812-415f-b243-069295deace5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687535253, "uuid": "7d646c2c-01cc-4f76-b549-6f030e4ea2c2", "value": "a2e2f442b621df2ff847b4fad327d57b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8ebf4b-1200-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687550218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550218, "uuid": "6633b5e4-1c80-4b14-a0f6-42b096fda5ae", "comment": "Malware payload (Gafgyt)", "value": "0142ecd4d8ea864e2278429dfde077ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550218, "uuid": "6b5f73d1-037d-4b83-a500-b08e5d8e1c4c", "comment": "Malware payload (Gafgyt)", "value": "513ffc0a01968eebd1e967214121c373d78c42985369840b87802efb155596bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550218, "uuid": "e58e9d04-aa21-4a99-9efd-d2b591f166b0", "comment": "Malware payload (Gafgyt)", "value": "0072900899f4f485632fc9f23e9eab57e15bf763", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550218, "uuid": "02bb98c1-c570-4fc3-8e7f-2af8da8b7a85", "comment": "Malware payload (Gafgyt)", "value": "5158770a7e42c2fdfd12e5ed9faf1f4deec4c7ca1ca43964de91674ed462d4d3f97e118c11a9fb5c82255aa6e351ace3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550218, "uuid": "3501bb6a-eddc-4d3d-ae61-7e925d18f5bc", "value": "T130B33B4795A89EB3C086BEB525EB59300722ED120F2F1A9621387BF4437F5CD741EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550218, "uuid": "fae2717a-1e5e-497c-88bc-915e78c00510", "value": "1536:Aq/W65rWXAiP5dfK4EBbkb25lyDQnAjCGB5+TjgkHmmycgYVLu1IPYC:R/vp+9C4xb2MjV0j/HmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687550218, "uuid": "20e96e6b-02b0-4b75-88e9-0551a2d33875", "value": 108486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687550218, "uuid": "f4515dbf-c81c-4df6-bd10-c7ae0aa9b875", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550218, "uuid": "4ff5132d-e374-44bc-9e7f-e101d1b61c71", "value": "0142ecd4d8ea864e2278429dfde077ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a55d8f-11fc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687548624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548624, "uuid": "89bf9d16-9f33-41f0-a967-9203d39a8e66", "comment": "Malware payload (Quakbot)", "value": "e26d8c2ecc8975fe561a7751ee7c1cee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548624, "uuid": "0b686b14-e315-4600-8c05-8cc784d1e6ea", "comment": "Malware payload (Quakbot)", "value": "528d81b023e374081d1d1147c9acf2adbfbc0ec8ac95f7e3131589a0c5ec0d7b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548624, "uuid": "7d0a0242-aa9c-4a1d-b5c8-b404eb7b28d0", "comment": "Malware payload (Quakbot)", "value": "dd730d22d774e9a02581de89a6702319c7e020cc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548624, "uuid": "cec24716-2bab-4a9a-a7a3-f0f62d03320f", "comment": "Malware payload (Quakbot)", "value": "0b90bc8e5cb4826e7b704193f7dcf29d56b945f51c7cfba71843228dd4fed98d1eed23ca86be7a4ff70be0827662d335", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548624, "uuid": "81755ba6-be17-41ef-b2dc-ce9660edcc4d", "value": "T193558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548624, "uuid": "9335ed00-ea53-4313-b254-b47a22b08146", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548624, "uuid": "bf19753c-4c33-4d92-af21-51ecc2b817aa", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4yJQ:QbkS7XB1EsOSNPSp0EAt2bUeM4yJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687548624, "uuid": "a1cbfe6b-a909-4c29-b6a0-b1504d0b4f86", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687548624, "uuid": "8c65d0e5-fd61-46b1-857d-f83e4db9e50e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548624, "uuid": "7270728b-ebb3-4010-9f82-9b8a2c90c884", "value": "06qbot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56adbe57-1159-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687478589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478589, "uuid": "e6b87f9a-a15f-4ad3-afce-1d2bb9a25ff1", "comment": "Malware payload (Amadey)", "value": "037c5c00d808fd17f7dba6169041bc39", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478589, "uuid": "33e1bf3f-8ce8-4d79-909e-bd9826220040", "comment": "Malware payload (Amadey)", "value": "52cda54aa331746eeca15fecdd944c804561669ae1434da3dd4f8e0acf0b753d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478589, "uuid": "8498a00e-4074-44fb-b96e-01ad93eb0b19", "comment": "Malware payload (Amadey)", "value": "65205cd3ae868aa508ddcc9ed0109b675c02f50f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478589, "uuid": "f6dfdcfd-996c-4c3c-9f33-ad02b69d6aef", "comment": "Malware payload (Amadey)", "value": "f0f8ed4801958b27c2580b1442b219dd1058ee47f35e590e843a3b6a6fc4cba7ef3d6019537c7f48dfafa6a742ded2bf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478589, "uuid": "65dc6177-b360-43f1-8129-359a198c26d0", "value": "T179344C13D3A27C95E9168B729F1FC6F8760DF6508F5E7B6D26188A1F05B10B2D2A3720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478589, "uuid": "7a2aaa5f-fa5f-4657-99c7-3327b901fa68", "value": "c6b81bb2ea776dc3cea825ea1e857b82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478589, "uuid": "e73a8588-4cbd-471e-a525-92511d1d900b", "value": "3072:U66VwoA9nn8bqfEL/vwcqtlA4f3S6K9esbizbPwXWRSdZfM2AnAx:R6VwDnnQqcLQcqvzfhKokIbPwRdZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687478589, "uuid": "57cecb64-cc06-4efc-99aa-fdb3c7ca535c", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687478589, "uuid": "e8ed4e5c-7753-449e-bf25-25992107c96d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478589, "uuid": "2e5bcf95-1890-443a-b458-1faee00e3e34", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec31f0fb-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687516636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516636, "uuid": "88439448-5574-4fca-8694-ddefbff509ca", "comment": "Malware payload (Amadey)", "value": "f20ff7769db22810d3017632050062d8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516636, "uuid": "9c33b7a1-4a67-4ea5-b984-fcdfabc90371", "comment": "Malware payload (Amadey)", "value": "5539ad05c6385cd009e55639b038359361ee75b1960fc69c92e339ab21fc997e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516636, "uuid": "23c1cea6-9bb7-4681-9a36-2172ca6a356f", "comment": "Malware payload (Amadey)", "value": "58b984afea7013320211c4d03d12558ef2ff5ab6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516636, "uuid": "48a80a87-991b-4478-a177-605c007c7dff", "comment": "Malware payload (Amadey)", "value": "06387af632249146f871632a7efd369ee4032e03271186b6fec2d9f7daab4b89f5aba8e4cae9eab307fb0b2c7eea33fa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516636, "uuid": "3cb5cdc1-2a2d-4f46-a5c2-a537d958e04d", "value": "T17BB401CAA4804973DF63C9F2D4EFEDD64E7671210BA50BC7130C59FA8A411E4E61B93A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516636, "uuid": "50599586-6620-4ac2-a680-d013a123e199", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516636, "uuid": "2d022e2c-87a4-44ec-afd3-ad609172f437", "value": "12288:TItAxTey5sZjVmRvnscH5cE+UFFyiuttiqhQJQmZ:TItwTey5sZhcZZFFFyiJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516636, "uuid": "eeda7212-b882-4886-b95b-48be52537ef9", "value": 530752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516636, "uuid": "10a47b92-e3ca-4efe-9d09-6d6d5fb5cda9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516636, "uuid": "092645f1-52a3-4caf-a37f-ef9d7c6444a5", "value": "f20ff7769db22810d3017632050062d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb61388-1191-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687502549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502549, "uuid": "ade20a6d-a899-4b7e-8528-a75306d88994", "comment": "Malware payload", "value": "6198aff1460d4ae58dcb18f8d96f67c5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502549, "uuid": "d1a9af7f-df21-455d-8181-b0c2c0921e1e", "comment": "Malware payload", "value": "555e73803eb01e013cff4c3bf377075dfa855ba05513eef843629dd4a30ec1d6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502549, "uuid": "103addac-625a-40be-b36b-efcf3ce7942b", "comment": "Malware payload", "value": "72b69d62bb08e7fb2b98442e1dc41bf8ae0d1f6f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502549, "uuid": "6005adba-4b1c-4b22-9c5b-8af516961023", "comment": "Malware payload", "value": "74db6ecfa6a1341eafa0f77a99ccace00f8634ecda935b25bc1a3176e4cc828363887837a8491bef5eb5bc7b0bc2eb54", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502549, "uuid": "f80cb7da-5e5e-4774-aabd-8269677f150a", "value": "T14653F14EB3F06046E1A3FCBCE40901E02E5E41224F595EEA4D3BD76B49565D73ABC0A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502549, "uuid": "34f3c816-834b-4503-80ea-b8375cef5aa1", "value": "1536:WDAsF4EJm20+lIccccccgF4EE3iMiyt1YK/rLD11IUqQJx:WDL2Ej72EKYafD1yUqQJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687502549, "uuid": "8f05e001-b8ee-4761-94b8-0c7077b5809c", "value": 64455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687502549, "uuid": "a4f03b11-88ac-4215-b8a3-d6a69d4134a2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502549, "uuid": "a526b734-6076-49e8-9322-2db6260b14a1", "value": "Transaction- Details.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43200b76-11c7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687525801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525801, "uuid": "5c652f1a-81eb-4603-ab12-6b252fc7f594", "comment": "Malware payload (AgentTesla)", "value": "56fc62a5a1dd4b940239a6dd0509a79f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525801, "uuid": "f127aa57-86c7-4a43-999d-012f4a9322ee", "comment": "Malware payload (AgentTesla)", "value": "5590cb2801075c18a490b2d65789e7d668dd7d81313bf685487105e72329cc71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525801, "uuid": "4b74a832-66a8-494b-904b-f290a41bd11c", "comment": "Malware payload (AgentTesla)", "value": "9e4ec9ed9259170ca4dd764c2aaf2e649fc9b8f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525801, "uuid": "61eae189-3c2f-414d-933d-9397edadb78e", "comment": "Malware payload (AgentTesla)", "value": "d9d4fc1be37c573dcb4f427f6c5c3b2f8d5d266b4b71f001f3f5bb8eae68869bcb430e68c359df72588b83af3c661bd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525801, "uuid": "2d75be3e-65e9-4ce8-9afc-e3a759b524cf", "value": "T1E5D4231C61641F56F7385EB91D82105003B4B5482627EB4FAEEEB8C57A93344AC87FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525801, "uuid": "3bf1db74-7a07-4dcd-9e35-d5f45dd3d373", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525801, "uuid": "1f1df3f8-9efc-44c5-b8d9-a6da89715f1b", "value": "12288:Ek54/mNUA4o80xgHi2zmhjVvemuqTjFOn4bbBRpffCi:Ek54/QUnoBxgHlmhBetqTZw4vRfCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687525801, "uuid": "35e0e148-31ae-43a2-86cd-38ea39542a5d", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687525801, "uuid": "194d7b3c-8a44-434b-85fd-4ee43f7aa8be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525801, "uuid": "baaf521b-fc6b-441f-a3db-7cb77561a115", "value": "PDA REQUEST - MV HAMMER - LOADING 12700 MT CEMENT_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21668c1-11c2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687523840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687523840, "uuid": "e64012d6-2be1-4768-832c-0c0efd8e8da6", "comment": "Malware payload (RedLineStealer)", "value": "98fc662bb37f91032d219edc5fca47d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687523840, "uuid": "815a08f0-679f-4612-aba7-c69faaa0c47a", "comment": "Malware payload (RedLineStealer)", "value": "5590d053a1709c79bb65677a2ea9cc401e3dc3ca7160e55a58ca9e69e6ae6980", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687523840, "uuid": "7086d897-2a6b-4b01-904f-eea862930802", "comment": "Malware payload (RedLineStealer)", "value": "3522b115d8874b47c96bd2e006d0ea4cae24c942", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687523840, "uuid": "6771b1c8-8722-4252-8cb8-9ef6c82e1566", "comment": "Malware payload (RedLineStealer)", "value": "9c4120e3d4c7cc65ee0585a7eda77c95857db91ecfae233bb015e86ed01eb6de5893482745bf0782adbec8e3103d81e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687523840, "uuid": "71fac899-1ee0-4d9e-815e-a8bdde8b009a", "value": "T103B4F1CA61408573CF63D8F2D4EFF9D65EB971214B764BC7120D9AF68A112C0A60B93E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687523840, "uuid": "1049fb0c-9987-4948-aaa7-42ce2b2fec54", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687523840, "uuid": "340cfc1f-a316-4202-a14d-5ccea30a0ccb", "value": "12288:GEeO9rTey5s2NeX0Od415zu/n3PYlCJkb5+9qafSQcdOlcQJQmZ:xeO5Tey5sueK5qv3PYlCJ44ERQcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687523840, "uuid": "32c6c302-182f-4f71-b82d-c83fd60c9fd5", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687523840, "uuid": "b88a033e-6938-4650-969d-8d62b1c6d6d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687523840, "uuid": "fc6d02bc-325e-4283-a7ad-a3d18c959a13", "value": "98fc662bb37f91032d219edc5fca47d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31004be7-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687510309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510309, "uuid": "87fecbb4-20d1-47ac-892a-5b93fb63f591", "comment": "Malware payload (Amadey)", "value": "232abf84ad620e7ec336eb5adb96392e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510309, "uuid": "af311b77-df19-43d5-beff-2ea9d2474d00", "comment": "Malware payload (Amadey)", "value": "563e8ece3bfe7ae6da9b563efdd7a3333b7d2489cbbb24be42af8985be1a05d8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510309, "uuid": "da8e45ef-439e-4575-b04a-34ef96406062", "comment": "Malware payload (Amadey)", "value": "ae990e168087ec8ac8a54983bc6fb4b1ff03f0c4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510309, "uuid": "06609608-5caf-4f63-a88e-1a90bc33c45a", "comment": "Malware payload (Amadey)", "value": "c3e7715ea26b9eab332758c32f2252942f3993ae05424f261433020fdca64d40d80f153f8a390f7c73e6c35a8cfa27cc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510309, "uuid": "b99eecf7-3fb9-496c-80ce-44cb2b415666", "value": "T13AE412CB65800563CF63CAF2D8DBE6D75B7A6225077207C7220C99F58E045E8E61B93E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510309, "uuid": "7fe8a841-6eb9-45b4-be66-7f08475ee590", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510309, "uuid": "1fca3e00-e8fe-44a9-a810-0c935edb0d70", "value": "12288:beICaTey5sPpmlBjktrl+B3OinrvdwQcO252CgpcXO/PeQJQmZ:beIZTey5s8lBItrlg3jnr9cO2Xet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510309, "uuid": "7679606f-8613-4715-becf-2d4d9b05b1d6", "value": 715072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510309, "uuid": "4b60a2a8-57e4-4d6d-926f-dac44cb910d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510309, "uuid": "6f2d6758-8f51-4353-af09-27f591d733b6", "value": "232abf84ad620e7ec336eb5adb96392e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37fd4cf-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500676, "uuid": "ec530c07-1d7b-4544-9b96-34d71c866bc9", "comment": "Malware payload (RedLineStealer)", "value": "acc43beba5ba761e016c4c72dba39060", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500676, "uuid": "3595cbf2-5040-403c-a98a-023a89ec6be2", "comment": "Malware payload (RedLineStealer)", "value": "56e3be0ed6bdc22e5254ea7e7eb35c7ed4ce149be2ecfa34c24e81d32b52b5e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500676, "uuid": "d0898da1-34d9-4a1a-9710-c22ce32a7511", "comment": "Malware payload (RedLineStealer)", "value": "8be0092220d30e78d39572ee8b5adc47f1534e91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500676, "uuid": "1d4cb4b9-f63f-4f09-a122-8d52e08a0afa", "comment": "Malware payload (RedLineStealer)", "value": "e2cae40ab95e497a6f49a94e9ee2fadcfa4b941a716a726501b6a71c3da30c928b252302502a539664d76e75db1b74b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500676, "uuid": "75d22b54-61f9-4f54-b21c-acbf74a624ae", "value": "T13FB4F1CB25804973DF73D9F294FBEDD64AB6713107A14AC7020D4AF64E021E4BA1B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500676, "uuid": "599dd314-583a-4259-b3e8-73d70532f255", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500676, "uuid": "0d40669c-96b9-49be-b57c-9843dd91ca98", "value": "12288:AkQZFTey5sZANq89/zhE4DjPBxXMYpGT9fC+uCfJfJQJQmZ:AkQzTey5sZA/xFZDjPjli965", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500676, "uuid": "8b344e09-a96f-451e-928e-68c71d046381", "value": 540480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500676, "uuid": "ff290678-b756-4c37-a61b-b80eb14294e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500676, "uuid": "4080baf6-8d70-4753-89c1-12fc76c54f7c", "value": "acc43beba5ba761e016c4c72dba39060.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb41717-11e2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687537659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687537659, "uuid": "0bad2649-d2c0-42bd-971c-879f1b1f70ac", "comment": "Malware payload (Amadey)", "value": "5c5c40b92b07428f1269290e38bc02f6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687537659, "uuid": "4394cdd2-dfd6-4134-a42e-bead820c3c33", "comment": "Malware payload (Amadey)", "value": "57a5b9ad3db988d277dc20da8afa0d747b109e4f65f2bce4e02b3b8341f7aa85", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687537659, "uuid": "3a15d127-88b0-4b00-b296-266ddd8a8d2e", "comment": "Malware payload (Amadey)", "value": "cb03fe6d49a8a2895db6f608b6430282ab6cba82", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687537659, "uuid": "4d10771c-7bc9-47c7-a563-c1aa25e02e09", "comment": "Malware payload (Amadey)", "value": "cca495de56168f8f85fa9bd334a0f27fb1be854eb806343189d022a94ba88c4ab643ad860c89f8559b1851c39a3fddd8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687537659, "uuid": "e36c34c6-fe63-4d8f-8f91-ef67ea466677", "value": "T1F91612B82244D67BD3C32871D853950F081A29B2AAEFB9597797CDFA15232BCC474BC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687537659, "uuid": "5086c242-c73e-4225-9a79-f4c24ea76a76", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687537659, "uuid": "e0008522-2cc1-4d44-8e9e-fc6180e1eff5", "value": "98304:VnUiHvDPES1d9Rp3ckTFL7aEfr6Ni1Y9MAaANWn0x4Iu0bpIMVZ+cgoEKcXNzpn7:lvDPEYRp3ckTF7aEkEY9u0x4d0bpF/bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687537659, "uuid": "73c0ce4d-4844-403c-baa3-b889e6b07353", "value": 4107776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687537659, "uuid": "8c44b909-7187-4f04-8c3b-e8294081cfe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687537659, "uuid": "09d650c5-4f47-45ca-a015-a81fb7317325", "value": "5c5c40b92b07428f1269290e38bc02f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d6ed89-11bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687520967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520967, "uuid": "93d0304d-3a2c-4bca-9b6a-7e20569049e2", "comment": "Malware payload", "value": "968df67f7d9e1f9003ff289b797df824", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520967, "uuid": "6e60bcc0-34c2-42fd-a84d-03fad0b952d7", "comment": "Malware payload", "value": "57cdae893cd3de5571f086bee2967d03fd143e760f30a20b52da4e73274dfce1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520967, "uuid": "9141570a-1f5d-493f-a32a-b55b5eca62b5", "comment": "Malware payload", "value": "615e9689a45951e9e898ae9c3ddc0ae16d5602c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520967, "uuid": "1596d252-f854-464f-b7c8-60f55d58ac9d", "comment": "Malware payload", "value": "b69599282cf568862f64c399e6eb5091e7635cb06ffe505657841f8f1ceff539dd73c7248c1ec94c64197e2399c15867", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520967, "uuid": "db13ea05-a15a-48e2-9b9f-2f9b656d1944", "value": "T113A3D02568E180B3CA93A5744465D2927B7EAE2323F4D88B1B5411746F322D2A73F35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520967, "uuid": "35cd66de-a8c2-45de-ade3-55ced7e8bea6", "value": "3072:bu8oDIUXgf7hCHSYhaHzZe3AzGTmFjMY9/Np:DlUXWVALhQz+AzOmtJXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520967, "uuid": "ae4e53d3-ebe9-4137-8186-abe84d0e2a69", "value": 104978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520967, "uuid": "351a38a3-9509-4322-81f7-eeaeae38d9bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520967, "uuid": "0fe9542e-cfb8-44d1-8032-0a211374ae07", "value": "968df67f7d9e1f9003ff289b797df824.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957ad689-11ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687520356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520356, "uuid": "0a009bad-d0a7-4aef-a8d6-290ce602ead0", "comment": "Malware payload (AgentTesla)", "value": "1685364f6a29adce613a378d6358914a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520356, "uuid": "436cfbbb-735f-4392-b7c2-3f798742ae29", "comment": "Malware payload (AgentTesla)", "value": "5a46c33cf8a11a1c4653c344b2559444343a740a7ea479bd2f2d1a51fc7cd9ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520356, "uuid": "1f6976c1-4aa7-4342-a55a-d9c8c02f5f43", "comment": "Malware payload (AgentTesla)", "value": "84be20bcf2f8d7a02b0196dee3b04670cfb11cef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520356, "uuid": "5e014b87-533a-4667-8807-df9d5f30ce93", "comment": "Malware payload (AgentTesla)", "value": "75d9a43c14297e19dc9967f91caca7e5bf1756ba77856e7c945983085f04e1d12d14dbdb3792d6e0b7d2d903d8bceae5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520356, "uuid": "e86f4f1c-47a8-4089-aaa6-e400c9d646f0", "value": "T12774010362EA5DC9B1F22A076A7B50B54BF7BE65293DC54C40CC1A0E0BE3A5C8D55BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520356, "uuid": "aca8b9b1-821c-4cbb-9623-163499751b87", "value": "3072:3/dzaL5n5Z5XNsn1u7HLDVZ8MxzakjTIvsp6Z0:JnOAMxzak5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520356, "uuid": "37e1cbb9-4fc1-431b-b6b2-4f6bb70f7b53", "value": 347542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520356, "uuid": "759680b9-ec44-4159-890e-3c665a7b91c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520356, "uuid": "3946f373-3396-45ab-b15e-0aadb5fedfa9", "value": "factura orden de compra.PDF____________________.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba94147-11b5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1687518058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518058, "uuid": "5f0fd47a-6993-4cb7-8b49-9bb00113e40d", "comment": "Malware payload (Rhadamanthys)", "value": "1e9201fccabb69da2f855ab94cda76b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518058, "uuid": "b7fd0729-b29f-4de9-96ff-efd3999d42f6", "comment": "Malware payload (Rhadamanthys)", "value": "5a71eb1525407515c4d17f99d6085731e127fc352da49e7644f2000ca27ddc84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518058, "uuid": "f1ecd317-ddbe-42ba-9146-a7e2e775a2ba", "comment": "Malware payload (Rhadamanthys)", "value": "a9da9eccc7b4ebdbd3925ed66426ca0642083369", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518058, "uuid": "3e27efd5-9d0b-48bc-8bcc-010995ff50ac", "comment": "Malware payload (Rhadamanthys)", "value": "e36d779b08e27486cb5c2c8429ffef74c63f8741b300853766ad4ba3e8fd06adae4075f65d9ad3504123c283718c1119", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687518058, "uuid": "1eca9bdf-69cd-4064-8dfa-64a41534cd61", "value": "T1E6644A65BBF6AD84CE9D33B3C8146BA4069E077645F2E3C84D285952273F6A5CB0B13C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687518058, "uuid": "192acc60-dc30-4925-9d77-30b1c217f7c3", "value": "6144:L/E8DIpjK28t4snQxlp3z/pSZ+pDKpf9EkQbKxVKP:dEpj7snqv/cgu4VGny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687518058, "uuid": "f6adb296-151d-439f-92b4-5b00347d8583", "value": 328284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687518058, "uuid": "4a8d63a9-150c-4dba-8c79-c347f9b75888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687518058, "uuid": "8c3d613a-da23-4bcb-a84c-23efca216b37", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987f4c8c-11c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687522938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522938, "uuid": "4a34a42e-16df-4794-93a8-60fa7fa93525", "comment": "Malware payload (RedLineStealer)", "value": "cc0574778e5698895080b336f58c82ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522938, "uuid": "fef9d1ed-951c-4263-ba79-e20ffa1c4f3f", "comment": "Malware payload (RedLineStealer)", "value": "5b165193437fe47b4e50a8c27d86673b95d37c51921336aa93655199d42b8460", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522938, "uuid": "1a60651c-b509-408b-bbcd-6d1f28958ac6", "comment": "Malware payload (RedLineStealer)", "value": "9ad27a64f42291960e88fd09861a63b6b374dfa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522938, "uuid": "31acbdd2-df8b-4b27-9d92-9b0130a9a37c", "comment": "Malware payload (RedLineStealer)", "value": "ff68961b35f316f4968b61ef19209bbfc41677ae97e702a67a00e9bb73d324e127e21a7c5130168615db30804e9fe1b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522938, "uuid": "431ab880-36b5-49e3-bd77-3bbeb5f429db", "value": "T1C2E402CA65804573DF67CDB2C4EFE9C24E7671220B398B87130C99F58A826E4E11B57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522938, "uuid": "3da23be4-dde5-49be-9168-0a2ebaa58a6b", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522938, "uuid": "e2bdd4ec-2d5f-40a1-814a-1396f4e13e40", "value": "12288:4oinYTey5shGQywXxnvWOczfHO9SGwLw1fwjNk9kVMKHhOQJQmZ:4oiYTey5s8QZvYyQGaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687522938, "uuid": "c3f86be1-b3e5-46f0-ba8d-70e3950f21b2", "value": 713536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687522938, "uuid": "215a030b-178d-4eec-8c50-04adc58dd4f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522938, "uuid": "221802f8-b3ed-454a-acc2-9153fb7629f1", "value": "cc0574778e5698895080b336f58c82ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756439ed-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500975, "uuid": "1f3d6148-33f8-41fa-89e2-90713083c506", "comment": "Malware payload (RedLineStealer)", "value": "c2f44b21aca46afadcb5e8528ad70493", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500975, "uuid": "8ca67d3e-f6af-4ee8-b760-2322d1ae10ac", "comment": "Malware payload (RedLineStealer)", "value": "5bf5c1dc4ecd762931078d33ec12b9c335f0b8e941dbcc09d6914178c3506cd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500975, "uuid": "449d846b-569f-4134-93b6-8c1b00d38e19", "comment": "Malware payload (RedLineStealer)", "value": "bb019e7123152af7d39c1afd4c8680c38a2e1cf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500975, "uuid": "1829efb8-ff7e-4518-82fb-6a75a97fe1b5", "comment": "Malware payload (RedLineStealer)", "value": "6851ad99cd929564a54a4e84abea94af01908f7af72aeb7315be65c6b5543e7c01602c1c163a82d031891e6bca862557", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500975, "uuid": "3af0a0e4-fd27-461e-a7b6-b0f0994e027a", "value": "T17FB4F1CA21804973CF63CDF1C4DFE9964E7A712207324B87130D9AF98F552E8A61B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500975, "uuid": "e355c326-4e65-4fec-8f48-33f9a6374ff0", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500975, "uuid": "18cac7de-2868-4cff-b491-c096a61d5e2a", "value": "12288:Eh+ixTey5s8AndabiDFRiy3kSeYWCESB5TQJQmZ:Eh+mTey5szdabivT3zeYWCESBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500975, "uuid": "cf3683d3-cdc0-42c0-a13d-4b7d75127e87", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500975, "uuid": "f0c1674f-6d7b-499d-af61-bb21f535e526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500975, "uuid": "dd3c6c74-0d3e-4d0a-ac8d-97d28a450a00", "value": "c2f44b21aca46afadcb5e8528ad70493.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8ddc17-11da-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687534058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534058, "uuid": "cd586578-69b5-4205-90fe-bd7267c45619", "comment": "Malware payload (RedLineStealer)", "value": "0c35a447aa2bd58aaef35c0a86868907", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534058, "uuid": "383eda6a-25e2-4fb5-9df5-1fdb2bd339c9", "comment": "Malware payload (RedLineStealer)", "value": "5c1d56ecc2dacb122b653cfc058b60b1e1ed34192289d3d94745a6c8a6337aad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534058, "uuid": "d93252fe-1877-4fb0-b26b-5a314f8cfff1", "comment": "Malware payload (RedLineStealer)", "value": "caa9fd4bd4bed172bf9d07b3932cff5c0693e9ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534058, "uuid": "fb490240-8bb5-4e26-a469-7aa0213fd83f", "comment": "Malware payload (RedLineStealer)", "value": "ed07d9f351bbd81e0a7b572ab7db659c62cc4586cbad99ff81d5f78bebb914c9856370c4d7466004dca0398d26f4d00d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534058, "uuid": "1ca8dfe5-62d0-4812-b0c6-d251a9fbee84", "value": "T1DE1612782600D6BBD3C72531E463555F08292872AADFB9997783CCEB58632BCC4B4BD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534058, "uuid": "24e35206-63e1-4064-9429-14f78dd3ef15", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534058, "uuid": "97a6a2a0-91cc-4173-a17c-c5782ef569c9", "value": "98304:iYm90mVIUZvEU5U0DfVRTsyRjjMBIpsS4Hp4jui+uX78M2rCZDY1ioH5knmp:Bo0UQ0DdF5RjYBcsbOj/X78FCD+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687534058, "uuid": "1d3bae05-4a3b-4f7c-996c-4462be49d5fa", "value": 4089344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687534058, "uuid": "72672a32-4948-4ffc-9ad6-65c083d5648a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534058, "uuid": "f6913371-8b86-4b3d-b1e0-77418d5ecd71", "value": "0c35a447aa2bd58aaef35c0a86868907.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5f59b3-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687510301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510301, "uuid": "357f9014-3896-46a3-aeff-1e30fd79fbcb", "comment": "Malware payload (RedLineStealer)", "value": "2d6ff1c1193f98a86225eb8070c4b9b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510301, "uuid": "ee29596b-18c1-4caa-a6a6-7b055db800ee", "comment": "Malware payload (RedLineStealer)", "value": "5c3a9825ff1d08f0ff6e602b6d7e8b181ef32babb6c9ef7874e62752ad0c7542", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510301, "uuid": "84fcc2fc-04f1-4dcb-8106-4eec000268f6", "comment": "Malware payload (RedLineStealer)", "value": "2f9fa414caba751ba74132b0d6a411bc1a1a667f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510301, "uuid": "ea01c67f-f1a5-474d-b17b-277553d916e0", "comment": "Malware payload (RedLineStealer)", "value": "f970a82d89ed8a0883e7f0d705c93921139c64860860f49d2f7ea1a12b1f9934d7077d411c4a678fd80e47fce62503dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510301, "uuid": "806add44-b216-431a-9e36-af2f102597b9", "value": "T172E402CB65804973CB33CAF1D8EFA9D65EB9B1210B350B87120C4AF58F066E4A61757E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510301, "uuid": "bdd652bb-0f1c-49b2-83a0-6ca1630b3df3", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510301, "uuid": "3fdda694-5e21-419e-8384-8a9a874bbea5", "value": "12288:DktLaTey5skI6SLTs/Zhf0gbzifkwUqxRmHE0It/lkcLR5pwQJQmZ:DktOTey5skI6SWH3aOHE7nVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510301, "uuid": "d59986cf-09cb-4674-b742-7768a6f63fdc", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510301, "uuid": "1b10b360-d095-42d7-8cbe-384060c9eabf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510301, "uuid": "2fc3ff26-a0e3-4b3e-b945-290c54c0f5b0", "value": "2d6ff1c1193f98a86225eb8070c4b9b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec4e7fe-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499756, "uuid": "739c68c3-b33c-4cdd-9cb5-726e19be7eb9", "comment": "Malware payload (RedLineStealer)", "value": "46a08d6bef293e27eec07f861b360347", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499756, "uuid": "b0f38c7a-3704-4513-a0c7-6163db0d4f40", "comment": "Malware payload (RedLineStealer)", "value": "5e8718b0eb902b73001ae7fa13cc97e089fb994ecfe616819f5433f49fc0b9bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499756, "uuid": "9c031a75-a74b-42f5-93b7-6d641f0e0c39", "comment": "Malware payload (RedLineStealer)", "value": "36f3b58820753a3c5275b20cb7b15a5961e4a00d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499756, "uuid": "10861fe9-3df1-497a-a105-0e5930bb91b1", "comment": "Malware payload (RedLineStealer)", "value": "9c79e1f02bd4241eba0def15df1846810b86b68579e5fb64cac0c8c9b9c5496eaa3ea86659816f64ea3648f2d122455c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499756, "uuid": "e0551763-68e7-4598-9b5b-a733900f5cd3", "value": "T193445CFB52D1D460DD0FA4B02C5EE1BDEE31B461DEA284CA19BA0952D3530E4BCE798D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499756, "uuid": "abbde3fc-13db-4be2-b322-15d5b6e7cf8a", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499756, "uuid": "9053f7ba-d3bc-4cdc-a33f-946c1969c0cf", "value": "6144:wghSpigt0poiRG/XvLNUgYhuE220QJQmB:wghFgtAoiRG/fSvcQJQmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499756, "uuid": "ee1c1390-0a04-47dd-a597-0d38301fb8bc", "value": 276290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499756, "uuid": "0e07f363-5a7c-458d-8e9e-6adc1e4d420c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499756, "uuid": "f048dced-fdd4-467e-9215-9a72f8754060", "value": "46a08d6bef293e27eec07f861b360347.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae68b4a-118f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687501870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501870, "uuid": "5c9d154a-92ea-4ed1-8347-8fc7d403cfe6", "comment": "Malware payload (Mirai)", "value": "6f12470757adea5fb599ddd33be3b52b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501870, "uuid": "16ffe605-1477-404b-8037-4b094b0b7510", "comment": "Malware payload (Mirai)", "value": "5e87374ee15938f3677a0e0b66ab342a178230e58c521b88156d138532bf4faa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501870, "uuid": "bacb9e14-38ca-4ade-8637-887e3cfd45f1", "comment": "Malware payload (Mirai)", "value": "a4da3ce7acb60ceda6c559879504eed45d001886", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501870, "uuid": "b28d150e-02a3-4729-a243-0ce517d45cca", "comment": "Malware payload (Mirai)", "value": "65204f2713328b70bcc175ae6f4bc1f0e6bc835f55f2280dbeacc5be9435a707ffec262be3bef29b6f6385ca807f9852", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501870, "uuid": "e9a5817e-9cf0-406d-a2ac-4e923840306d", "value": "T164C2E193A0B8CD06C873413F6E2F159B61282439134DEE1E333AEBDC62564B4A279DD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501870, "uuid": "a6a56168-e0e2-4020-8609-9e255ee83636", "value": "384:MRSK9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5dwapDyCTYHHJC8oytPFnAqV/LlJk:w5+Kcrb9VDJe5FLTYTlPFnz/nSKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501870, "uuid": "be4af789-4d8d-43e7-961b-63987f1d0b87", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501870, "uuid": "cd92c9f9-773a-4542-9150-a2fbe97392b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501870, "uuid": "f85cde06-4c66-403d-a225-606936dad0ab", "value": "6f12470757adea5fb599ddd33be3b52b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9764d394-11c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687522936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522936, "uuid": "e4798951-76d4-4d80-82aa-bb22717839d7", "comment": "Malware payload (Amadey)", "value": "7bcdec7a57441c6fb642fe9d62f46a52", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522936, "uuid": "4bf5f649-463f-4a08-ade4-d750c6944fb1", "comment": "Malware payload (Amadey)", "value": "5f3cfc2432c2f809c662adfa1de5439bb85bb7d1797e50ab3d32844081944005", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522936, "uuid": "f7417628-1435-4729-b1ca-5df4b495b83f", "comment": "Malware payload (Amadey)", "value": "3ae7e9875f29e9be5d0fcfc940f09b78bacd3cb2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522936, "uuid": "7eeefd46-fdcd-4317-9414-a7b90241c9c3", "comment": "Malware payload (Amadey)", "value": "6453565b3f52d044fd3fb37e1e0816ce3ee1687b0435094a87e8f52c4bd0b341cc8a33a28de8cc8f39b6b3f834947554", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522936, "uuid": "2d72de8e-c4a6-4ae5-986e-ef75eb48e638", "value": "T11AE402CA62804563CF37CEF2C4EEE9D74EB971210B754ACB020D59F94E466E8E60B539", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522936, "uuid": "ce2c97d5-929b-4bfc-811b-e9f2659529dd", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522936, "uuid": "1446bcb6-d8a6-4b0f-bebb-bdbc7d0f75e5", "value": "12288:YMeI2ATey5sIjPiSit1U2PtO3Bgtnn27R3eZTFwyUjEnn7MkkFKsYvI0t3QJQmZ:jeI/Tey5s5LEetOA27S1UjunQBKsyXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687522936, "uuid": "7b7e031f-2b10-4585-88ad-541bcb4efe38", "value": 714048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687522936, "uuid": "b042d0a4-2759-4d79-a5a3-511c2603e41b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522936, "uuid": "8c785f1d-4065-474c-938a-a8f3bf78a081", "value": "7bcdec7a57441c6fb642fe9d62f46a52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3b1105-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500372, "uuid": "9d6ff8ff-c30e-45ee-8f4e-36022ff958f5", "comment": "Malware payload (Amadey)", "value": "8df59efcec57c45e33a88fe9e1bcfb2b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500372, "uuid": "57b9a3fb-98e4-490a-8c10-c64941f954cf", "comment": "Malware payload (Amadey)", "value": "61058727489cc469472d46b28b2772b564f4846064d6cb57bc1dd130251057c0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500372, "uuid": "1a11ef47-3c52-4441-aa65-80b0aebcb3d1", "comment": "Malware payload (Amadey)", "value": "59f13de718f025dfd7d2dd14e67789c20d71b49f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500372, "uuid": "ed619a80-acc8-4074-9d12-cae17ec4ecb5", "comment": "Malware payload (Amadey)", "value": "7adbb8e8a1b6446c8d2e8adb8bba39306eb5a12f9a36af7c0456f62084ebb8ca268687957fcd2be9cc8db4dbc1cc9f06", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500372, "uuid": "277bc5ee-c3fe-4987-aa22-acb4149ba4c9", "value": "T183B4F1CA65404673CF73C9F2C8EFE9C24EB971310BA14BC7130C4AF58A556D4A61B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500372, "uuid": "4e03a108-b5e9-4097-84c7-0bf67cc09ead", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500372, "uuid": "3ea2d6f5-3ef8-451d-aef7-679b17ced158", "value": "12288:4EFn3Tey5sRGmEWATGsHIPo+W506qvoCdaUQJQmZ:4EF3Tey5sR/EWATRIQ+tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500372, "uuid": "9fb6fb06-bfc2-42f8-8695-9199501be6ad", "value": 540992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500372, "uuid": "89616e0c-e2e5-467e-83b4-c9fb8a85b138", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500372, "uuid": "f4528807-6473-4394-8fcd-2fb4667c5d6d", "value": "8df59efcec57c45e33a88fe9e1bcfb2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13404df-11d4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687531650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687531650, "uuid": "5e59e382-d934-4377-9a7c-011e45e689e5", "comment": "Malware payload (RedLineStealer)", "value": "95b7d7bc2c7c93893b4ad97d260a43fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687531650, "uuid": "23e97bb1-6913-41b2-ba6d-47287324a6d2", "comment": "Malware payload (RedLineStealer)", "value": "61c5d25b538f5866a842a91e04b405974441d364659e400aaddd37bcd5137166", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687531650, "uuid": "230959ae-9fc7-4d90-8946-8608b145be1a", "comment": "Malware payload (RedLineStealer)", "value": "5ae494d1688aa09ed32400359f79a426ca840835", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687531650, "uuid": "c0f72f53-fae4-48fc-a498-1a0f0ed64301", "comment": "Malware payload (RedLineStealer)", "value": "1af94ade60b273528843775936e449fa494c853b2c2f5c958bd6f6a7ff409a49199d9a0154c64a3c17ac8bacd32951d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687531650, "uuid": "fd3e8ae4-ffa2-4d61-9a51-012bd157a967", "value": "T17D06127A2D05D673DBD72935C0A3929F485C6AB0154F784A7FAB0D3B9AA34ACC034BD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687531650, "uuid": "52ec1499-9561-4680-b951-8cbfbf87dcda", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687531650, "uuid": "ac9cda67-287c-4e0b-ad7e-652096835e74", "value": "98304:Yr024Im7ToICq1AHABH3kXEtEm8Pfaf2ywS4AhACrPQ7K7nkXD4q6IR/4zN8Z:Yr0247oIzp3kUt77s8A8P2D8PzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687531650, "uuid": "131748f4-9b9b-41a4-91a7-02a809901194", "value": 3784704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687531650, "uuid": "41cc6857-7871-4434-b48d-befac57321d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687531650, "uuid": "a9490be8-712a-4362-ac17-7b8aef65dafc", "value": "95b7d7bc2c7c93893b4ad97d260a43fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987ce2f2-11b9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687519932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519932, "uuid": "30e05568-6eaf-4706-826d-aeb585d8837c", "comment": "Malware payload (AgentTesla)", "value": "9686b284da996d61286bf7667b96c64c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519932, "uuid": "c7078747-dd17-4e82-8dd5-a1ef3b263481", "comment": "Malware payload (AgentTesla)", "value": "61e75e123449c092c36171ad72de1ddbce425c8a82de0704f868295fab5df3a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519932, "uuid": "e60aaa5f-58a1-4e08-bc3e-67c953788f53", "comment": "Malware payload (AgentTesla)", "value": "c0d2b8c8b3d6bf9c689bd4c392cce68b3eb5a955", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519932, "uuid": "87c1b7bf-d02a-4b9f-9fcf-e379371f0d53", "comment": "Malware payload (AgentTesla)", "value": "b9248cf195aef5acd34534291f9d707b0feeafc9da6aef158ad440df1501da5ddb7e9920a33f20968c8d8abcf92fba58", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519932, "uuid": "c50ede69-23b1-4a23-8677-4bce82fb5ab3", "value": "T197D4022611A40729F43B2FF954748168C7B5FE425322F62E6EF511F20923F518F167A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519932, "uuid": "1363aba9-1d8d-441a-bd66-34bb86c441df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519932, "uuid": "9b06e1f0-8422-480b-b76b-e4bafc110864", "value": "12288:La2iNG4/mNUAMrx3B43kdsE63thunkpvlhxniwCYlc7fE:La1M4/QUlrx3C3RtcKvlnhlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687519932, "uuid": "3a4b6e1b-d3c7-4aa2-b42b-32702af9fefd", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687519932, "uuid": "887c8a7d-db67-443f-ac68-26b63ce6e6bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519932, "uuid": "6d74dc88-56a5-4639-92c6-538c97a78b3e", "value": "Swift Copy EUR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49868ec-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516623, "uuid": "2b831d89-72f1-473b-8009-bc10153cde6e", "comment": "Malware payload (RedLineStealer)", "value": "6d32afddcfe58753ba4a5619d452d7d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516623, "uuid": "96c2f411-632a-4b5b-b394-0050f591dab6", "comment": "Malware payload (RedLineStealer)", "value": "63a4b0dab558897b74810973ad467c8ee70873488d38c2cf49aa9877f22747c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516623, "uuid": "c163383d-4af4-4536-8652-5f5a72379fba", "comment": "Malware payload (RedLineStealer)", "value": "d0c9587ae25151271acd84694ab7e244161dd1f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516623, "uuid": "fcb7eb15-2d71-43de-8f23-b1205fd4ef53", "comment": "Malware payload (RedLineStealer)", "value": "20973e6d62af91fe9eb8ad3a391c8f7028a3236352b29c1a76390a4dde458328925d34be8a61dd9bab77fb3c8f197159", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516623, "uuid": "3b6de36d-3466-4c82-93c0-a9ef607672ce", "value": "T138B4F1CA66400573CF63CEF290EBE9D64B7971214B714BC7130D8AF68B016E5B60B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516623, "uuid": "1313d124-8378-4acc-bd86-7cb7215ab88f", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516623, "uuid": "afcadb34-5b66-4237-bd76-5bca7e68b6ca", "value": "12288:V5BV8/Tey5syIplzYCf4PBNo9blBHtEGycUXFRwCFQJQmZ:DBVSTey5sR7aTo1HtLYFRwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516623, "uuid": "31d4a0a0-f106-4dab-92fe-b1b9f48b73e0", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516623, "uuid": "fe98a3da-3441-4846-aaf7-60f0fe7e4dd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516623, "uuid": "517e01f6-fb94-479f-822d-6aecbb65179a", "value": "6d32afddcfe58753ba4a5619d452d7d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63713e54-11b9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687519843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519843, "uuid": "5cb5b357-4b1b-4448-b3c7-2b7179554281", "comment": "Malware payload (AgentTesla)", "value": "34c93bec02c4bc6e4905d69c67e469a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519843, "uuid": "20409e67-d647-40c2-b6b9-7f19ca5cb058", "comment": "Malware payload (AgentTesla)", "value": "63ff2048431b0b07082efac82b0df98fc58b00af04df325ea8a50b81c0110a95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519843, "uuid": "078f8cfb-5754-454d-a11b-86e5b74f9312", "comment": "Malware payload (AgentTesla)", "value": "e6b2b3bbbfac914fe3695c2d663b5f91af0c4c8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519843, "uuid": "bfea4394-d6cb-4619-a493-f17472ab8252", "comment": "Malware payload (AgentTesla)", "value": "ae05ddc62755df9695a71716b7eeab1d3e3b5af7856c7ec5ce218987a01a4b1c801899acc2f5d1a9112e6b93a7e4eb62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519843, "uuid": "4c77a9ce-2286-42cb-80d5-b784727bf62d", "value": "T11354BE0366EA4DC8B2F26A076A7744B54BF3BDA5693DC54C50CC190E0BE7A1C8D52BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519843, "uuid": "4348bbbe-f917-4400-81a4-83d63366c653", "value": "6144:GyyyyyG0cKBAfeSaWmymvCmGm80amvmjCzeyyyyy5yyyyy3yyyyysyyyyyhyyyy/:GyyyyyG0cKBAfeSaWmymvCmGm80amvme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687519843, "uuid": "1b8eb5dd-ef09-4d5d-9d27-2f110bff2c57", "value": 298826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687519843, "uuid": "809803a2-1ac5-4a0c-af6d-19688f6d8b73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519843, "uuid": "e028ed72-db5d-4c2d-85a2-b3e0b7959919", "value": "Transfer.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3361396-11bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687522634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522634, "uuid": "a34a1d89-5cf6-43ab-b177-644ffd1d99f0", "comment": "Malware payload (RedLineStealer)", "value": "791e75553c42418a0146120d1b9df611", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522634, "uuid": "95f09114-4e8c-46f1-a82d-923ecd6dacbe", "comment": "Malware payload (RedLineStealer)", "value": "647cda5850d0f3f949b98494149f12e75bbcbb8fb3497dec4d5208b3ad3b6d16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522634, "uuid": "42b5193f-8a81-4adb-b7f7-bf1d5f604fc3", "comment": "Malware payload (RedLineStealer)", "value": "bb8ab68921abb778907f9412ac4ec19df5a21c17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522634, "uuid": "16280034-ee52-429e-935a-a341689b8c68", "comment": "Malware payload (RedLineStealer)", "value": "e8dde0275bb7827191ed62c8def5fdfa6f06b2dd5f7d3bc648b6354119a8b6a611b8330d409fef925d76d546118a816d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522634, "uuid": "f30d1dcd-3adc-4c73-8412-03f7e1f004cc", "value": "T1F5B4F1CF62404873CF33D9B2D0EFE9965F79B0214B724787120C89F94A465D8B62B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522634, "uuid": "a4fc72b0-cbd2-4326-ba2d-9cd98f00937e", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522634, "uuid": "8844d933-c428-4a2f-8169-1a7dbd27e8fc", "value": "12288:LeiDDTey5s6myf9TIiSCThmOUINjGT7+QJQmZ:LeiXTey5s6hf9Ts+oOUIdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687522634, "uuid": "5d4b0133-b9f4-407c-a147-f70b0967e298", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687522634, "uuid": "ef47e35a-8203-4780-90a2-962d45395967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522634, "uuid": "5429afc9-d9d8-4edf-8ff6-9a347bc07303", "value": "791e75553c42418a0146120d1b9df611.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08c715f-11bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687520831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520831, "uuid": "1a267959-d49e-4b19-ba6d-dc62f3c7ef17", "comment": "Malware payload (RedLineStealer)", "value": "ecf2551b3c2d3c7ca72ba508cfb80109", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520831, "uuid": "2f2c3e97-4df0-4250-8692-9d7725d7794b", "comment": "Malware payload (RedLineStealer)", "value": "64ec3eb5a08a21c4fe3acc71af7950675a81635910e34d9dd662a2e2b31a140d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520831, "uuid": "012e45f5-634c-487a-a867-2f4d0d476122", "comment": "Malware payload (RedLineStealer)", "value": "894480f6f0a5aa089ddcb0d8e93fabd443201f22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520831, "uuid": "2ca82774-15a2-4bab-a527-f0054480626c", "comment": "Malware payload (RedLineStealer)", "value": "97a5b94e92aef5620365da9fc05ee2f33df5675c9527c7b5e72a7f96fce07fe3b2321502b2093d2a9a14e22700344a32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520831, "uuid": "b56df684-7790-4953-923e-17586f484ed5", "value": "T1C7E401C565404973CB73C9F2C4EFEAD78E79B120076147CB120E59FA8B0A6E4E5076BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520831, "uuid": "3187b867-a32a-4034-a47c-a3ff8256c4d4", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520831, "uuid": "6b968601-8d11-4767-aaad-69ddb455464f", "value": "12288:B85IPr8Tey5spDk6x4r2v3crdZA/+yAAM8wxDo28sfb4x85VSSQ/7YTtyQJQmZ:S5IPITey5spDfSrQ3YM/+bAMvDZ8wUxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520831, "uuid": "5062af39-ed78-4455-9f86-9f87ddb9aad4", "value": 713536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520831, "uuid": "bc172e3a-2c03-4553-bb68-e6a2905d834f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520831, "uuid": "18ea7a17-08e7-42be-9791-7cab51e338bf", "value": "ecf2551b3c2d3c7ca72ba508cfb80109.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7449b252-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500973, "uuid": "9b7fa13f-57cb-4c7f-9af5-960ce94d440a", "comment": "Malware payload (Amadey)", "value": "7718b65c7d2c62dc3873c8354508704e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500973, "uuid": "4fc84941-8356-4e25-b82a-6c093ce2116c", "comment": "Malware payload (Amadey)", "value": "651efacf638c6775e4388e460f3cc921a3f9460e43b635bc709f47bd50e3aa44", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500973, "uuid": "e2b79836-98cf-4744-aa41-03bbc3497282", "comment": "Malware payload (Amadey)", "value": "b9b7773585a219934fcfd0cbb12b2a317ce7cf13", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500973, "uuid": "1ebbe116-6c8d-4bb3-bd35-632164005e36", "comment": "Malware payload (Amadey)", "value": "206c3dde4071743285a6cf4b5598fd3ae1af45db6ffce281ca65069734573fd140cfaa9eeab2d81d1713409462ffebe5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500973, "uuid": "0ae28bb3-9235-4f63-ae1c-c6a6d8af146a", "value": "T10FB4F1DA25404573CF23D9F1D4EBE9878E7A702107B68BC3130D8AF54E856E4AA1B53B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500973, "uuid": "c9bf9bbe-d66b-46bb-b420-e92ca50e1d98", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500973, "uuid": "e67cb12a-adff-466b-874f-5b8d82d00715", "value": "12288:mtTcLTey5slGPt6vihSE9f/Ey7eX2+QJQmZ:mtTCTey5slGl6Mxp/Ey7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500973, "uuid": "0d0c6b1a-be24-4cfc-a571-1a54eac702e5", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500973, "uuid": "44f5cb09-9918-4869-b709-9494afec44b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500973, "uuid": "5955e85a-b11f-4b53-be21-f64cc64502f4", "value": "7718b65c7d2c62dc3873c8354508704e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f757f6-11fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687548011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548011, "uuid": "cb051614-f22c-40db-8b0f-09c30f5ac433", "comment": "Malware payload", "value": "bdad0b1d57df81fb98ed0cd1e5b4b40c", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548011, "uuid": "569c9efc-887d-49b7-a1fd-6bf249963b9c", "comment": "Malware payload", "value": "65831b6a853bb664e7f189003da9cdda832e5bcf647c1e262b3bc80acb715814", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548011, "uuid": "770d07fb-6530-41f7-b1cf-ba2f59fd29a2", "comment": "Malware payload", "value": "20502e5500f85ebc86add55efa3a70b3f2399e12", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548011, "uuid": "468cd8fc-ae53-4a8c-be44-bc10f388b42d", "comment": "Malware payload", "value": "70dc62d9bdafb7e9cba9df3b17d3155e4a8751d35d95da42ce181af80c98212dd576351375b9b4022477ef4840014821", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548011, "uuid": "bebc12f7-599e-4c53-8b34-37293c5fde35", "value": "T1C5925C17A7D8C367DC4F473ACCA11380033AF3BB6B17AB260687A04729763A857446B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548011, "uuid": "f0885daa-634f-44f4-a52a-5e3c080c4401", "value": "384:q8e8l/Y6ZQnkD4Z4gyzBfYvQ3Dz6a21DR7l+EENluwL8ScQjn3qDjUw:HEkPTziMglg3qHUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687548011, "uuid": "4d519903-7d2d-45eb-b91a-09dfc90c254c", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687548011, "uuid": "c86a8b57-6704-4b4f-883d-23155a43f763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548011, "uuid": "2ef45959-a617-4108-95f1-d262c14a3e63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88135ee5-11b9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687519904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519904, "uuid": "0f95281d-d124-46a6-8048-b381675ae98f", "comment": "Malware payload (AgentTesla)", "value": "1d0ba620631acc24a652e4759e53947b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519904, "uuid": "ca5b52b6-3293-4d75-8d38-7573309aab3f", "comment": "Malware payload (AgentTesla)", "value": "658d5f23cc2d33d6d5883e6dbe0e43f80fe93983c53943e8067d18ae161c119d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519904, "uuid": "c3f09282-eb2a-4a9a-b327-c9e5a6b5d77f", "comment": "Malware payload (AgentTesla)", "value": "771b45df7c4c79d0ee9fd4bbd41e4b799b0ffcdb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519904, "uuid": "455f98d6-b9d6-4e86-a61a-0b55a730eb27", "comment": "Malware payload (AgentTesla)", "value": "d3e25080fea54983ce444fc0f9e3753a645a30878ec85dc743d8baa1fddf374a895c0a626f5d85a28c49bbd489d108ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519904, "uuid": "9ffb6bab-55bc-4ab1-b59b-01e359fa23f0", "value": "T139250201FAC198B2D17219324676BB21597DBD250F64CEEBB3C42A5EAE312C1E731B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519904, "uuid": "6f6cd307-3f80-4c28-a1da-757ad0cf3771", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519904, "uuid": "7cff744d-8a4d-4410-86d8-3a0d2e22f3c3", "value": "24576:vTbBv5rUPL6Xizhqh+TkwlhgAhEWbtKuJo+tnL90J:ZBwWSzUhXwlhgbEXJL5L96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687519904, "uuid": "7b4d4f05-dc6a-46da-88c4-f958c797ba79", "value": 1009426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687519904, "uuid": "8205540d-1ae9-4cb9-9a54-c02495263bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519904, "uuid": "85aca809-8bfb-4ba8-830c-ecd3da242eb6", "value": "New Order List_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c57feec-1159-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687478679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478679, "uuid": "058a0087-9c35-472b-b706-76eea6ec43a7", "comment": "Malware payload (RedLineStealer)", "value": "7c787e1243a6644283a5931ec2dcc748", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478679, "uuid": "62c22254-38fb-443e-afff-fcae13a27ddf", "comment": "Malware payload (RedLineStealer)", "value": "66002276868f3b06b43b8ef66ffaa8a4b65cbae0831a17be14dd9ec7e3e83d1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478679, "uuid": "5bf5fa43-33c5-4bd1-9914-47b01b1f1717", "comment": "Malware payload (RedLineStealer)", "value": "9dcd150367d974e9ef3193e2441b83a8e84c19e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478679, "uuid": "57315f40-bbb2-49b7-ab63-53341bc0c64e", "comment": "Malware payload (RedLineStealer)", "value": "d31b90242e5dee699fdba29990c8753f86559e78ca4ecf156b04e0827720d2abe454224c72e5e25bdc0a9fded76eaa29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478679, "uuid": "81984637-7cd5-4ccc-b56c-8c36208eb27a", "value": "T1A0E402CA66804633DF67CDF1D8AFE8D78F7AA0311B6147C7120C4AF58A412E5B61B53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478679, "uuid": "6e353aab-7e56-4179-b99b-39193fa82f14", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478679, "uuid": "687ec620-3b28-47c0-ba22-d9767e8571bc", "value": "12288:KiUTAoTey5swCST3ZhBLirJriYZCIi21dwIHOgVaY+B7kTQJQmZ:KiUTNTey5swxBirViYZrH3HTVapr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687478679, "uuid": "d291ba3f-b811-4e55-aabc-ca04f483a116", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687478679, "uuid": "c7526456-acfc-44ea-869e-774754fd8429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478679, "uuid": "0fb67fae-eab8-40d8-a665-687adb9dd028", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e541d09f-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499444, "uuid": "7f4bdbed-d04f-4153-a468-f908401a7a04", "comment": "Malware payload (RedLineStealer)", "value": "33aaf1ebeb976f678bdc5325c2f694ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499444, "uuid": "94607451-f88c-4b05-b766-3b9dc508c1bc", "comment": "Malware payload (RedLineStealer)", "value": "667ea54c148754a8bbecf983fdc3b79deabd3123a341e2100bcfc88528e700c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499444, "uuid": "2d34def7-6950-4b4b-a3a1-ef0dc864bcf1", "comment": "Malware payload (RedLineStealer)", "value": "8c0af9006eb63078b981f0cd880eb2aa9d9ec1af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499444, "uuid": "8d46b822-fa0a-4396-86fd-36f2dfc46a75", "comment": "Malware payload (RedLineStealer)", "value": "23d03e104e917f2439f593bd67c2cbf799a47bb965fcd1a4afee4ea879fbfa016799b5330073ddec3891d4f7beb22fd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499444, "uuid": "4aa5c98b-8605-438b-89d1-2ac623ea88aa", "value": "T121B4F0CA24404973CE23CEF1D8DBE9DB4EBA21210B764BC7530E4AF54F455E4A64B63A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499444, "uuid": "89bf2b2b-8180-46b6-b66e-e2191c38f7c5", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499444, "uuid": "215b2dd0-db9b-456f-b53e-474ce82d5e06", "value": "12288:6gxtTXMTey5smYN4lKILxfCdVv4INbYm8ZOyH1Hs3kQJQmZ:6gxtTcTey5sbwLaLVYBZJsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499444, "uuid": "8d93d3dd-ef88-47ab-ba74-64b59d46704e", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499444, "uuid": "1c4e4b71-e4ca-4fc1-ad47-5b38d2e68550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499444, "uuid": "dca6ee2f-f718-4a73-8b06-de338c1952b6", "value": "33aaf1ebeb976f678bdc5325c2f694ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16957913-11d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1687530451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530451, "uuid": "3f456f4e-6879-4986-a533-10755ee49318", "comment": "Malware payload (RecordBreaker)", "value": "e3f6264aea5137c2e65b7d8d783be036", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530451, "uuid": "4b57ebc9-d1f3-4d7a-b87c-7594e9a261cf", "comment": "Malware payload (RecordBreaker)", "value": "66aba326f753f1d952e03cdae48806b64965572b400a9ad38da882d55515a2d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530451, "uuid": "06cf7504-0087-44f3-b9a6-7e01bb6bcfbc", "comment": "Malware payload (RecordBreaker)", "value": "bb4bbda5d2260d48941614b42f8f0cc911a6e444", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530451, "uuid": "576bccff-794d-4f6d-9137-b9f8d1de46b3", "comment": "Malware payload (RecordBreaker)", "value": "3ad51cd0be94c8732e02d5bbe0f85e53db2309e27c4f284babc83b5e25993271315c7de6f84dea4dbfdb181a981b29b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530451, "uuid": "3c74d4c2-3050-4e73-a68a-988feffeb3c8", "value": "T117343A1362E07D75E9264F738E2EC7E8760DF6508F5937EA2218AA1F08B01B2D273755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530451, "uuid": "2371411f-fecd-4205-bedc-65eb81caf78b", "value": "9a98e5a62eea7ca866a4d62b19532a13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530451, "uuid": "c323eb8f-dcf9-41c6-aebe-6f31f71eda95", "value": "3072:jAmX/joXL0K0ZzpFpRGNFlQ850uaGYJlYtP2zS5g1eCydFso7deM2H702:FX/yLMzpFpRGNMi0JGYJtN1eCACoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687530451, "uuid": "aa0e08b3-f8f9-45f1-b982-c312a28f1be0", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687530451, "uuid": "69f6091a-1210-43f6-82ed-8cb1c535e08c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530451, "uuid": "41e2405a-6434-40eb-9a48-a9b85a737fbd", "value": "e3f6264aea5137c2e65b7d8d783be036.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b8ae5a-11d1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687530146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530146, "uuid": "d3b54d44-e968-4e29-b254-fca0e42ae24f", "comment": "Malware payload (RedLineStealer)", "value": "5d6901646f8476b8cab79fc2c75c12c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530146, "uuid": "7bff3ab3-8ab5-4783-b36b-0e24c25c3f6f", "comment": "Malware payload (RedLineStealer)", "value": "66f882759c84ecbe2d523b5c997d354010f3a757a648dffbd9a2afb0a4bf1bbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530146, "uuid": "b112f1ae-8323-42dc-a604-d9f417a2bf29", "comment": "Malware payload (RedLineStealer)", "value": "a95b7ceb26061217709f4f822d36db98bd47dff9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530146, "uuid": "0548b015-f5e5-471f-b27c-85977280bb15", "comment": "Malware payload (RedLineStealer)", "value": "32774fe658c0b987f93d623324223bf29003ef76ab63e146d0de4e9681c472f1553a052f8ec19f47a9034095b24c290f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530146, "uuid": "4c9beb42-0aa7-43bb-b21c-cb667e0b2fc0", "value": "T1041612752240C6BBE3C32932E493900F0C1969726AEFB98977978DFA15635BCC4B4BD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530146, "uuid": "750106e2-b97c-460e-94d3-6b4c77bd5870", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530146, "uuid": "b01287d2-cb7a-4572-bdcb-b378e76e196b", "value": "98304:vyedkA71mn+c/n/FtjtZtqlyiDlv/8VcrB7Le713rPVH0jpZRLexpubxFcEB2KUm:LkAxmn+UHjtZtqbTLepPVUjl2ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687530146, "uuid": "6aabaae8-8cd4-4e46-8921-2842eef8d040", "value": 4103680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687530146, "uuid": "96d84ed2-37f8-4c79-9b07-f74f83b5250f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530146, "uuid": "83826e27-5c99-42ee-99a2-c57e59619730", "value": "5d6901646f8476b8cab79fc2c75c12c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e72f009-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687501285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501285, "uuid": "ef1c265d-e94e-405c-9c9f-e38ac2504c73", "comment": "Malware payload (Amadey)", "value": "dda3f111249ce08b2a50334cbdca9e4d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501285, "uuid": "3f8bd9da-1d86-4ab6-b905-7dc13045e290", "comment": "Malware payload (Amadey)", "value": "679646680d29885aa3c3701be32b4b28e4539af294efeb2bc6ba03c5ee37b6fb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501285, "uuid": "d7be6b19-fd2c-4396-a7ff-66238a63efad", "comment": "Malware payload (Amadey)", "value": "158771b57477300ba39c4cb71019b22a08bccd47", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501285, "uuid": "bb746a0e-30bd-47e3-aabd-f39bee314d66", "comment": "Malware payload (Amadey)", "value": "99515b1c357b4aeddda8cc645b6d0db9add579a828d44e4d541297dcbb3d2211e2b141ec3fe820bd095b67bceb84d954", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501285, "uuid": "1fb130b1-ad54-4fb1-8285-9f2d5950f185", "value": "T170B4F1CA25408973DF33C9B1D0EFEAD64FB9716007754BCB120D4AF68A522D4E21B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501285, "uuid": "c996312c-625c-4df2-a48e-915bc30a3ed0", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501285, "uuid": "f707acf7-ddd7-4d15-affc-df3ab0ff86d8", "value": "12288:daU+D4Tey5sMGFNXiEMdGjmew/xyvF3xh2JUAJzzi5RjaQJQmZ:daU+0Tey5sMGFHMCw/xy93/o8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501285, "uuid": "1b331286-3d5b-44e6-8bdf-19526f4ddb42", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501285, "uuid": "1ccb494e-d116-4b61-aced-2c3c68bf8e61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501285, "uuid": "6df6aaf3-fee7-443b-b0b4-0bdc2a12f783", "value": "dda3f111249ce08b2a50334cbdca9e4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6cde70-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499131, "uuid": "41be4255-231b-4580-9c16-41789d648d29", "comment": "Malware payload (RedLineStealer)", "value": "17e98b7b001cc2c1ae1671c84367be86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499131, "uuid": "e37d6ac8-5df9-4227-aeda-e128ff302f6b", "comment": "Malware payload (RedLineStealer)", "value": "68769184a1b357fa76ac2d0c52919f49f05be7520a5dece41e2052262e1aedac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499131, "uuid": "0d8c71a8-380f-454e-8e12-0e6b8ef62365", "comment": "Malware payload (RedLineStealer)", "value": "a39798a1572da4ee830db1909821898c0a7a6b24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499131, "uuid": "6fb595ad-ba41-45b5-be84-d2d997eb57fb", "comment": "Malware payload (RedLineStealer)", "value": "e1ab76bb5d025f517d3116beeab8b265150fe0ba72f365d4cdfbf1d6591b1f859325c37d11b39d63ebe29ee900f71117", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499131, "uuid": "2feb37a3-2447-4666-bc81-9ade80378c4a", "value": "T172B401CA21808573CF63CEF2D4EFE9D24E7A71220B614BC7130D4AF58E155E4A61B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499131, "uuid": "0913a87e-1bc7-4573-9b1a-5744805a297a", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499131, "uuid": "d9126210-18a4-4040-9fb7-7f03ab300de5", "value": "12288:8EFdfTey5sL2Q3QG29eM5EB1uMZUjkOHQJQmZ:8EFlTey5siQ3QG1MmBIjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499131, "uuid": "5fbe7b78-8aa0-41d1-be0c-34f7db1c4714", "value": 530752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499131, "uuid": "ad247ee1-4779-4aed-9615-2008dc7c78f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499131, "uuid": "f922ea8d-f23e-4074-a113-e8d6a9a27240", "value": "17e98b7b001cc2c1ae1671c84367be86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e08a4e5-11ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687520343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520343, "uuid": "4a9c79e4-ff0b-40c4-a347-54b8b3353f4e", "comment": "Malware payload (Loki)", "value": "c3868ab4795acf609b16f0af1ee3ffc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520343, "uuid": "c0758d17-6cff-4e62-a4db-6b38a6081d4f", "comment": "Malware payload (Loki)", "value": "68ab80bfd012b6e3080ba58bc8cf5edf14a5a384520576177349a6dd17876303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520343, "uuid": "b83073d8-4268-4d6d-9ed6-ba50bd435ab5", "comment": "Malware payload (Loki)", "value": "5ccd1872d287a26925a2bc6083556cd50275f864", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520343, "uuid": "0dab1e6b-184a-4fbc-9851-3c24677f9509", "comment": "Malware payload (Loki)", "value": "172f12d6dff750dc99c8ba4fd8f6e6e8d4eeb91b8822e2ecd78bd7f1800529994d27c23adf022e3f305f2aa6b8bfca84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520343, "uuid": "e202b440-63dd-47d5-8524-daddfadc6d26", "value": "T181B4233A23545F26E2E45B754D97020013766250AA27EBADCFFF38D71AA7B014F026E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520343, "uuid": "f2038c07-d1b7-4022-8406-7dbc4cf2cf14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520343, "uuid": "6cb07e89-8364-49ca-9e93-ccc0223ef358", "value": "12288:hk54/mNUALj/+3C904eTtB3QHjfR8XDGAleH+YQMXf:hk54/QUI//04eTtB3QH18zFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520343, "uuid": "450d6b4a-c65a-44ad-8cbe-c18faef38a86", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520343, "uuid": "263993b8-f953-461c-8b5f-ff256fbb3c77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520343, "uuid": "c7b00ee5-f748-40bc-b5f4-84ca078c8aa7", "value": "UPS#1Z31136W7049359223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a5a9e6-11cb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687527742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527742, "uuid": "c82665ec-ed88-4fa6-88bc-27b94f45e3b8", "comment": "Malware payload (RedLineStealer)", "value": "856d9af47ae83154622d04a622a45809", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527742, "uuid": "05171899-ef02-45c9-b696-52b978dad1ec", "comment": "Malware payload (RedLineStealer)", "value": "69217e2b910a67bc3e7ed65c17c7680ea4481db0ae1df30dbe46dc610b9535ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527742, "uuid": "6e2fcb4d-2574-4846-b5b2-826a1481ce93", "comment": "Malware payload (RedLineStealer)", "value": "07f30deb162eb1517fcd5aa7a7846e8cf3c68c8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527742, "uuid": "30d11293-70da-47de-93d1-1bec0e4462f8", "comment": "Malware payload (RedLineStealer)", "value": "926fc69b273fe268a1315136fbcddc62bc73ab13a6898bcf74336b15ab4803ededd813e01b8d5ba44f3a26f5cebb72e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527742, "uuid": "b80c767c-c1f3-4bb6-bb10-4437344edc59", "value": "T1741612386540D63BD7CB2971E843945F4C2A20B16ADF79893383CDF60A636BCC979B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527742, "uuid": "56931e9d-bffd-45e1-9842-7fc409c0357e", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527742, "uuid": "aa45e501-e8f4-4017-b715-d73de5238ce6", "value": "98304:w91RAenQ3w/00+y/kmd6J/eMBQegPhbqfG04XzNXtVycwwqkg21mVWbaT3wo1uhK:kAenQg/00B36J/eM7g02zNXVL+WbaE0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687527742, "uuid": "cfcfb886-1fec-4283-884c-bd750f38841a", "value": 4168192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687527742, "uuid": "a62b7c61-4f2a-40f9-a6a2-91369f82a6a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527742, "uuid": "d1c9617a-bcb3-4cc8-be99-7934a350f9f2", "value": "856d9af47ae83154622d04a622a45809.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c20f6d6-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687510328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510328, "uuid": "4bd4bcf6-bb01-4507-b6f4-92dabd1eff4a", "comment": "Malware payload (Amadey)", "value": "f343580ce07925333f9b4019cbf435c2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510328, "uuid": "2576340e-6f74-43e1-badd-012d7a30537a", "comment": "Malware payload (Amadey)", "value": "6a6818e43858772b6a02c2055acf8ccd1ccb0f036613731197d4548cb024c222", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510328, "uuid": "c9a2652a-f50d-402d-8195-022fa99405d6", "comment": "Malware payload (Amadey)", "value": "8a1fc73eec6bd87617eeb9cce6239b2c88ce88fd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510328, "uuid": "c00be872-cdfe-4687-809d-0e1e05e9e5a2", "comment": "Malware payload (Amadey)", "value": "705e0dd2e6f8630a092ebc5b35fd933fefe529d2340bac82b3b689b9518d6d96583ce906ddb82af2c4adf00caedb412f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510328, "uuid": "2af5323f-0b4b-441a-a190-2184c78fa257", "value": "T1A4E402CA66404933CE73CDF1C4EFE9D65E7A702107724BC7220D85F98E462D4A61B9BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510328, "uuid": "d7bbd27a-bf37-4db7-9649-0abf06a43b62", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510328, "uuid": "9703d0e3-6fe0-4c42-a639-8a4406c849c2", "value": "12288:j0UIcTey5sS8TuAa22eA14D3rLr23wBZqL33D107GBb4R8fQJQmZ:j0UdTey5sSuuAa22X4DUL3JnBb43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510328, "uuid": "c2d600b8-4cb2-4340-a970-b21deb9f0aaf", "value": 715072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510328, "uuid": "1d72303d-4a56-47eb-b74d-4b59dae40251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510328, "uuid": "21bfb431-fa89-499d-8d7c-44a9c6b7bb94", "value": "f343580ce07925333f9b4019cbf435c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe754f5-11e2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687537661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687537661, "uuid": "c295ef4b-0abf-4891-95d8-0e0803899244", "comment": "Malware payload (Amadey)", "value": "652b98fe79b1443d1d1c1634183d4529", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687537661, "uuid": "77f6b5d8-bb44-496c-9169-0bb8ea5f855f", "comment": "Malware payload (Amadey)", "value": "6afecad578bafc4d97482c1217dc59d39dad36110b12fcdc197da5eb614793c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687537661, "uuid": "829ec0bd-4a04-4b54-bc92-f1bd929ae70c", "comment": "Malware payload (Amadey)", "value": "f507bbdaed8bde9deeb63b783ecb3bb66c029afb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687537661, "uuid": "92cf9742-a4a8-4f96-a6e4-715e5f0e352f", "comment": "Malware payload (Amadey)", "value": "331f8431306cb9ed552e70f2b08e4238c019e0e81622dfdccd89f39793b8551cfbec51a90f9da516fcdd9805dac38447", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687537661, "uuid": "6c8f7714-6c77-4961-9818-5c63c2103209", "value": "T13606127A2A41D233EBC32A71C15391AF480D62701A8FBC893FA71CAB99671BDD0757C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687537661, "uuid": "7bd0e64b-b1e8-4457-849c-50b79e3ec3b3", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687537661, "uuid": "4f0dc4e6-e1c7-40c1-80ac-1b158584b4e1", "value": "98304:1Wf4N7AE+4D5ga66zgG4JIHmwlDYDwWd0Kk77EXdGXSzxmCWqMzel/WaqOxsNxPO:0f4ngt6zgnJmNQwWd0KkDilvqOxsNxPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687537661, "uuid": "2adaa548-7f67-4c0c-a0eb-fea5af524f2b", "value": 3803136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687537661, "uuid": "832d10ad-4165-4b96-a849-70f632dfa58e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687537661, "uuid": "8ce11778-7951-46be-aec4-b041acf5b9ec", "value": "6afecad578bafc4d97482c1217dc59d39dad36110b12f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ff7eb6-11fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687548004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548004, "uuid": "a1a8d71d-e3b2-435d-bc1b-bcce0994fba8", "comment": "Malware payload", "value": "cb831d1b12476282cccc07a1da49361e", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548004, "uuid": "0b8b146d-8aa3-46b1-9ef3-895ae5cc80c8", "comment": "Malware payload", "value": "6b2bf6e4a38ab7a141c99183426f7b7e4a8690a2102d2b02910c5fdbf0d3f110", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548004, "uuid": "d3fe30aa-3f17-4308-a9e7-d65511014237", "comment": "Malware payload", "value": "abb0d551f79a0da9f265c29b9e2a39cb8df9a043", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548004, "uuid": "b42c285c-c3c9-4b43-b56b-7be21bfd8811", "comment": "Malware payload", "value": "a013ca04d60b4fed4c941562af15ef7ad16cac19e7dc544e9106379f029137dfb09652e4fbb482f3095f294314d20da5", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548004, "uuid": "2433e54b-4ef5-47ca-a988-3d1766e129db", "value": "T17E831743BA668265DD090336C6AF9712DBE0F642F173D64E35883F633B1B3C6964648B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548004, "uuid": "dd9fbaeb-3e48-407b-b518-8c605a94be0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548004, "uuid": "7a761379-31e0-4e64-b662-240350a954bb", "value": "1536:a1Y8J8yOoXj+nKN+3+cGGGGGGGGHGGGGGGGGGGGGGGGGGGGGGGGGGGGGq4Xb3cvy:qn1SKN+3+cGGGGGGGGHGGGGGGGGGGGG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687548004, "uuid": "87fec233-f2a0-420a-b449-16dde7ebc8c2", "value": 87552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687548004, "uuid": "84418b56-e399-4488-8e6c-fa500a320695", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548004, "uuid": "80e79049-445e-4231-9343-7064f276ec79", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4136ed98-11ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687520215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520215, "uuid": "5cfc0635-327c-4b13-bacf-3a94cf652bf3", "comment": "Malware payload (SnakeKeylogger)", "value": "93e007016515135b82db2b4c874167d3", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520215, "uuid": "8aa19853-8487-4684-b9bd-c4b835e57da8", "comment": "Malware payload (SnakeKeylogger)", "value": "6c232f8bc7a3cd70f69cfd297b3144ae2eb082f021e5f0093298809b027d43e6", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520215, "uuid": "796113de-5984-44ae-a7bf-8b674b62b83f", "comment": "Malware payload (SnakeKeylogger)", "value": "3c92dc7f262b8261e25580397038b1704d8c3309", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520215, "uuid": "84729f77-d29f-4f70-a9b7-9c086c170834", "comment": "Malware payload (SnakeKeylogger)", "value": "48deaa27bac546e2fb936546c6ccb85e1bf981f575baeb389d20ff0ecdbe687d402002b8007a64d66506f976ef3d29a3", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520215, "uuid": "cbb65981-e6ef-4037-bc6e-129712bf45b8", "value": "T12635AE4061DD9FE4E47A8BF50D60727457B62E6AA43EEE090EC2B1DA2570F0149B2F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520215, "uuid": "63e4df90-dd66-4668-83c8-895f91e6a5ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520215, "uuid": "25b4ce86-3f4a-4c54-9b27-17d5744d392e", "value": "24576:77MyuyF1/65JwJ1KNohUNMbh2qVMgc7pWIfDys:77MyuyTYmJ1KNoQIh2Vgc7pvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520215, "uuid": "c0f98fa7-d01b-499e-b08d-ba568c31e3bf", "value": 1071104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520215, "uuid": "fa727307-1d61-475c-9518-c3b13b3fe5fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520215, "uuid": "d95591d5-40f3-4a3a-a45b-a1e9377f2788", "value": "AWB728590890733.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e2641e-11c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687524739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524739, "uuid": "20a12bd5-2651-4afc-9664-3c20c2606dcd", "comment": "Malware payload (Amadey)", "value": "0612c36820a226cbb3d3544bdeb3ccb0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524739, "uuid": "472b7989-020f-46aa-acf8-8a871d8a3c49", "comment": "Malware payload (Amadey)", "value": "6c5dd777658f1b6a4e0818d430f0ae1a100defc876ce3d61dd6a9bb682bd8b11", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524739, "uuid": "42fff7d4-6790-411e-8218-34e9843e5b8e", "comment": "Malware payload (Amadey)", "value": "430d7328c192810853310a55638e37998bd68c72", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524739, "uuid": "22f272a4-a70c-4ea4-aedc-4158f74b33be", "comment": "Malware payload (Amadey)", "value": "aef12f3e97968cdfe87869135e253201ba7aa35cf211d823193d5910490efb530e83f4253df09d67697da63cfd9ba94c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524739, "uuid": "7116d235-aa85-4b79-8efa-6f70f739f78b", "value": "T1D3B4F1CA69404863DF73CEB2D4EFA9DB4E7AB1210B7447C7020D89F58E425D4E61B93A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524739, "uuid": "c4c8a4ea-9bb4-453e-bb46-26d1d53d361c", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524739, "uuid": "8224c373-4093-43a9-a0f5-e66ca9310c86", "value": "12288:cBVctTey5s6qXJl3UCaxAaQs4VVz8peQJQmZ:cBVsTey5s6dCbVz8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687524739, "uuid": "ea385f1f-ec9e-4f20-8547-129686bac340", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687524739, "uuid": "03dba36f-a636-49bb-a04d-a4f6a8f6e872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524739, "uuid": "4d262992-4d14-4fb9-b274-9e451514b60d", "value": "0612c36820a226cbb3d3544bdeb3ccb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d2b816-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500382, "uuid": "4adfb4dc-1b58-4ea0-9c08-033691eb51e5", "comment": "Malware payload (RedLineStealer)", "value": "9e8646f416f8b9579de7f3131e5723bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500382, "uuid": "25f89538-ae61-4a5f-af98-1ade46981a82", "comment": "Malware payload (RedLineStealer)", "value": "6c78c0c8ffbbde532a6f2bce65a2b0050be35528e6a9af645726ac63dd654fa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500382, "uuid": "a162151c-0646-45d4-9ba3-a872447ce776", "comment": "Malware payload (RedLineStealer)", "value": "40c3ba6122f57104c0b19e45b76f3487be0d37f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500382, "uuid": "25bcd8e6-1796-46b4-a6dd-75f6d306f76b", "comment": "Malware payload (RedLineStealer)", "value": "951ace2a0ae6deae2d947698945074e8d47516d2a0de91ed9c32e79b5c2e6fa3dbbe235bc7547bbe58584d2322db426c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500382, "uuid": "e783930f-a60d-49f8-8b3a-50c6f4f7522f", "value": "T194E402CA62404473CF27DEB2C4EBE9E64F7AB1210B714B87120D46F58E466E4E51B93E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500382, "uuid": "96571823-1952-415d-8eed-b7e241d146dd", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500382, "uuid": "e1e3dbc4-3b2f-445d-82a7-86b003cf97e5", "value": "12288:ReYdaTey5ssD+a87LPlSMDYYOVUgQz+iTswXTnbm09KJmZ8lsrJfgaQJQmZ:ReYUTey5sva8XlS5YLzhTnbmSKc86rU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500382, "uuid": "e624c90b-447a-4533-8b51-2a3e09b6286f", "value": 715584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500382, "uuid": "25680a63-c1ae-4ac2-a819-2df648bb209c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500382, "uuid": "25d1912c-1b3f-4942-870f-ca822b07f1fe", "value": "9e8646f416f8b9579de7f3131e5723bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f95e8d3-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500992, "uuid": "b4bbeff2-0554-4887-a9f9-136ed2c02f90", "comment": "Malware payload (Amadey)", "value": "ca6bbe7df576f1c57cc7df0065c7cd3f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500992, "uuid": "6b93e0f6-6094-41eb-8f28-4e2f42f4b192", "comment": "Malware payload (Amadey)", "value": "6d0dad3c452f4775051fe34bc2e0c387657fec17ba8da2785ac5ee09cf6ee542", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500992, "uuid": "3bf43137-c425-4b80-83c7-3b29fc108aa4", "comment": "Malware payload (Amadey)", "value": "09fd339984bf4d98a851ba45b49998bebcff4f38", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500992, "uuid": "584d641b-8879-4566-aa68-6781f2c8d408", "comment": "Malware payload (Amadey)", "value": "f287efe6d7d87dad99fe6155aa5b25a44ebc117271456dd3313e9fd0e1a352a3bf865bf3bb2774215f10c39ca108e920", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500992, "uuid": "161c4d58-cb5a-44e2-89db-310cfd6c0a97", "value": "T17FB4F1CA25404533CF27CDF2E4EFE9D64AB9712007624BC7130C9AFA5E456E4A21B97E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500992, "uuid": "60f3a187-809c-490e-89b6-8f3cef7bec3b", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500992, "uuid": "bd19378f-5435-43fd-9f7a-803c9d6c91fe", "value": "12288:xEF2tTey5sD+r9eXheExT2MCoxI272hSIjDQJQmZ:xEFqTey5sDqlExKixIHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500992, "uuid": "eaf07d4e-c9d5-4ae4-a7a4-daaf2b4b6c75", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500992, "uuid": "98b3772e-2cf3-49b9-a0be-f6fc3329ba5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500992, "uuid": "211c90c2-fcfa-4fc1-ab2b-cc3e6d4d673a", "value": "ca6bbe7df576f1c57cc7df0065c7cd3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ac8fb4-11d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687530750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530750, "uuid": "d505a669-c21d-421f-99c8-b1714f782876", "comment": "Malware payload (RedLineStealer)", "value": "f2a5c8c75723a3e9c1c483ee87265b10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530750, "uuid": "81e46b56-fb3f-4b52-b4dd-7b8224fb75c2", "comment": "Malware payload (RedLineStealer)", "value": "6de168d940cec462cc2cdead5a06a3b77a533558deb22bb4c0138ccb20f85f51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530750, "uuid": "986cb785-3ad9-455f-98ea-3f7db9d95b5f", "comment": "Malware payload (RedLineStealer)", "value": "74a1755ce1843b54817f3e9d15b26c2090c6c902", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530750, "uuid": "f2f13315-80a1-4046-85ca-21d9c54b2f5a", "comment": "Malware payload (RedLineStealer)", "value": "5190d64771b5a8acd69644bfddba1ea2251c191b85b507918fd608c0d8ee0ca7610a577e7153656141b86baec7ee0e20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530750, "uuid": "17194cc7-d1e3-4d37-8a1e-9f0f9772dd03", "value": "T1B60612392A00E673D7DB2575D1AB924F084CAAB15A5FBC4A7F670C278AA34ECC4347C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530750, "uuid": "93fc41c1-2897-44a2-b479-895778db321a", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530750, "uuid": "8a8e4f11-b25d-4c5e-bea3-ab49125b87f1", "value": "98304:s7fnE/c3LG4Y1wkeihJXFNKv2d0gVCu8ojhGKzCJ5u/8tOBC3ZoKLxwhJ:mfmSXY1w90JXFNKvg3bhGCCJ5u/8dSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687530750, "uuid": "5c28e92a-93b2-4b6d-8ad0-bf9209976211", "value": 3781120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687530750, "uuid": "c077543f-de45-45eb-a826-eb381a34c23e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530750, "uuid": "eb31f424-0af3-4f46-b398-ba196dfdf188", "value": "f2a5c8c75723a3e9c1c483ee87265b10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155aec63-1200-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687550206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550206, "uuid": "d89edc8c-5310-48c1-927d-72d394f256e4", "comment": "Malware payload (Gafgyt)", "value": "87d16a3a0a48f753fa1eecdf688b1697", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550206, "uuid": "7afe9ccd-31bf-47b0-a837-d8b62e4abce7", "comment": "Malware payload (Gafgyt)", "value": "6df52e217a4ce05824396d220e8d5037192ec8347e62cb88fbcdfa6ba2344c18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550206, "uuid": "4af2c020-635f-42cc-9643-32035a180d41", "comment": "Malware payload (Gafgyt)", "value": "8a1a39058362a06b30d873c2f99d33651316dc4b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550206, "uuid": "23407927-a264-4688-ab6e-7dd418914e86", "comment": "Malware payload (Gafgyt)", "value": "4d456e997f60df077396f864103ee6ffc29eef631589f088465df752ed6489d3132373a5333ff62779d2b21de36c43a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550206, "uuid": "962c2660-28d5-4d52-a8ba-60310f3d8aa1", "value": "T132C30A45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550206, "uuid": "d5876161-1124-409a-9f2a-298780987eb0", "value": "3072:hQrFRNfuLrGhEPOD0xg3gNlmBoHQuQekQnYW:IFzuaEGQxg3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687550206, "uuid": "de416c8c-4537-42a2-a67f-be5b5bd3e267", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687550206, "uuid": "a6abf7fc-5802-40e3-968e-efb2d1d48a30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550206, "uuid": "b9a371ff-85ce-4cfa-b511-0427049d9541", "value": "87d16a3a0a48f753fa1eecdf688b1697", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9522b41-11e4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687538562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687538562, "uuid": "dbe826f8-c39e-4688-833e-695ad2cf946a", "comment": "Malware payload (Amadey)", "value": "d9ad2996021f2d167b160107b9f2d578", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687538562, "uuid": "0b8270f2-01cc-4d63-8f20-f253984fb74a", "comment": "Malware payload (Amadey)", "value": "6e39ce8777ba1197f8a1f1a6d6ded0038a3b5eb6a4cd59a5bdd523eb000b6955", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687538562, "uuid": "59e0237e-8eab-45a1-9f9d-1591692162b6", "comment": "Malware payload (Amadey)", "value": "7f734529f4cf831f623ab960da54932be2355a28", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687538562, "uuid": "2799671b-85c4-4f24-98ef-7cb16eb2150b", "comment": "Malware payload (Amadey)", "value": "f57b9590f673da798df9c6064627066ba188fb1fc07b03b1b900476bef72d619ea186ac7f365b561c644e783f22ba3b3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687538562, "uuid": "f9f050c2-900f-46ad-8ddb-a06d7ee55a5a", "value": "T10B3622392648CD73E7DB26B0C093852FC9192A7195DFB88EA7731DEE39679BDC021604", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687538562, "uuid": "7abff6d6-10f4-4b0a-b7a6-1a10dd6c0d64", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687538562, "uuid": "37b99771-0d36-4f01-8e5f-285db2486bb7", "value": "98304:Xx+tWRMQX9tViV0XyH5UhDXNfQZ82JLFvFAOSbqNCc8UrbUd80Jq1gkpRaVOyZik:MsRNa0XyHYCZPtAOSONCJUr70H6R8OKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687538562, "uuid": "3fc9c9f5-5f34-429d-98b0-be8c1a508bd9", "value": 5175296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687538562, "uuid": "50cb0756-6bf2-4ffc-a5a8-1381017dd645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687538562, "uuid": "cf5edc12-5de3-4416-95e8-3568c2772cce", "value": "d9ad2996021f2d167b160107b9f2d578.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92895e9-1194-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687504202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504202, "uuid": "f2b05da9-a073-45ab-a24f-fed8971b7a20", "comment": "Malware payload (AgentTesla)", "value": "2ecb63642970c6bb5b7e612b0cacdb9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504202, "uuid": "f8ccd4c3-2b78-474e-924e-30e61a29a74f", "comment": "Malware payload (AgentTesla)", "value": "6e4d94a8cbae20e551bd82c5663b5da3efdc5acaf22c765d21b392da761d5678", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504202, "uuid": "7a1d2d6d-a306-4d87-806f-da73fb068448", "comment": "Malware payload (AgentTesla)", "value": "ea563d43c95aa93536b23e3282086d340f21f6bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504202, "uuid": "73c78161-d832-4c75-8338-333be31be516", "comment": "Malware payload (AgentTesla)", "value": "2880396947acd386219bd0c4f7df2a3d46d66cb8525cb3c8f3373749f9a1eea86d2eba69daa4163bc5018cea7cfef5ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504202, "uuid": "fba4ec21-d4c6-4e70-9d00-c432f74ceda9", "value": "T115F4230C7F2C68E867E7BDE68054612359EEE6A1882947FB79D311CB169736E0490AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504202, "uuid": "f611e620-627e-4e6a-93d8-ba43c774f49f", "value": "24576:InmCN0NlG/xiZ73K+4MbPwl1IlqOHDvcNP:ImJNluxU76+Z0IlhjvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687504202, "uuid": "ba31af38-c518-498d-a138-adffb1514e8a", "value": 786946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687504202, "uuid": "4f23159a-727e-46df-beab-4a4563cec925", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504202, "uuid": "9de0cd72-4d29-4a5c-8beb-e9afbd89636a", "value": "QUOTATION 9982_pdf.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b39bbbf-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501280, "uuid": "a2905df3-4495-457c-b126-5a38419ab45b", "comment": "Malware payload (RedLineStealer)", "value": "d9fb1f0542234b591e0c810a5ae3dcd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501280, "uuid": "19b9cda8-183b-4fa9-87e0-f9e66494050b", "comment": "Malware payload (RedLineStealer)", "value": "6f1798bcda4b1e5caf1939a6d5f63c8c684849781d0e4afe53123dfc25c73ddd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501280, "uuid": "ad022a1c-82b4-4507-9cac-edd8be9265cc", "comment": "Malware payload (RedLineStealer)", "value": "6a83a73dc247763faa44b68e2f709afc756b8b15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501280, "uuid": "23a434df-8729-40cd-a702-e2693d25d092", "comment": "Malware payload (RedLineStealer)", "value": "b23ff4f05aa48d5d26c668a7704cc48fcdc23cbd4b594f270da7f2f2182c25a4abd5b6826b9e9db2d75ebe9ee940ffbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501280, "uuid": "abb0e0b0-1095-40af-92e5-fcd9ea9d8e3b", "value": "T161B4F1CA25804973CF77CDB2D4EFE8A60E7A712147614BC7120C8AF54E451E8E62F97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501280, "uuid": "6f0571bd-63a8-4a35-8f61-b3b7191a1dd7", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501280, "uuid": "ca2ba098-0a2a-47a7-a2cc-e985ff98d232", "value": "12288:pacLzTey5st6OPpGwLCtuUCKP/Q08bVQrncyPbQJQmZ:pac3Tey5szpGHkUCKP/Q0EIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501280, "uuid": "cf15dfd1-43cf-4373-8fdc-0396a14848c6", "value": 543040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501280, "uuid": "d1332d1c-327a-4666-b4ea-5ae574a15bd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501280, "uuid": "6901057c-68a5-41ff-8028-c9722c87448d", "value": "d9fb1f0542234b591e0c810a5ae3dcd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a835755f-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499772, "uuid": "994afc09-a272-4b4c-8455-c2d0bbc98eaa", "comment": "Malware payload (RedLineStealer)", "value": "468f3fcdf6e4c296073ec9f6c9398568", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499772, "uuid": "6227fd02-2b54-4a10-bdba-c7bbd4202554", "comment": "Malware payload (RedLineStealer)", "value": "6f1ca76d16cf50b6fcf6ce1cff5e3541a6594d8744ffa912bfe1528adc65ab1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499772, "uuid": "2df20953-bc09-42c2-a2f3-f19a65ceabfe", "comment": "Malware payload (RedLineStealer)", "value": "48e83a9439929f1bf20e517baf1e9b79986cd769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499772, "uuid": "a8bd13b8-5088-4504-baf8-ed1f1d4b684b", "comment": "Malware payload (RedLineStealer)", "value": "50fab27e01dca07311b2c554e3c677a63da87f4ca337f809a1a674e3daea2f90c57f6a2b8f03b15790cff74cd4128f19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499772, "uuid": "f6ebb10d-d58b-4d8b-a767-6e36d92b5b4a", "value": "T156B4F1CA29404973CF23CDB2D4AFEDD74EB971210B728BC7120C49F69E455E4A61B87A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499772, "uuid": "3e18a825-3a9f-4849-8d6f-9642d0bf904d", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499772, "uuid": "115d2091-38ef-4550-83fb-2bf24f665bdd", "value": "12288:3nE9mC7Tey5srznwSHmLNkaB1yIvhM4nmyXQJQmZ:3E9moTey5srlHvaB1yIv+4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499772, "uuid": "db8de4ca-f92a-4565-ab6b-c083d1482fad", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499772, "uuid": "6299a6d7-881c-41a1-936f-5ff9e76167dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499772, "uuid": "b8ec12d2-d464-488d-bf92-b4eeb0776b69", "value": "468f3fcdf6e4c296073ec9f6c9398568.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5cf474-1190-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687502300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502300, "uuid": "6e934c37-d28d-4c51-be52-6de538c72914", "comment": "Malware payload (AgentTesla)", "value": "dcc2ff41a87fd260e174e4d0130d482c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "sarahfoils-com", "colour": "#A5BFA1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502300, "uuid": "7ad46f0a-434b-4897-a997-3144a9d39fdc", "comment": "Malware payload (AgentTesla)", "value": "6f9a62dffc256543dc81c132c72806c55d91a9e61274266340beafea394fd008", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "sarahfoils-com", "colour": "#A5BFA1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502300, "uuid": "4d1ff2d9-3440-4045-9ccd-6dafa97c1518", "comment": "Malware payload (AgentTesla)", "value": "e19f2981ccb557573e8a0e3446ab4aea6831952e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "sarahfoils-com", "colour": "#A5BFA1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502300, "uuid": "a001b0d4-c631-4696-88de-3821e481d0ad", "comment": "Malware payload (AgentTesla)", "value": "3f39d65c460c6ffd5248e53bf66b7a5a70a01318dfd4522abd851ad97fd398117f8ace89ff6caa38b945c0cd9a29155e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "sarahfoils-com", "colour": "#A5BFA1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502300, "uuid": "503b116c-01e1-41f8-aed2-12014467ba85", "value": "T19205238941507D2587959AC2EA9B31F7CBE87E3F39A78A0D00CFDF04F8E6C19C065999", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502300, "uuid": "649a013e-aebb-4d05-bf16-bcde1d80b62d", "value": "24576:qn/flsYDdRHdis98Mr5YdDxcrl1VMZaEKspI4dUk:M/uCRHd9frl8ZaEfd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687502300, "uuid": "c117c6f6-1d6d-412c-9dc7-19f4a9d455f5", "value": 810036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687502300, "uuid": "3ec43dcc-b194-4b8c-ad39-3b3b0415fac3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502300, "uuid": "c3b9eab8-8bd5-4c2c-8e88-b169c10a496b", "value": "CTM REQUEST BIRTHSHIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a4d44c-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500680, "uuid": "6177f34a-fa3b-4072-852e-6e7b0e3d42bb", "comment": "Malware payload (RedLineStealer)", "value": "a88465b14b89db7070d65fbc0bb321f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500680, "uuid": "58967cb8-053b-498a-b3a3-818296a4fe4a", "comment": "Malware payload (RedLineStealer)", "value": "70f01489d075e73b0dc3b738f29df838092b0b95881d06c5428f3313d7a9eac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500680, "uuid": "6c7eeaef-a471-43b6-b6e5-85e8ef30fdc0", "comment": "Malware payload (RedLineStealer)", "value": "de2c43212d206249dc77055871d16d03d40d88fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500680, "uuid": "848daf8b-db6a-4f87-948f-a949d2a61ba7", "comment": "Malware payload (RedLineStealer)", "value": "b84c7027fc98e31de00efbcfb8276b5dd29424d6d42c172fa17a4c0d1862457955bc7282e5b84fba802ac21156d4a7e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500680, "uuid": "c66cdcbb-73ca-4970-9a2a-60de06e779ab", "value": "T1A8B401CA314045B3CF73DAB1E4AFE9978F7A71220B604BC7125D4AF68E412D4A60B57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500680, "uuid": "e96f90e2-dc35-4a4e-91d3-69bfe4b81706", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500680, "uuid": "d7c84641-90d6-4ec2-9df3-609d9567c671", "value": "12288:b0uebRTey5sbvIFNzVLpLDFcwGnGNOQJQmZ:b0uGTey5sbgNzVNLdGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500680, "uuid": "80b32578-c7bb-40f6-bc0e-f6f9a362ce7d", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500680, "uuid": "8b3ec354-3588-4502-93c2-143d31b3bbc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500680, "uuid": "74939eca-b863-4ed1-8bb3-3cc7136329ed", "value": "a88465b14b89db7070d65fbc0bb321f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968f72dc-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499742, "uuid": "17bb05cd-b7de-4cec-910c-694c45a10324", "comment": "Malware payload (RedLineStealer)", "value": "33d47b01520152137db0c2480b0f5bf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499742, "uuid": "59f5bd4c-e957-433a-9d8a-323c17b9e26d", "comment": "Malware payload (RedLineStealer)", "value": "711aebc93869a3baf4c15d7c72aa4d81d5dfda4d20ed260f8c3b5a454b7a2a16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499742, "uuid": "faed0f5e-0e6f-4820-a4ab-d36b7e0602a0", "comment": "Malware payload (RedLineStealer)", "value": "bb0a9b6972c7b89009032c61cfa241de09f0ca61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499742, "uuid": "be0f2b1d-e3b1-4b33-a63b-14fcc0ca7fc8", "comment": "Malware payload (RedLineStealer)", "value": "1a3038c99b737ca9909a0c887346810d4ed182de8ebb1bafd8b4ce8bb91794a7503d290405eacd08b1030e8ebc7d950c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499742, "uuid": "2b1be052-403c-41e2-8785-899290547c33", "value": "T136444CFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA284CA19BA0952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499742, "uuid": "561fb5fa-861c-4ed9-8177-d990b8aee0d4", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499742, "uuid": "3b883a37-2962-4af9-a1a4-381165e5e803", "value": "6144:P+chaigt0poiRG/XvLNUgYhuE22JQJQmb:P+cfgtAoiRG/fSvBQJQmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499742, "uuid": "37e93d4c-361b-4c9a-be2a-d088f123ef95", "value": 275777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499742, "uuid": "26f3df3a-8716-4e84-b156-f10a9a2ee52e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499742, "uuid": "51a22869-4b93-4d00-b873-02ea7066edb0", "value": "33d47b01520152137db0c2480b0f5bf7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1033394-1159-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687478848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478848, "uuid": "a0e1c16b-8fd3-4322-84c7-5c756c4f24c2", "comment": "Malware payload (RedLineStealer)", "value": "b59a17b5240bd301839b9b276bb9d50f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478848, "uuid": "d80e306e-3e46-4b61-b936-c7946ff30459", "comment": "Malware payload (RedLineStealer)", "value": "715e315b101158ace555541c9f760c4dbc33f0142920ac816eecd09e15f31d9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478848, "uuid": "17345e31-c8e2-4be4-bdcc-b93403522880", "comment": "Malware payload (RedLineStealer)", "value": "b9d6070d1949c5e7700f343ce2a6e74513aef396", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478848, "uuid": "d12482f8-858e-4f46-908c-f091ca960075", "comment": "Malware payload (RedLineStealer)", "value": "0956bda90f258723e8160294d84eb4aee9abe7373530719073c6919842a49ef4d6ad14c959be709416a5ea9b064a3fab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478848, "uuid": "80e8bb08-f40a-4ac4-8828-5aef78b4f69d", "value": "T1EBB4F1CA61804533CF77CDB2D4EFE8D64EB971210B718BC7120D89FA4E026E5A21B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478848, "uuid": "749546f7-f402-4fa6-bb83-1f1b561359b7", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478848, "uuid": "f356c99b-5db1-4a5f-b20b-70aca279ecd5", "value": "12288:Ooz6qTey5s5zBAMc/KFHlqHSAt8PhaiVQJQmZ:OozVTey5s5z+FyFHlqPt8PU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687478848, "uuid": "a11a9f5a-66d6-4112-b3f5-df068b572306", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687478848, "uuid": "3cf256c3-91fd-4724-abbf-abb312393a6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478848, "uuid": "fd6b0084-8133-44c6-83d6-514faec4d6d2", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf6bd15-11fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687547987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687547987, "uuid": "c29b6364-79df-4a55-bbe5-05c55ee4b6b3", "comment": "Malware payload (AsyncRAT)", "value": "c03a7cedc3314e6f0dc26431503dd035", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687547987, "uuid": "eb2440dc-6079-401d-8244-aa369aee42e4", "comment": "Malware payload (AsyncRAT)", "value": "719169d99a13f958de7a3f58d34ac4262cc90924eea256c782ed0b82de6adc0a", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687547987, "uuid": "0f0fa5ea-5f2f-41fd-9f81-a19c91d92fa6", "comment": "Malware payload (AsyncRAT)", "value": "3a4c09c8c54639a839ce19f49e9018e53ac6b2b8", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687547987, "uuid": "3c458b55-a58c-4d79-84bd-998709658a11", "comment": "Malware payload (AsyncRAT)", "value": "941902c1a5ebb7bb892c39732ba67da6766d487bed2d58e086891a1dccffb7f6fbedd7508cbb160b1488e1025ab0be35", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687547987, "uuid": "27b3441f-5f6e-4a33-be16-d44beb41839c", "value": "T1DA04392437E81919E3FFDBB8F4B001258B72F8236913E76F299459EA1D62344E550BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687547987, "uuid": "1a061b92-01fa-4583-a699-ca52830b6b2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687547987, "uuid": "ae823379-f19b-4161-bbe8-0d3fff6c207d", "value": "3072:G+STW8djpN6izj8mZw+GSv5hqIPu/i9bcJ2cknew6+WpD:b8XN6W8mm+vvnXPSi9b4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687547987, "uuid": "5b52d513-6cdf-48a5-b1d8-10046caef1f5", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687547987, "uuid": "7499bb67-8ef1-4961-b858-9699a5ec4dad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687547987, "uuid": "451b864c-c191-4807-89b1-a2e66220e49a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a0c122-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687499425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499425, "uuid": "de33958a-1cdc-458d-91d8-dff2e3b5c6be", "comment": "Malware payload (Amadey)", "value": "169928e20f13ba4505409ff6d086d8b7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499425, "uuid": "a5c600a2-33f8-40e4-8842-84b9f760779f", "comment": "Malware payload (Amadey)", "value": "71f3e81a50c08a980cbdf45d224d240c5ba962cb9fa3cbc1a18339b69a4c1a82", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499425, "uuid": "0f03a7d5-12e2-43f8-b850-a55b2561200d", "comment": "Malware payload (Amadey)", "value": "c06c4f755fa29eea93452de79a9afaf46c40d291", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499425, "uuid": "c85bdf46-569a-417f-83da-5578300a53dc", "comment": "Malware payload (Amadey)", "value": "6a0b67a259f9a14818b6bb16832da49dea9357949de4ee2c206eb05bc5c0399a8ad72def176df1ae3bc878b7bce58882", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499425, "uuid": "b13713ab-9a7c-4ece-9c7a-3576a1d877da", "value": "T1FEB4F1DA21400973CF23DDF2D4EFE8D78E7661310B724BC7120D8AF58A852D5A61B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499425, "uuid": "e6c5a021-e028-43f3-b088-eb5178c790f9", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499425, "uuid": "69bbefd5-964f-4d05-ba8e-a7037e2c88e8", "value": "12288:b4mO1oayu6Tey5sNnGAXjOJ5EKI0BhYvwrYywVdRIKGvWRFNQJQmZ:b4mO1oayVTey5sNRyBMtLny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499425, "uuid": "fbf97ea4-b046-4037-9268-3047c683c090", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499425, "uuid": "e345cfc8-2dbd-4a5e-b0a9-a6e5b086fa45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499425, "uuid": "1263798b-6d58-49f5-8e72-fb9b1511439e", "value": "169928e20f13ba4505409ff6d086d8b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e129e312-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499438, "uuid": "c4a4ef63-f697-4fad-8686-ec300e925f22", "comment": "Malware payload (RedLineStealer)", "value": "0c584fc07a680c2bdc9d6d82e36e2dc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499438, "uuid": "f0b39f7d-9942-4cdb-9362-cbedf3f3b247", "comment": "Malware payload (RedLineStealer)", "value": "72c636379bf7a2d0880564daae0a6f77d0f20e249dbcc418bd8c2c397617a939", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499438, "uuid": "5b1ae548-b556-444f-ba33-e75cbdd32ce6", "comment": "Malware payload (RedLineStealer)", "value": "6f0fd4871914b28386909c9224aede2412a804a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499438, "uuid": "c5c2d6db-b1b7-4f77-9cdf-707f6afdb5ca", "comment": "Malware payload (RedLineStealer)", "value": "f3b046421dd472efae361c3f5d93c73c99eff3836a862774522045b0b6f265f953c7ce148fcd077989a49c77036d51f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499438, "uuid": "4b8092ec-2c8c-4284-a4be-adfac2f45db0", "value": "T198B401CB21404973DF63DDB180EEF9C68E7A712107614BCB120D4AF64E466E4E62B97B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499438, "uuid": "1a6723e6-0384-4936-9b5c-4e0c54ae9ff7", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499438, "uuid": "80171eda-00e3-425f-9270-ef2c451e42c6", "value": "12288:FqAGITey5sQ+vmmA/Htki1gFmAl75bUy1BfyCQJQmZ:FqA3Tey5sJvmmsJoJYUfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499438, "uuid": "83efa1b1-8b76-4fc0-827c-fa39a0486162", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499438, "uuid": "b3e996b7-e326-42c1-947b-08e717d9b80e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499438, "uuid": "f0d5de72-4813-413b-a9ad-cd3ae566a31d", "value": "0c584fc07a680c2bdc9d6d82e36e2dc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ff25f9-11ca-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687527395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527395, "uuid": "4002ff5a-421a-4b6f-902b-f1587e8855b9", "comment": "Malware payload (AgentTesla)", "value": "ea4c75858dfc24a3681fb2cf8aac3a79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527395, "uuid": "df3d5b6a-5e48-448e-98c7-90e62151d9d3", "comment": "Malware payload (AgentTesla)", "value": "72d1ca783a74d9e5e8024a44759419ea5221177d53a2739960a8457e21e773d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527395, "uuid": "7854ed5f-f9df-4401-899e-6851f4025f8b", "comment": "Malware payload (AgentTesla)", "value": "7ddfc2266f10a680e2e1ea0946bf5aebdbf3d979", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687527395, "uuid": "7991b7fe-ce7b-4157-8064-7e980e83e69e", "comment": "Malware payload (AgentTesla)", "value": "c4aeacecc417c127d652181ae45d8d56d072756b0572efd2148f137c39d948b13ed2d51afee874fdc9aaa5ac4e21a309", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527395, "uuid": "24cbb440-2b11-4006-a9d0-73f59ce5832b", "value": "T124E4121680B54E70F97E6BF695B01161CBFAE666BB03FA8E1ED431F109A3F504A03653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527395, "uuid": "987ba452-6601-4b61-b832-667764a32121", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527395, "uuid": "4387bb91-9041-45b9-bf7e-11b3e6274d48", "value": "12288:z5M2iNh4/mNUAfJxy/h9A0JuatdrQce4XnO49zKE9bUwUtuO:VM1D4/QU+ETwIixmxBj6wUtuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687527395, "uuid": "de2c3416-0b63-4fe5-afca-c39c85ae5a12", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687527395, "uuid": "7f6e1831-abb7-4c62-9b0e-320070e04b92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687527395, "uuid": "d38d03d0-9057-4235-ab33-6b3b5b1521a1", "value": "Cotizacion 575843.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e81a264-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500990, "uuid": "5c1858ee-0d52-483f-9c63-ed3b144a463c", "comment": "Malware payload (Amadey)", "value": "cdf69d1af4fba21824a9ebadd5d01abb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500990, "uuid": "645600f8-f2b9-4e57-863d-4615d2f63eeb", "comment": "Malware payload (Amadey)", "value": "730563f19bb8de9c3fdb3aa18482f0872610e78765a9d739c220d92bc3ebc3dd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500990, "uuid": "fd7db60e-36e9-40e0-bfe8-295a88ac6497", "comment": "Malware payload (Amadey)", "value": "bc90213fdc14b2f2bfd34f5b4bd9380b8d4ceb1c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500990, "uuid": "06501303-ff2d-4c2f-aec2-c4926e8604f9", "comment": "Malware payload (Amadey)", "value": "692be55ba91d6c445bdc5dc0f715d624644a7fffe336007dafb2f7b0c8d573cdf105d8b0e954ad2b74380936ed6e3344", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500990, "uuid": "beaf210e-345b-4eeb-a925-e6968d4d7758", "value": "T1CCB4F1C965804933CF63C9F1D4EFE9D74E7A70214B764B83231C4AFA8A512E4A51B63A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500990, "uuid": "f80d1a23-b56d-45cc-a76a-9c6010d4b6dd", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500990, "uuid": "f9501a8e-0e4f-44cf-bd98-5d43e3c76f3d", "value": "12288:F+cSMTey5sGXK9uXj7ijjTYtQhy4P0FxrMi3YQJQmZ:F+cfTey5sGXKcTmj9hy4cFxlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500990, "uuid": "6c59f243-7e19-4c39-9269-9c33e3a80b4f", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500990, "uuid": "e95b40a9-a41a-4bb0-8085-c7100439512f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500990, "uuid": "28114500-8745-4b29-a0c2-4d62a27a93cf", "value": "cdf69d1af4fba21824a9ebadd5d01abb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3333f779-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687510313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510313, "uuid": "61863074-7226-483e-a791-33b85e993520", "comment": "Malware payload (Amadey)", "value": "6e102f0976635c7112bcc84106b79e66", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510313, "uuid": "ecd393d3-4f10-4ac3-a72a-a8903e76f88e", "comment": "Malware payload (Amadey)", "value": "731cef07b0144908619dc93ca3e4bd9567e7be9a02f32786da5620f71968ba26", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510313, "uuid": "ffaa724a-5df4-4c91-9ee2-899d1091eab6", "comment": "Malware payload (Amadey)", "value": "fd22fa93a399619e56792019d681e4e21a84f94a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510313, "uuid": "66644594-1a0a-44f7-8f51-6c2cd284a747", "comment": "Malware payload (Amadey)", "value": "1faa1112f71a081ebcbe75e7b5054bb5a53ba6e0dd5fb582a8a85d016df454e87cf57b62868bef678144bfcb57443045", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510313, "uuid": "a4ec64a0-7a09-4e30-9b6d-5f959f75b648", "value": "T1C5B4F1CA22404977CF63D8F2D4EFF8DA4E7A712107224B87121E99F68F465E0E51B53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510313, "uuid": "20756c90-2a01-48b2-a679-b8a8810224c6", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510313, "uuid": "7910dbef-d7d9-43f3-bd8d-edb2ea1e83d5", "value": "12288:ZKeJTzTey5sefaMYiQcGY4fb9r+ZQJQmZ:ZKeJfTey5seCMYhPN9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510313, "uuid": "ddf68d23-16f8-410c-b7dc-a1fabca4d974", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510313, "uuid": "444812ee-bffa-4594-a333-ef2b8aad2055", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510313, "uuid": "7491f491-4787-4dcf-95fb-ff492081486e", "value": "6e102f0976635c7112bcc84106b79e66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7313635-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687499770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499770, "uuid": "f7ea66f2-7fa5-4388-8d59-1f9725e3b0cb", "comment": "Malware payload (Amadey)", "value": "549f739d347598dd27814b596c1b81ad", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499770, "uuid": "90ca6359-e67d-4d67-a3c7-70c4e60c64c4", "comment": "Malware payload (Amadey)", "value": "733bcdb4739e48f67c15289fba2a86f33c3ab61ee5d7c4916cad3baca8b9f614", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499770, "uuid": "177a20fa-cbda-4e9d-b2a0-48e585982da7", "comment": "Malware payload (Amadey)", "value": "84450125967c4b95710ac63a765b1793c0c179d8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499770, "uuid": "6d55ba6b-688b-460c-9de7-c312002d7d5a", "comment": "Malware payload (Amadey)", "value": "7178749a0ef65aefe4327ad2633bfbfb87d716165e98d9f10a173ae294f52b650dd55a94ac34d389cc12fd3b4beab38e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499770, "uuid": "48021818-875f-490c-9e65-6794996f093c", "value": "T17AB4F1CA6A404973CF33C9F1D4EFE9DA4EBA31204B624AC7130D85F58F452E4A61B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499770, "uuid": "7183125e-20db-4612-9b2b-b56c819c5904", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499770, "uuid": "9dbd80e7-7bd3-43d0-93ee-2454d906bfa7", "value": "12288:HtT0WTey5s9NfKpU1V+/n4TKZceqWtTHZEhmA8zQJQmZ:HtT7Tey5s9Nyq1V+Myce1xqhmAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499770, "uuid": "a1244815-307e-4fcc-b823-afa2e5a61aa2", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499770, "uuid": "c3972945-b1a4-45f7-b755-dab36012c782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499770, "uuid": "23e4e816-4a91-4738-966c-0a0b95f72567", "value": "549f739d347598dd27814b596c1b81ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d4f3fb-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687501620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501620, "uuid": "f35fd2bb-2818-41ec-b529-62f0e420840f", "comment": "Malware payload (AgentTesla)", "value": "ec12810aa3d7c0009125a03604940aa6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "convergentinterfreight-info", "colour": "#D08CC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501620, "uuid": "b28ea3cc-2af0-45f8-9d8f-aab4238bc7e6", "comment": "Malware payload (AgentTesla)", "value": "73d1559ce3382e47d1b7e891fea97f5378c5d31e0cb422a594e6a106b47cace5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "convergentinterfreight-info", "colour": "#D08CC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501620, "uuid": "ebc6cc8d-8a2b-46b3-a5e7-8752d2148704", "comment": "Malware payload (AgentTesla)", "value": "028c7e6efcfeb035b281a324eb52c9441fef1bac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "convergentinterfreight-info", "colour": "#D08CC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501620, "uuid": "62fdd4ab-0b6a-4e92-8729-dcac47df918a", "comment": "Malware payload (AgentTesla)", "value": "235a697fb8cc261a274505656ab3b0c1689d255afd2a60d3004f65957c4600def2d50b76c696932529d7a551c7671e1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "convergentinterfreight-info", "colour": "#D08CC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501620, "uuid": "b4e3c1dd-6e39-42f3-b852-510df19ac158", "value": "T17E05337D51A971F6E8B27783F2C2CCA4E2428A771F7B5A0033076CCC516F69A131AE59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501620, "uuid": "07d498a8-1c13-4613-bc09-f1bfaa2c962b", "value": "12288:LaQ3drIOMUql1uKXI+Mj9DDkY5OTXdiNAWpNBszkBT8bisOwGFp3cyJmKrFXP10X:LaQpm1uhbj9ITXgtB2k57/NGyJ3PeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501620, "uuid": "c1a57661-1000-4bfd-aa8f-6ccd0b381d0a", "value": 818515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501620, "uuid": "f38edae8-ef1f-4677-88e9-05eaa45a1142", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501620, "uuid": "f05cb881-e08d-4a05-9fb5-80b701018c9b", "value": "PRE-ALERT ==HTHC22031529.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8cb80b7-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687501088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501088, "uuid": "66d3eda4-2fa1-4bda-819e-eb7f6812eb22", "comment": "Malware payload (AgentTesla)", "value": "e5d0d2deb7bafbbb6d544cc1d4caa789", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501088, "uuid": "81a2203c-8c68-45e7-b174-c62f9901e2bc", "comment": "Malware payload (AgentTesla)", "value": "7507ad80bdab3989a360f8d560c74dda0078fee626239e3b8d2bcda37d57f0fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501088, "uuid": "0f010a58-d65f-4cbe-b3e7-b01711a87a2e", "comment": "Malware payload (AgentTesla)", "value": "4f2fbae85bc1457d7e7ef46b8db96a9c8342ad68", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501088, "uuid": "82026b81-1c92-4bd0-864e-c6e5b1816021", "comment": "Malware payload (AgentTesla)", "value": "6c06b661fa92503cc5220818d0dbbbea475a050aee9a0955a132d31ef53b017cdfbb16baaae83d87232f4f90f5208181", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501088, "uuid": "0fc32ee0-f5f7-49fa-8936-635a36e41780", "value": "T1243533A4B5F5651BFD6A88C5D1908C87BE973834948B138D247C37EE7CE912483C98B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501088, "uuid": "62837572-8548-4276-b0e2-0718e4e0ea57", "value": "24576:JUs0yDk8jtkOubF9kYyNrZ/xE7qpqU7uE48PLwN:JUs0yI8tkPb4Yy1Z/xIFUzsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501088, "uuid": "49e6089a-edac-4a54-be04-46aa7e88ef8f", "value": 1097060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501088, "uuid": "667b14e4-dc4f-4b5d-954c-377e0af23f72", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501088, "uuid": "ad796263-68bc-4c4d-bf04-7ec8a9f7a2d4", "value": "pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652a3e61-11df-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687536166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536166, "uuid": "a0b5cf29-2382-4507-bae6-28c1db7f5530", "comment": "Malware payload (RedLineStealer)", "value": "f684c5c871aaa48d0e0aa966b73b2472", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536166, "uuid": "7b797e48-b5f5-4469-af41-8d101d8b88d3", "comment": "Malware payload (RedLineStealer)", "value": "752c5346575c65d6b071b575cd4bc98ca840bab2426a1917eaea96894efc8c02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536166, "uuid": "d1e7d10b-eca4-4453-b7bb-f6b2e3d11512", "comment": "Malware payload (RedLineStealer)", "value": "96297a99a957e13decfdcb51f37dce8f638cbc58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536166, "uuid": "6b498084-262e-4b06-8266-deed3f74373b", "comment": "Malware payload (RedLineStealer)", "value": "4de9843b0b3c54061e95427c7bd6f7c79eb7849b3e4d2ca86917c0b0f69fb157eb1ec0d811243635c1de12a042730086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536166, "uuid": "1abf0fbf-e340-4d48-b09e-5e78b842d00b", "value": "T11D1612786240D6BBD3C31431E893941F4C1A64B2AADFB5487787CDE619A35BCC8B4BC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536166, "uuid": "c808d62f-f138-4d3f-9a74-60d95b1b9d1a", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536166, "uuid": "52fef906-d409-48cc-8bdb-1418e0391502", "value": "98304:QlOJDnItLE8bYQe50hZHbsKgns9v6s82Y8tELmqw3O4xZqnLIBbN+863JBMCrXL:Qo5ItfbCAZHbVgnkv6s82TOLmnO4VBbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687536166, "uuid": "f03ba0d9-5118-4cdb-88f4-fd67be7428e4", "value": 4128768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687536166, "uuid": "adeb2ab5-5e27-4527-934b-3021dde720a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536166, "uuid": "c3e2946b-200d-4a62-a5e5-db6c558df58f", "value": "f684c5c871aaa48d0e0aa966b73b2472.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e489132c-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687510610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510610, "uuid": "54ff9449-455c-4afa-ae01-be907e2be997", "comment": "Malware payload (RedLineStealer)", "value": "6dc9b8cd64986d42b26ea6b11c2905f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510610, "uuid": "8d57ad94-ac0b-4632-bb7a-ed401ce24822", "comment": "Malware payload (RedLineStealer)", "value": "7548160d3253512383b83447d461d0df67340f3d2ca34646dd868c5c85e5c650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510610, "uuid": "72e0c734-ff02-49e7-97c8-e41b786cd1c0", "comment": "Malware payload (RedLineStealer)", "value": "4d80172b6cf812b6afc6373ec6ada0ced7f197cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510610, "uuid": "0d189bb1-7488-4896-bfaa-92bcbf51fce0", "comment": "Malware payload (RedLineStealer)", "value": "63644e90cc2eb5d604a84c3bd021d2cb33b8419f18c752d0ec81420b339472111d4399d2661892966f27760f67a68655", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510610, "uuid": "9026fdb4-3df4-41ff-a6d5-455c204cd4f7", "value": "T12EB401CA22404973CF23CDB1D4DFE9E64E7AB02107724BC7120D49F64E466E4AA1B57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510610, "uuid": "3fbeb537-c68f-44a3-8d8c-5d29f35584e3", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510610, "uuid": "ba5a8751-c816-43c2-b5df-61de5d0e0c61", "value": "12288:Lk7+STey5sdBJsh3wLVD7u90zJexaiYDhBlQJQmZ:Lk7BTey5sLJAALVXu9kJekid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510610, "uuid": "1492ab16-ba06-47a9-a8c2-073baba403e7", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510610, "uuid": "b0e28c8c-3d7d-4409-8629-7a4596d15021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510610, "uuid": "1a6d1735-487d-4f12-a87b-32986e390376", "value": "6dc9b8cd64986d42b26ea6b11c2905f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f39f339-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499139, "uuid": "7bbf727e-bb95-4bbc-99d7-77f472d1a85b", "comment": "Malware payload (RedLineStealer)", "value": "0dfeff027463fc1137270335fcd6faa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499139, "uuid": "04f24516-3c19-4bff-9cdb-2ed5acae98e8", "comment": "Malware payload (RedLineStealer)", "value": "765cb00a4242249ca82f85cdf242bd05d65a6f590848f77bcd2c14e80826ba2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499139, "uuid": "1ba7aa0d-0e96-4760-a15b-4e9fc749c285", "comment": "Malware payload (RedLineStealer)", "value": "9b6dbe94310033b12b38b930a2abcaeb27e830be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499139, "uuid": "701ea2e0-55ff-4622-b811-0033f26dd294", "comment": "Malware payload (RedLineStealer)", "value": "0231362f2f971f7c0af4acc1d5d04d7f169b5ff61d11b5d8ee2576ccfa595bb95468754fac0e585d0401be5ce08f3868", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499139, "uuid": "e03b2cd6-240f-4e01-bb4d-489e0f1e1b07", "value": "T11BE402CA61804973CF27DAF2D8EFE9974E7970250B314BC7220C56F98B452D0E62B979", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499139, "uuid": "7aa66ab3-4fbd-4d01-9acf-055472ff35aa", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499139, "uuid": "91b288a9-ccea-4055-bb2d-5d6757605520", "value": "12288:CCev1UTey5saavdUYOOg+eTngdaTxtfUpwvq3z7IqipTrCta0safZ8xq+hcEQJQI:Hev6Tey5s1vdUYOOgViaTxt8Yq/ITXIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499139, "uuid": "ea5766ef-e993-4d51-a647-6f6fa45b1b2b", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499139, "uuid": "d308271c-9bcc-4302-acd9-50ded1b09dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499139, "uuid": "5d7cfb66-b321-4169-8f68-506a6664ed4a", "value": "0dfeff027463fc1137270335fcd6faa6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a501598-11da-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687534054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534054, "uuid": "b762f0b7-873c-4967-8682-0bb68720d9cf", "comment": "Malware payload (RedLineStealer)", "value": "8363654ddc73b211f1571e5e8f5d72e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534054, "uuid": "13b2ca95-db70-4dcf-8eae-693b26192df7", "comment": "Malware payload (RedLineStealer)", "value": "76800b305528d2d0b68c468cbd8aee5a21b1c9c386dcd0595e8c07e059f4da50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534054, "uuid": "0b66268a-dede-4f42-92e8-61228f4dadb4", "comment": "Malware payload (RedLineStealer)", "value": "e3254431932ae78d95cfa803f43986451b9607a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534054, "uuid": "4e1b1989-3d14-410f-b8ed-4a2a245a7119", "comment": "Malware payload (RedLineStealer)", "value": "e0c1e5323a3aaa55fad56223e3ad64726f902bab0963266b23d0f30cf22480bfaf24a44476ca279bdf6af5baa0c2055b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534054, "uuid": "6f49e68e-9f63-4488-ba9e-3ae1578ffe45", "value": "T1B706123A2A45D633DBD72536D0A3829F4869A6710A5FBC49BF670C3BA9631ECC0353D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534054, "uuid": "3a212557-4470-4d33-9fe0-e24c218e7068", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534054, "uuid": "2107a5cb-f59f-47c8-89ca-cff01743f9a8", "value": "98304:s/51wCDMwnEx+D4FmFrjfYIJb4HOl1hGXGgaFASZSDG+FVK58XCScwh6Fnvikfsk:O51wVIE09fYIJbnFASZSKoKKSScK6de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687534054, "uuid": "3f914a56-10c9-4100-a908-e46dbd0c239f", "value": 3766272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687534054, "uuid": "f0f9db13-c486-49e1-880a-557124bedf04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534054, "uuid": "4898388d-138f-4371-89b0-a0b9b7cf12cd", "value": "8363654ddc73b211f1571e5e8f5d72e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfee975f-117d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687494282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494282, "uuid": "a333310d-dde6-4c1e-9596-575f53560bc2", "comment": "Malware payload (AgentTesla)", "value": "d780edde21bb311f2ad62d883e6ad8ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sconengr-com", "colour": "#A461B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494282, "uuid": "03ce118a-34ec-419a-a5f2-5311b2d55774", "comment": "Malware payload (AgentTesla)", "value": "780c9bad9c62b35f6af3a27633c4c0e7187049b7a6e7ed7b244a8fe1ef6a240c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sconengr-com", "colour": "#A461B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494282, "uuid": "0a542324-d872-4d50-82f5-5e18f022d207", "comment": "Malware payload (AgentTesla)", "value": "2db045e5b2496df11d1008098c8ac864b30161c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sconengr-com", "colour": "#A461B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494282, "uuid": "4146e9e5-97a4-4128-b20c-c47efa8c061e", "comment": "Malware payload (AgentTesla)", "value": "606c1343fa8bf5bb46ff2e3942e25f0332098d4f70ff179a9547c57e5615006136f4c2f87a5288511d766aa69a952091", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sconengr-com", "colour": "#A461B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687494282, "uuid": "3056d154-0c0a-4ca3-bca6-7c8d36f2b75e", "value": "T176C41220B6689523E27D95F98430520A0FB9616B8A50E7DCDCD134BA1BF4F9246D2F8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687494282, "uuid": "95c75d71-0406-4f76-820f-468201448595", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687494282, "uuid": "a2dd56de-b8bc-4470-bade-227437c88d95", "value": "12288:Haw/osNeQD7je5LMFO4dlCcLCxd/x/IZZPoKs/PYtnxOzsk+g3I:HaWosNeM7ELrWhLCxFFylvBJQzsk+g4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687494282, "uuid": "d62c4b4a-c04c-4a8f-8599-dcc19e58a3a4", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687494282, "uuid": "e80f3e38-18ab-4680-90d6-ebd56e598abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687494282, "uuid": "0de701ee-ced0-4bd0-be28-5ebbc74737ff", "value": "Amended_LOA and AirSea Proforma InvoiceEPDA_Docs .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d67d3ef-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501283, "uuid": "cd99ce79-6676-48c9-b7b1-0da803beaf2a", "comment": "Malware payload (RedLineStealer)", "value": "e74252f0dd59f9ccf58f1f582f7c2d62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501283, "uuid": "2f165f84-9880-483f-a54f-ad710b7e8a6c", "comment": "Malware payload (RedLineStealer)", "value": "7847b3f2d359d1ffc7840b99b186ad86f09765bba9c9f8cd96762c7e706f9db3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501283, "uuid": "38162daa-8503-48ae-920c-6cc6650b8bd1", "comment": "Malware payload (RedLineStealer)", "value": "573b760904ddf38dd30d005102417c2282fa9bbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501283, "uuid": "ada4e008-e521-462c-ba2e-1c6f69304e67", "comment": "Malware payload (RedLineStealer)", "value": "953de680bbd054dda3336b210b6fa04d6bd99e56ada20a078b5dfe5c33089db0cc4f1e7567ca6b8d540dcbc71f8a7626", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501283, "uuid": "0bbfd02b-88e0-40ed-a51b-d0ad5ae5bc41", "value": "T1B7444CFB52D1D460DD0FA4B02C6EE1BDEE35B461DEA184CA19BA0952D3430E4BCE798D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501283, "uuid": "4326de33-68f7-4403-a46a-2cb0451b2793", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501283, "uuid": "d0601532-4014-474c-b16c-6562b5994906", "value": "6144:5tSKJigt0poiRG/XvLNUgYhuE22yQJQmT:5tS9gtAoiRG/fSv6QJQmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501283, "uuid": "753a4d13-0623-422e-9c92-853c2d5ac4b7", "value": 276291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501283, "uuid": "db51b101-0694-4ecf-a66f-43cdc6c716e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501283, "uuid": "7280d8e2-91f9-4e9c-a659-ff806c32164b", "value": "e74252f0dd59f9ccf58f1f582f7c2d62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de085a02-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499432, "uuid": "3410c05c-0798-44f5-ba6b-70a1f7d922cd", "comment": "Malware payload (RedLineStealer)", "value": "0d0d3081c076e83a927e18782e49d09a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499432, "uuid": "3b4a8d5d-b753-4ab2-afc3-7165ae925885", "comment": "Malware payload (RedLineStealer)", "value": "78f651834c15fa8566c394744fa95c80c4e7fa636a458f2b1a05f611eff4ea07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499432, "uuid": "eb872f25-5836-4c74-82f2-cd388a61823a", "comment": "Malware payload (RedLineStealer)", "value": "7f621d82e9d684686a5911f99f1322579bd08569", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499432, "uuid": "ff87e258-4f1f-486b-877d-5e3420fcdfc6", "comment": "Malware payload (RedLineStealer)", "value": "3b73892e63cdbea90b249a8840b64f86411d0e02dcdfa4f959fa5d4db342cc81505fed9998246958481ddf48c6a0a78a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499432, "uuid": "e60a1f12-a0b1-420d-966b-b9d37587fe6a", "value": "T141E401C665808573CF33C9B2C4AEEDD68E7971210B7647CB120D95F11F06AE4E60BA7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499432, "uuid": "52815151-90f6-45e5-82f0-254bdaa86d17", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499432, "uuid": "6aaa75d6-30f5-49fc-8479-c9bf28a83b37", "value": "12288:MqozZNTey5s03EDKsXbqJAIAiV73UNSMJySTjwLaQ81k0s2xxDDuiRltiQJQmZ:boznTey5sHDQAI17ENSMV51VRjD7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499432, "uuid": "ed839a3c-c298-453c-af70-1ce31e083ff4", "value": 715072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499432, "uuid": "d4d81948-3d6b-4bcb-9a70-7aae3bfe95bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499432, "uuid": "88f27ca9-529a-43f8-927f-c94555eca47e", "value": "0d0d3081c076e83a927e18782e49d09a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915095b8-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499733, "uuid": "adc2f6d4-0ab7-42ba-99fe-2efd994a0a37", "comment": "Malware payload (RedLineStealer)", "value": "380e3ad20d88bb91ca45c6eddde23d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499733, "uuid": "a0d1d664-724e-45e8-99ff-1800050819fc", "comment": "Malware payload (RedLineStealer)", "value": "79199ce7b4000f477404597b8da1d18025cdbdb0caf09f33aa5440fa050d636a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499733, "uuid": "d17f9b9b-7e81-4091-aa34-98996301fbdb", "comment": "Malware payload (RedLineStealer)", "value": "b41477b1d08b34e9e9da6055cb439abde0c5dc3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499733, "uuid": "9f6145c3-b040-4517-8cd8-18a137503b1c", "comment": "Malware payload (RedLineStealer)", "value": "8af3285941c27eeaf00541738616f8ca256ae7cce56946b6bab0d146ac3075bde1dc35983441c7a3d1c6d22a3481cf39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499733, "uuid": "98423d23-39a5-4462-a70a-4f7eaa894198", "value": "T1E1E402CA25404973CF63CDF2D0EBE9D69B7AB0210B714787160C99F68B412E4E61B57B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499733, "uuid": "7382ae87-8a16-4141-9fb6-b37642f7da23", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499733, "uuid": "d1dd8ce0-ae50-4456-967a-07bf5c2ec969", "value": "12288:pcE9mJ8Tey5szpYpf1ZMZsxKXeOQRQtmROtpvwP0mQIfS5MntcDK6gM/Aw5MwwQv:pcE9mmTey5s9Y7yZ8EeOAjStmQpG+m6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499733, "uuid": "37d1542b-f76e-4cee-a841-2454f5ba4c25", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499733, "uuid": "77e49033-b381-43b8-be52-2038795385b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499733, "uuid": "07101bb8-c181-4e04-99d2-b2664301ae8a", "value": "380e3ad20d88bb91ca45c6eddde23d1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc71fac-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499754, "uuid": "4e4e2576-4164-4ba1-8472-90143e7187de", "comment": "Malware payload (RedLineStealer)", "value": "4662f40e09aca3d67b0825c893afb588", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499754, "uuid": "b41c8a3e-44d0-4711-8357-76b1e58de27a", "comment": "Malware payload (RedLineStealer)", "value": "79e77af4745709a5ffbdb38fd3acafcfc0b818791048d76b6f27dc3ca489f06f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499754, "uuid": "73416d25-ffc7-43a5-ad27-fd45be4b5c8b", "comment": "Malware payload (RedLineStealer)", "value": "d2fb63234c1afc702d9bf5c792560c24e4234138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499754, "uuid": "bdb2587d-55b7-4603-8664-feb61f56af0c", "comment": "Malware payload (RedLineStealer)", "value": "d42a7cbb4315d3e2183717fc049e0e71eed0a6c329ca550eb69c8ca4dbcd8789c55f43918605a5d4a3c18fc636052426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499754, "uuid": "cc890a57-197c-4e12-8322-1a3a7c2af7f1", "value": "T159E401C63A804963CF27DEB2C89FADD68F7A60214B364B83020C99F54F565E4E51F53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499754, "uuid": "59b5cde6-c12c-458e-8f69-6c5323820f75", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499754, "uuid": "a74684be-b250-42e4-8745-e3a16ee3e225", "value": "12288:3jk73ITey5shHSKvzPYA+hH9UjJCdwAv8DDUmhOg8fUL8ZOyQJQmZ:zk74Tey5shFPYvH9UjJr7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499754, "uuid": "a934f068-e086-4da3-a6ec-7d6d8dd80422", "value": 713536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499754, "uuid": "59b4c142-a3b9-4862-91ab-ac5e5f830971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499754, "uuid": "0aa15032-58c5-4261-b49a-3fc2a4636e84", "value": "4662f40e09aca3d67b0825c893afb588.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52944a9a-11d8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687533129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533129, "uuid": "1aa81aa0-593f-44d5-9539-b234c2ca03cf", "comment": "Malware payload (RedLineStealer)", "value": "4786f469607fd300faaafba096d2c09f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533129, "uuid": "b870e969-6ecc-4122-a846-a9ec810e3d2e", "comment": "Malware payload (RedLineStealer)", "value": "7a6aa35deed2fac5dcad730ab3591efb8f28a82312bf77d5b18a1b34381d9ffe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533129, "uuid": "e2dbdc93-a200-4001-8de2-ce1bd88098f7", "comment": "Malware payload (RedLineStealer)", "value": "48360e75345b73d3f85c91b66417e791c8102507", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533129, "uuid": "898c65c2-36f9-4e29-accd-b71ff8b61c92", "comment": "Malware payload (RedLineStealer)", "value": "c614471d5c10c86d45607e7af38ccf913398f4fade0cebd1d2c133eecd0e5d25e902b2217ae633ef1df84ac5c0d44455", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533129, "uuid": "c5d82cf5-febc-4fd7-a7ce-1f30e456e890", "value": "T1EB747D1362E17D51FA254B329E2FC6F8764DF6508F193BEB22189A2F08B01B2C573765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533129, "uuid": "4a079f0d-431d-4892-9e8c-c95ab3f98665", "value": "3d932c8387f734b87492e5f8d5c5a08c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533129, "uuid": "c8c1617d-3ae8-4def-aa2e-0120c1e0fc0d", "value": "6144:Ug9O9/oO0Nk8sG7oB3OFed8MrA/eq5CiRAY:Ueo/ofa8sG7oNOY9kYiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687533129, "uuid": "61c57c34-6f02-46e9-bff4-538c05232def", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687533129, "uuid": "75a7090a-43bb-4b42-820a-0cc40596b1eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533129, "uuid": "e75ea876-46aa-4ee9-ae41-dcf416f8bfc8", "value": "4786f469607fd300faaafba096d2c09f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aedaea68-1199-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687506225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687506225, "uuid": "059333d3-847f-488e-910d-20d08519aee9", "comment": "Malware payload (Quakbot)", "value": "b4ac4fc6d5efd95e81d280205090f03a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687506225, "uuid": "0dbbb35e-a1c9-41e9-9df5-a3234083527d", "comment": "Malware payload (Quakbot)", "value": "7ad0a845fdc8ed7843d1b65c446dc85e19cdd1e40b2e5d6ddd416c60a922100a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687506225, "uuid": "498931be-3d8e-4d1c-97de-a8464b6d2306", "comment": "Malware payload (Quakbot)", "value": "21c38ea11d14039eb45428892a38ba191081cca8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687506225, "uuid": "20f72f24-c36d-4106-b426-df6aacf44fbd", "comment": "Malware payload (Quakbot)", "value": "08248592ca7e63cc505f7679bb858531fa7fabe68efca4709f88525f0b0aca30a9ea38ed0b5ca43668cbc41694973342", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687506225, "uuid": "999c20ef-6774-4124-b586-f5058a95d5d9", "value": "T1EFB4F6862AE178224273A33DF6468D64F272455781A5894BB63CA479FF7DC0263B4F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687506225, "uuid": "2cec90b0-a796-4e69-8437-f188d9cabbc9", "value": "12288:NHq5j7bcOahKu0B6xlU9fzyhnmRFGfAGmFcRmkV0b4a7WOOX/wMzAnlkJalue4kD:rufzyhcBs/MaxG2E9u272n8MT3cBfFJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687506225, "uuid": "bfc5bb5c-ed43-489c-95e1-75e756f9709e", "value": 494939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687506225, "uuid": "9f699f51-2f0c-46b2-8e57-796a127bfdb4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687506225, "uuid": "356d32d1-a715-4c87-af5f-3ff3994d73e4", "value": "Ams.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce444bb-11bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687520959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520959, "uuid": "e72fc56d-9f6c-4e52-b66a-7451d226ada8", "comment": "Malware payload (GCleaner)", "value": "c4f1d7b84e9abdc52b127199a964be03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520959, "uuid": "5db0fb43-3104-44ff-a4fb-0cd0d974da23", "comment": "Malware payload (GCleaner)", "value": "7bd3d25d5812015f81b828cdea41c0cc3ba0b6e899d22866132010e1a5888101", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520959, "uuid": "5faba053-a9f8-4033-a051-adecc4fa96a7", "comment": "Malware payload (GCleaner)", "value": "d3ac5ff8d050dca9c1dcb3e686522eb9681e546d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520959, "uuid": "6da97cc1-6545-4985-b189-cd9e54c230a1", "comment": "Malware payload (GCleaner)", "value": "7cb6a175550d9f5bf9da7641823712a23b2740e2ed4ca234f89e87bafc51608639634537c92eaca912d698a1bb8a2a59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520959, "uuid": "f3aed50d-0327-4b90-ae9e-f31374b28cae", "value": "T1D6948D03B2D26C64E525DA328E2EC7F8761FF1604F197B9F66585A6B0A701F2D233316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520959, "uuid": "31b5cf78-2100-47e7-bda1-120cf7d5c1c7", "value": "e53988d785c3385128434cebf2176c57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520959, "uuid": "8136c3d5-9744-4620-a16b-77397535c359", "value": "6144:yJ9BFmWdUsIMOWn17V8LYmhFfCDlP/fgkKABqVhn5yTlZ4OuB5l7IacjC9mUWp:wFmWdUfMCh5CDlP/4PK0ZwTReM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520959, "uuid": "e4c7c235-ce8b-4ea4-bb35-3cb00aab6232", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520959, "uuid": "c07ebac0-c6e3-483e-9186-4cb07d907388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520959, "uuid": "949e7a19-d0a3-4841-99cd-74d8c6b3cd3b", "value": "c4f1d7b84e9abdc52b127199a964be03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2d9383-11ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687540793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540793, "uuid": "4aa4a9ac-d762-4bbe-89a8-45998b0d99fd", "comment": "Malware payload (Quakbot)", "value": "0ee8ea053b9fe7157eabf88cb0c88263", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540793, "uuid": "a1b35b8e-ffa2-49cd-a68c-102d68d397ed", "comment": "Malware payload (Quakbot)", "value": "7cb5b62b3c90732c49c25ae8781a67b9eb0e08fc990719082ee588b0d75cd7de", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540793, "uuid": "080d13b8-0a8d-4e12-b4b2-178795966c96", "comment": "Malware payload (Quakbot)", "value": "9e10f3446b65c59dfb9a3ef4a1b2c9d02e29b59f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540793, "uuid": "6e436155-506b-4673-9458-0a7819b9b758", "comment": "Malware payload (Quakbot)", "value": "df96c1ed801365e645e43b27ef931a8dd971383dd1f0311cdc2e1d0955d25050ef838d59dbacb9d56de0636d4f480c3f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687540793, "uuid": "bed17f53-f8f4-49d8-b585-8d4d38a491af", "value": "T17674496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687540793, "uuid": "33317201-9ff6-4c64-841a-da6ec1b23ba0", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593i:fIS1xbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687540793, "uuid": "504f803a-046c-4eab-a07b-bd5ef022b303", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687540793, "uuid": "cc038da8-e902-4ad3-b0b0-8f394238abfe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687540793, "uuid": "859aca0f-34b8-4026-af7a-3fbd9950f0ef", "value": "BSN-18504297.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39f778b-1191-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687502797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502797, "uuid": "931ba033-60ac-4ca0-80b3-7b4374897656", "comment": "Malware payload (RedLineStealer)", "value": "2c6bf57e7fa1044d5f7f83bb86f41996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502797, "uuid": "6e9ea388-d20b-49a5-91a4-4cea20165862", "comment": "Malware payload (RedLineStealer)", "value": "7ce0efab547a7fe08d40688bc519633b776176967d190b19cb561febfb23a61d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502797, "uuid": "f05f78f4-3fe3-482c-954e-3e635db6ce10", "comment": "Malware payload (RedLineStealer)", "value": "f325eb5d10391b9f08d40926db63e86dec3362df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502797, "uuid": "78d79fb1-8b2c-48b8-8cbd-f28df7e5d930", "comment": "Malware payload (RedLineStealer)", "value": "95bc7aaca365ae2c3e126f265797cb2bb2c79b2534e9972000e266e692ccbb41f04a19394be5116b91dba2804c3617f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502797, "uuid": "7f40606e-9ed2-4c91-abf5-ed91ac1b2eaa", "value": "T110E401CA64404973CF67CDB1E89FE8DA4EBE2221072147C7134D49FA4E460E4E65FA7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502797, "uuid": "143db332-5033-479b-94ea-f48d72f2e1f7", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502797, "uuid": "14cfcec1-26c8-446c-9bde-022994642fd1", "value": "12288:t6M+OeSmTey5sTlLsWOjzUnZwlhCyBhPwGs6oE1J5U7Dx+3Z1dOQJQmZ:tz+O6Tey5sTiWkCGfBhUxu/Unx+3zP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687502797, "uuid": "74d43814-503b-43f5-b566-0a70f72a702c", "value": 713536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687502797, "uuid": "b3a134ec-9549-4853-8d0f-f9b917e8c33e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502797, "uuid": "61859402-38f1-4389-bd35-eed4aebcb28e", "value": "2c6bf57e7fa1044d5f7f83bb86f41996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f2d6c1-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687510341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510341, "uuid": "05d7b340-9a0e-4821-ae32-b2fc6a31f281", "comment": "Malware payload (Amadey)", "value": "cbfffd4a3c9e48ff7e069f373788f623", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510341, "uuid": "abec02ee-8729-42b4-b4ae-f21be1b99932", "comment": "Malware payload (Amadey)", "value": "7d4791bdc88fe1642e9aadae0a77c2642a3c366e2858ee7d2f28e8dad9f1eab1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510341, "uuid": "37d7526c-7047-4116-bf8f-c5229a81a396", "comment": "Malware payload (Amadey)", "value": "f2a3c6934a216bf13c64ff3acac35a1a2763455a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510341, "uuid": "1e310102-ed39-4f01-b0a6-e982d2b8b27c", "comment": "Malware payload (Amadey)", "value": "e1c5929242302cc8280ceb9d86d54d3130ace08043f21541fae38526f660049160a746eeab7f6f79cfb33b92859a6b15", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510341, "uuid": "e08fb4dc-74d9-4041-85ce-4b756652a9ee", "value": "T1A7B4F1CA25004573CF63CDB1D4EEE8874AB9713047704BC7630D96F68E466D4AA1BABA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510341, "uuid": "7827d6b0-0d5a-492a-b1e5-001fc74f79de", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510341, "uuid": "3cb78a5f-757e-4b2c-9439-cf20f8c91db6", "value": "12288:VE9mv9Tey5sTsgkrSNfqoUUgSepNd7zePv4qtPYXphwhsHQJQmZ:VE9m1Tey5s3ffqoaSeZ8v4qIphQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510341, "uuid": "9d0a4380-2e9e-4447-b3a7-7a040cb18784", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510341, "uuid": "22a5f81b-a4c7-40ad-9c89-b85686f500ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510341, "uuid": "7b10e90d-9768-4f25-ad00-74b025c0a14a", "value": "cbfffd4a3c9e48ff7e069f373788f623.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845a674b-11dd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1687535360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687535360, "uuid": "1c7d8a44-f40a-4657-99cc-88d73e12a7f2", "comment": "Malware payload (njrat)", "value": "67157b5044611d419cbf264e6c60b4fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687535360, "uuid": "08a8bc89-60c2-4b6f-a877-0783081075e2", "comment": "Malware payload (njrat)", "value": "7e2529bf89a9227da9f9fe7591b73a76eb2c4b22d3cac23db1e226b4371c3e57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687535360, "uuid": "30a6f25c-e3aa-4284-b799-5de88b7cd795", "comment": "Malware payload (njrat)", "value": "0c142859f8e15b0c5116a4db825fd82cd6a6aa00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687535360, "uuid": "2d94006b-352a-4115-87ed-5dca6441878d", "comment": "Malware payload (njrat)", "value": "cd405e9b3c3275839d9c4ce6bba86756ecafb48f0469839b730e150393207501d4d47f4c00eb9a185f070ffd159389de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687535360, "uuid": "bd27fd1c-3ca1-4590-a034-033f3461c518", "value": "T1B1E207067BE94215D6BC5AF88CB313214772E3838532EB6F9CDC88CA4B676D00655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687535360, "uuid": "5eee4bab-dd47-413c-a9ec-22a4f3077fa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687535360, "uuid": "dbead029-19d1-4374-bfbd-48df1fe70c2c", "value": "384:v0bUe5XB4e0XGOllMw0Q0mS03AWTxtTUFQqzFFObbp:ET9BuVlP55dTbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687535360, "uuid": "5bdeef3e-3620-454f-9fde-ea2ff6d31ddc", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687535360, "uuid": "ddac4310-f59b-4fb6-91ed-b2eb7d93a0b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687535360, "uuid": "2ddc2078-79f2-4cc1-bb3e-62d698da89cf", "value": "xPXLTItADRwv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70908c02-1188-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687498819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498819, "uuid": "3aa4d94b-ca99-4acf-bb67-b09bb3c476b7", "comment": "Malware payload (RedLineStealer)", "value": "00f66e9c5d9514b010b079031e1be2bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498819, "uuid": "02d08197-ede3-4b6a-8f0e-352f0524b3a7", "comment": "Malware payload (RedLineStealer)", "value": "7ed14677a288271dc5c0e2812a74df12369116a1cd4ff3abad60e39d1a3204b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498819, "uuid": "a36a92b1-c5e8-4e0a-8cb3-425b3a0623f9", "comment": "Malware payload (RedLineStealer)", "value": "669e88b257466d6ce425c0e2453cd0ac37aa746a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498819, "uuid": "f29e656b-6178-41e3-b280-91886243cb21", "comment": "Malware payload (RedLineStealer)", "value": "2b5eb793380403673fa52702d416717fb806d5ff7b6c4a4ee80bb9c2a4c86dfdb1b904923e7e4daf5464cec5680a71e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498819, "uuid": "515c1187-8e6c-4627-9b40-ac0ec0d8bb84", "value": "T18DB4F1CA26404833DF33D9F1D4AFEDD64E7A70210B7287CB121D8AF58E051E5A61B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498819, "uuid": "08deba6e-0be2-47b0-a081-5348c66b9526", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498819, "uuid": "549c2a87-ed58-459b-bced-e44afc5cf45b", "value": "12288:C+Bq85JTey5sqnvJDOI5YjZo6UFQmAYx5laMTFoiqp6b2QJQmZ:C+Bq8fTey5sqnxzPtAWTyp65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687498819, "uuid": "cf6178e2-28e9-48e5-a56b-71b645d86500", "value": 543040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687498819, "uuid": "6a3439b2-efb9-4b0e-bb96-2cc4a5e02214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498819, "uuid": "2d0fcc11-f352-49d0-b664-4e40baa41190", "value": "00f66e9c5d9514b010b079031e1be2bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b712f4-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501598, "uuid": "9a8dcdd1-3e2f-43b2-8a7e-b2a313653bbf", "comment": "Malware payload (RedLineStealer)", "value": "f3ec58e279e6205c2fdf73236f93f421", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501598, "uuid": "04eb00b4-258c-421c-bc7a-42723baf82f6", "comment": "Malware payload (RedLineStealer)", "value": "7f59f9b62b6ae6115409c007d3c8910bd21a593978ce7b40358e049795484cd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501598, "uuid": "0ff911bc-7075-4152-a6c9-b6dcc39b4e25", "comment": "Malware payload (RedLineStealer)", "value": "47c533fa895313e281cd2123237e8b3037db91ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501598, "uuid": "8ca65e75-326a-489b-bc44-5457cbc01666", "comment": "Malware payload (RedLineStealer)", "value": "e8fe7258ccf1a9cb47e3e7812b9fc6a1ce221672049d706943d3f715152fa56af73aef9797fef412783461d4a13546cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501598, "uuid": "3dee4c8d-ec34-4c8f-b109-d0ff960c80c7", "value": "T121B4F1DA35808533CF33DDF2D4AFE8968EBA71200B6147C7120D9AF64E452E4E51B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501598, "uuid": "2437d2e6-3fd4-47c9-86d4-1704db4e1478", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501598, "uuid": "24f13f2a-9ec3-4ffe-99c2-072e97103e63", "value": "12288:rP+cpJTey5sF/uAlqPw+/HvZFL1H/suymCMYeQJQmZ:rP+cHTey5sF/uRw+3Zr/L5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501598, "uuid": "c4b4e482-13f0-432a-8123-906d3862b440", "value": 540992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501598, "uuid": "5c1c420e-59df-4fc4-ad0c-689551e478e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501598, "uuid": "6cea5bd5-cdc0-49d8-93cb-9dd15df2450d", "value": "f3ec58e279e6205c2fdf73236f93f421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa02356c-11a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687512364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687512364, "uuid": "b27e9be8-f19c-4667-809f-6383ad61eef9", "comment": "Malware payload", "value": "4db8c565512cc67837560c3841d94a89", "object_relation": "md5", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false }, { "name": "sconengr-com", "colour": "#A461B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687512364, "uuid": "9ef3775e-b212-4ea8-ba44-bc3c10d40fee", "comment": "Malware payload", "value": "7f71d89a929cd639eb78ddc2fcee09acf23514f2fd67146f49b43ede3d1c7d43", "object_relation": "sha256", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false }, { "name": "sconengr-com", "colour": "#A461B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687512364, "uuid": "c9e2b1e8-8845-45d8-954d-2a46c9c677ea", "comment": "Malware payload", "value": "245166260698b94193342c73dd58840dc5f08362", "object_relation": "sha1", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false }, { "name": "sconengr-com", "colour": "#A461B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687512364, "uuid": "da4be4fe-21cc-4e3a-a35f-174b36e8c07a", "comment": "Malware payload", "value": "37edd14b13e32127cf9081fd2b40f963e769613297a471c7f5afefc0d05bbc975246816e8aeb4ebf0d9e9253f668ce87", "object_relation": "sha3-384", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false }, { "name": "sconengr-com", "colour": "#A461B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687512364, "uuid": "b011dd2f-6d02-43a6-ae3d-666ecbc912e4", "value": "T1ABB4232D2D377B5780D3AC74F655C8924BBECD06E8B542BAA241C585ABC31EC6134BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687512364, "uuid": "7dbfa569-0ed7-4206-965e-44940ceb6852", "value": "12288:um3vTV+xXu05mQEGLC2gtWnnAISxg/NtWau+paHzu:DvsR5mQEGJnAvaNtWt+wH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687512364, "uuid": "67ae0efd-0b9b-4c25-8517-8672e6114ff2", "value": 542577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687512364, "uuid": "04f7f3ae-01a7-4a38-b63c-352cb421d202", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687512364, "uuid": "e0203401-ebc2-4721-9f2d-faef996b5509", "value": "Scanned_CORRECTION-AMENDMENTS EFFECTED_SHIPMENT DOCUMENTS Sailing.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14698d4-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687501585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501585, "uuid": "fde35184-df9a-4155-bc2c-b332b24d0f5a", "comment": "Malware payload (Amadey)", "value": "f8bcda9e76a36c8afe6fce549772a9ef", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501585, "uuid": "de8cf344-8e2c-4627-810c-389698eeba1c", "comment": "Malware payload (Amadey)", "value": "81458009309c2ed3d7c188d6c718565a21c5e66dc9d479a92220a0433d70ef5b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501585, "uuid": "b899df0d-3054-46a4-b8af-473dcf51e7da", "comment": "Malware payload (Amadey)", "value": "e0ab515f6b5294b361b890954d7d522860557e16", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501585, "uuid": "83b2d1b5-2b8d-47ae-a8df-f0ba163e6158", "comment": "Malware payload (Amadey)", "value": "97ed8b9cc1fea4a604dd8634755ebd4b45afbdb8280c4f851cdca8472c03e84373628d5b42da5e50feb683e25d9ce1e6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501585, "uuid": "01e43a5a-722c-43e9-a48d-33e2d90a2a93", "value": "T17EE401CA61804563DF37CEB2D09FEE864FBAB12147A5878B130E49F18F455E0E21B679", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501585, "uuid": "86fc4fae-40a9-4f94-8cde-d2023be9870e", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501585, "uuid": "ff4f05e2-3e62-4800-a72e-a36cccbdbaee", "value": "12288:9EgcCTey5smqNiMb44Firx4apNkwyG8CLl9ikTBqu5rfZTB7jnQ18qQJQmZ:9EgLTey5smqNic2r2F4Ll9JssFdjSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501585, "uuid": "5abdc6c3-906b-4b66-8270-594b4293a48d", "value": 713536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501585, "uuid": "6fb56f48-dbd7-43e6-8b0c-e181c625411f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501585, "uuid": "0409815b-6fbf-4aaa-9880-5b0cdca3a49c", "value": "f8bcda9e76a36c8afe6fce549772a9ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c54fe38-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501282, "uuid": "e18fcbde-484d-4344-b86a-d728cf2c4d07", "comment": "Malware payload (RedLineStealer)", "value": "d3fce5404ae83fa3a1e3327dd7e0a31d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501282, "uuid": "992bc907-addb-4a38-addc-beb318866104", "comment": "Malware payload (RedLineStealer)", "value": "814fffb96a52a8ffcaef67bb87332785812c6599a7a8568f98313b6c1c0a5c8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501282, "uuid": "bbf3324a-c126-4b8d-8646-421477280f03", "comment": "Malware payload (RedLineStealer)", "value": "869c9aff99d317bbff11e3ef040529dfec14f6eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501282, "uuid": "67a5f2d3-c0c3-4174-a27a-12ebea458714", "comment": "Malware payload (RedLineStealer)", "value": "1d7230ef488f82b1a838cb8ad0ad163892d73d590e8f9ea6cea32272934d49b426328646fcfa62c2e02ae7194138ef12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501282, "uuid": "5c1c1e8a-b729-4cf6-8d3f-7b58af282526", "value": "T195B401CA24800973CF27CEF2D4EFE9D64E76B0214B614A83530D99F68E451D8F61B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501282, "uuid": "3ba06085-95e5-4638-bca8-d1ce0ec4b0fe", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501282, "uuid": "3d70d672-a3c2-49b3-b8eb-57bfda75f107", "value": "12288:myeezVTey5siw9/NKjUw/stwriGGDPNRQJQmZ:neeBTey5sV9NKj3/st+DGDPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501282, "uuid": "26b2613d-4baf-4567-a515-168b9045bdd8", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501282, "uuid": "2c907c6a-feb5-43c7-9610-9095f94d0f5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501282, "uuid": "b26ec9e9-ce38-440d-a4da-d707a37508d1", "value": "d3fce5404ae83fa3a1e3327dd7e0a31d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a37727f-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500983, "uuid": "e493c3a5-2c56-486f-955d-85e610e72cb6", "comment": "Malware payload (Amadey)", "value": "9402e03d34362a6e65ea982f4a7fb631", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500983, "uuid": "b5c52bec-1a8a-4823-a9e3-a3cf476e6836", "comment": "Malware payload (Amadey)", "value": "81a5f68059f9bf2bf171619429376bd42d041632a106e62c02090cd094f714c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500983, "uuid": "3bee024b-bdd2-49a8-a3d3-b9a998e0ebfc", "comment": "Malware payload (Amadey)", "value": "add10fd46e73536261669215ebdba5d090e929ce", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500983, "uuid": "5e2fe10d-d5e4-4b07-8158-d9f5a8e86230", "comment": "Malware payload (Amadey)", "value": "1c527d02d76ea78051ecd29ac8e28de6c01740f443d40a31adc793e7a0b43968788adf69ae1c6c2ed8f9c40db5181081", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500983, "uuid": "e2cbae1d-ffc1-445b-96bc-8a5b4ffe8407", "value": "T1C4B401CA25408533CF73D9B2D0EFEE964F7A71210B754BC7220D89F64E522D8A61B17A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500983, "uuid": "bd6e9500-9778-410d-b86b-50b22a288d74", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500983, "uuid": "2ff11937-3baf-49e7-97d2-852f26d8cc4d", "value": "12288:4eYJNTey5sHU69dabsD0g9+BKU8E6PvNbNZ0zQJQmZ:4eYLTey5sHT1D9BUIP1b/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500983, "uuid": "b5fc20e6-9a2a-4310-b49c-f949c76197a8", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500983, "uuid": "fd828655-f921-4630-a8b3-9984060d9709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500983, "uuid": "4a4ffdf4-9854-4cdf-9839-38f56e75a599", "value": "9402e03d34362a6e65ea982f4a7fb631.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3699299-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687510608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510608, "uuid": "8b161f2c-4e20-4e90-900b-907b561af8f4", "comment": "Malware payload (Amadey)", "value": "53eed09a70836efde3d6f1a67d024cf4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510608, "uuid": "3cf9a44e-198e-4642-8529-b1582eabf834", "comment": "Malware payload (Amadey)", "value": "81c1b636f19e9c19a8ff2b119ee2b240cb9d6921fafa10b98bacba957f1e9521", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510608, "uuid": "4056177d-9031-45d3-be2b-f102ff7f71fd", "comment": "Malware payload (Amadey)", "value": "190e8311befd0f41bd958619715908a4d2751b80", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510608, "uuid": "d7676aa8-cd72-4daf-b237-3787a628fa56", "comment": "Malware payload (Amadey)", "value": "4ade8fd4798c6953e8b959eb488f117163d2c529357ab7fb4ae18e886a4a9dd9e902df9e0cd63be41071f6eeb979c9ad", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510608, "uuid": "7319f933-6ad1-473f-9df3-72c69ebd870c", "value": "T174B4F1CA25404573CF23CDB2D4EFE8D64E7A70210B7647C7231D9AF98E512E4A60B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510608, "uuid": "9c5e7bd8-530a-46b0-ab57-49d37c35bd25", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510608, "uuid": "d6c3331d-1ebe-4e9d-aaa6-3ce99f888ddc", "value": "12288:S5C4rUfTey5sLkqzPJ34BFyDDAv5zSD8i7935GYWQagQJQmZ:WC4rSTey5sJCBbRzR69JjWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510608, "uuid": "3f6fc1fa-ad0c-434b-a04c-8e7d6f3aa511", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510608, "uuid": "b785cb20-f1e4-445a-8fee-85e1474a5d15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510608, "uuid": "07932a8f-2d15-4427-8c5a-5ba65acff4b4", "value": "53eed09a70836efde3d6f1a67d024cf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94409e2a-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687500597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500597, "uuid": "b876af26-1e22-4ebf-aee3-c50043df438b", "comment": "Malware payload (Formbook)", "value": "5c7761814faef677ad520784ca1eb78b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500597, "uuid": "7184b5a3-a427-4b8f-bbe3-0dc24fd700f1", "comment": "Malware payload (Formbook)", "value": "822c034d2867150fd3e4cdddd307e169a3f93fab20f5650396cbec81800bc266", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500597, "uuid": "a90b730b-1eed-42b5-b860-af1d1dc08f03", "comment": "Malware payload (Formbook)", "value": "4ede7720b03bc4da805587f5313f6bfad31e626d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500597, "uuid": "a6e9b0da-70ac-497f-b772-e31b74daa2e1", "comment": "Malware payload (Formbook)", "value": "91098852e1f094f7678f12e3b06b4d799a5a81290aedc7e4b02ac8731557470a35c5fe92aad5bbe7fe600e17f20b9a0c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500597, "uuid": "bb69a357-5b64-4e0e-b34e-ca924539f10e", "value": "T16D0523A1DEE379D281C70F830520269ED293D2830B761E37AE57F11B25DD3396C9A25E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500597, "uuid": "a723fa03-5ab3-4601-bc11-79f0e64db699", "value": "24576:+BQxwGKsoIjjklutu3z5doyaQQ4glFaaI:WrwMugDDoya5lFaaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500597, "uuid": "4e659e96-6490-4aec-b207-994bba9a7b34", "value": 801144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500597, "uuid": "6c6c492d-3826-424d-b206-2a9dfdb6967c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500597, "uuid": "ade077e5-8eff-4792-9852-76ff46674e6b", "value": "Mirus Packaging GmbH Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6c051c-11da-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687534056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534056, "uuid": "d8c08f22-2cb6-4235-b552-a05d3df0a606", "comment": "Malware payload (RedLineStealer)", "value": "650c697c6e039f9baf7fe627902637e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534056, "uuid": "51275bfc-8fea-4231-8c4e-68c2772419f4", "comment": "Malware payload (RedLineStealer)", "value": "828470d0978f131cc02c4f07dee6499f8e5e44c21ee313987109942fa53721c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534056, "uuid": "af879c9b-1a1a-4126-97c7-259d15d52eba", "comment": "Malware payload (RedLineStealer)", "value": "6630bc4e7153c3545a8fa3062f444af1533a1396", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534056, "uuid": "7c54a3c5-b2b2-46de-9f07-28f6bdc19e0d", "comment": "Malware payload (RedLineStealer)", "value": "24b3a824599b059377d3bae8cacf0ee438f65fb92328af6d5005ce88465ffc411c4404213962f3dbf5002215a7582307", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534056, "uuid": "7799512d-dcbe-4bff-a973-ad18bc1f1f3c", "value": "T14D55AD83EF491973EA812473E92F77932842A4F1139FB0BAB35F0A96D65383D0574798", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534056, "uuid": "cb9ee738-f18d-46f5-82bc-5b94bf9d78ca", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534056, "uuid": "1fd02073-7c3e-42b1-af16-c15abc38d1c1", "value": "24576:iK1e4WG52M3FX2Rvu21dy15p5mTYoZ4bBPWdOaIOwyvp/QrHB9nsrKkFBjAfzKIE:nXFmB257qYoZ4bEdOaIdIGDiKkDjaIv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687534056, "uuid": "7f7a0278-2999-4cc9-a3f5-6fefe51ee96a", "value": 1358852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687534056, "uuid": "c9e21801-7cfd-487e-bdb0-538176077d04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534056, "uuid": "1a3dc199-2dd5-47d7-a95f-e8d634232dbd", "value": "650c697c6e039f9baf7fe627902637e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0e63d8-11fc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687548684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548684, "uuid": "33fe8aa3-701a-43c0-96fd-669c14d26268", "comment": "Malware payload (Quakbot)", "value": "da523131749d28e5376348af7d297b44", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548684, "uuid": "68007599-abb8-40fb-98f7-8469f912b746", "comment": "Malware payload (Quakbot)", "value": "8386c26ef88062db37966613ac32debe4ec5be1e44ea42ae89d8ad7fbf3f83e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548684, "uuid": "5f349ae4-0947-4b24-8ca1-c22357935a96", "comment": "Malware payload (Quakbot)", "value": "c59d63e8decc63ff82ed10c381675f1ba32d6df8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548684, "uuid": "aeca101e-1f1d-4650-ac9d-311db0a510e0", "comment": "Malware payload (Quakbot)", "value": "8cec48d1a3095840f15ae8a41565044434863ce508d3ab9a049ff0a711e9b9e4f54a3ae468b15279d5dcb32fb6afe74b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548684, "uuid": "cbcd816b-6898-4939-b1bf-30ca0abceb2a", "value": "T1EC558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548684, "uuid": "45585d1d-8c00-4581-8780-a619aa6e83c6", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548684, "uuid": "192b377d-3631-465e-9ebc-81ad8fef38b6", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4yIQ:QbkS7XB1EsOSNPSp0EAt2bUeM4yIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687548684, "uuid": "b8a82d56-283d-4b6a-9366-dd4e61bb6dfb", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687548684, "uuid": "e4b4f9be-831a-4edd-a3bb-d261c2de2c31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548684, "uuid": "b57eab36-9626-4f4b-a3b8-b7c59e795dda", "value": "09qbot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b99415c-11bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687521091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521091, "uuid": "b6a0bb69-e6d2-4ec7-9be1-f7883dcfa3ab", "comment": "Malware payload (AgentTesla)", "value": "5cea347d6984102fc1ca70a11d8309c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521091, "uuid": "ab5c66ac-fd81-44a6-8cea-399409a222ab", "comment": "Malware payload (AgentTesla)", "value": "83d3644a239ef9f0353c7387c55f76c1c5aa30eb1d261b5035aff03db365e9f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521091, "uuid": "d33c93a6-e9be-462f-ba7e-f41b012f208e", "comment": "Malware payload (AgentTesla)", "value": "526e1e553d4ec1779f8a1052470d8786199f6d9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521091, "uuid": "ab5813a7-8a50-4a82-bd65-10afc01482e3", "comment": "Malware payload (AgentTesla)", "value": "57fbaccc3b4c6572cefa910c79b1fddf9d4d2825ff5f40f8009d1f58e8a4be3bd8f4a9510d109abe6d9917637c4ec399", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521091, "uuid": "b19b750d-f23d-4266-8840-9eb7fdbd8db6", "value": "T12ED4121622940F19F53F9FF925B44560C3B2FA519B02F23E6FE620F105A3B519E02B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521091, "uuid": "a26aa719-b94e-46b7-a10c-eeb19a03727b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521091, "uuid": "eaade834-a8a6-4c38-b3e9-7f6088434812", "value": "12288:J2iNG4/mNUAf7hNroGh9gU6BsMjZeoN3uhpDFjyHID:J1M4/QUi7oGOBsMlnN+pDtyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687521091, "uuid": "acd78039-8a8f-4572-b5fc-f1823484a0a8", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687521091, "uuid": "f07bb922-d349-4378-aa3a-7ea28878348f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521091, "uuid": "9270bfed-cca8-444f-b3b3-36377646aec7", "value": "5cea347d6984102fc1ca70a11d8309c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335f8e59-11c6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687525345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525345, "uuid": "1540aa85-8c28-4fdb-988d-a2d8bd3f05c2", "comment": "Malware payload (RedLineStealer)", "value": "6574cd99c19b3505fe2f7a882314b8e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525345, "uuid": "c00de3e3-4d32-4d75-b4a5-18ba2d8dda76", "comment": "Malware payload (RedLineStealer)", "value": "8417106bf26375cb725ffb01cc8a263280770ff3f4d922f4925d6f630ccb502b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525345, "uuid": "6921809b-5035-4c9d-a137-b75349cf22b9", "comment": "Malware payload (RedLineStealer)", "value": "0fe9980ae4ae2d697638250bd47ba63cd9b1d1ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525345, "uuid": "05070cd1-424b-49bc-b273-d27cb80c1b18", "comment": "Malware payload (RedLineStealer)", "value": "c0892a2a4d0a632c455366195345999c819ec85a541b58a268a7aca34890f2496948de221311a2fc31ae55cce2298a28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525345, "uuid": "351428ec-58aa-4d17-8edc-58fb83e66346", "value": "T106B4F1CA614045A3CF63DEB2D0EFF9D60E7960210BA64BC7130D5AF54F456E0B60B6BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525345, "uuid": "4e6b7298-fab8-4252-b6cd-dbbddeb5ae65", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525345, "uuid": "31692cac-cb3e-48e0-b07d-5e529a6c7aa0", "value": "12288:nwepTfTey5sCsWpBBT93PKoA47b5+duzNWdWTO9QJQmZ:nwep7Tey5sCrBBT9nJ7bY8pV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687525345, "uuid": "f05697e2-3640-475b-9c60-f519226ea636", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687525345, "uuid": "2e9a2274-2b28-4586-80b0-27607766671b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525345, "uuid": "bb74a5f4-8266-4686-9e57-e692ed4b847a", "value": "6574cd99c19b3505fe2f7a882314b8e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc37bc8-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500665, "uuid": "06289373-88aa-4d59-b23e-50d864747997", "comment": "Malware payload (RedLineStealer)", "value": "a433d9f2bbcc459f67f1e86ec33ce704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500665, "uuid": "7629403d-497a-4744-9a26-c25be6c52d89", "comment": "Malware payload (RedLineStealer)", "value": "846d95c1797b69b1126e084ef0d8f6dca6a23b7ec5ad4ff78dab108647442bb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500665, "uuid": "db171495-92df-4ad1-ac80-840542f369ad", "comment": "Malware payload (RedLineStealer)", "value": "53701c0b69777b1cbf25913204af4e2316bd09fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500665, "uuid": "32bcf277-4772-4733-a0ee-fc1e1cd3ad02", "comment": "Malware payload (RedLineStealer)", "value": "7f2074642c837c1a2178bed529cb836a6a607d61c9c57cef0dc8be86add239b95e06daa53d35134d869d96552a14fd06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500665, "uuid": "1094c555-1829-491b-8646-becee55311f0", "value": "T13DB4F1CA21408973CF73CDF2D4EBE9E64EBA31210B724BC7120D89F64A515E4E61B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500665, "uuid": "c93f12d3-4f91-4257-a2cf-fc570b9e9cda", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500665, "uuid": "6572162a-985e-4eec-854c-98a9b7091421", "value": "12288:rrq0O8YTey5s6/y6Q6YZEgrc4N2vQTunE+AQJQmZ:rrq0OpTey5s67+i2BTuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500665, "uuid": "2e6b3b36-876f-4a55-a7fb-8ae0fd2af74c", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500665, "uuid": "e7e205a0-e371-47bd-aacc-3844f9415acd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500665, "uuid": "73988b7a-8998-4807-9539-a164f267bdea", "value": "a433d9f2bbcc459f67f1e86ec33ce704.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350359a1-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687501296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501296, "uuid": "c1c1305a-0df5-4b64-8a8f-671d5d515fe3", "comment": "Malware payload (Amadey)", "value": "e5e1d5f574dbce8ad56420a77443c839", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501296, "uuid": "b4889022-186a-4b43-a396-277075a9d97e", "comment": "Malware payload (Amadey)", "value": "848d49656438d98d0f4dd1c6eb591bdd9066f7b21f2dcf91c6b9f1ef2d15c6cc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501296, "uuid": "345b213f-e079-4a66-99be-7037b986b261", "comment": "Malware payload (Amadey)", "value": "665b00da2119cfa429f41cc4f11ea003579c1145", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501296, "uuid": "f5357c54-a160-404d-8af4-b00828d0abca", "comment": "Malware payload (Amadey)", "value": "a0eef11699c8bb589e9fac90f452c7882840460904a6d7a7cbc1125a2d78a163d27aef40d0b5c778b173ef110dfcdf63", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501296, "uuid": "5d7e0625-1417-4a0b-aa10-bcc46d5fe876", "value": "T1BCB4F1CA75408973DF33D9F2C4AFE9C64A7A72210B714BC7120E4AFA4B416D4A61B53B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501296, "uuid": "9794a969-e3e2-491b-8faf-4ea67688e907", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501296, "uuid": "380bb4cf-b8ff-4c73-a2bd-8c61babcd2e9", "value": "12288:eI1/9Tey5sX/Nc8rZP9sULhxJ+/kkPSJVZcuQJQmZ:eI1FTey5sXyqjLhHnWkVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501296, "uuid": "04285707-659a-4bdf-9784-b428c9b40b36", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501296, "uuid": "9d6cfad7-023b-4f10-bbe6-6fbbfe1b2957", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501296, "uuid": "7bbfe6aa-e687-46ce-9bab-53ecd1dc0030", "value": "e5e1d5f574dbce8ad56420a77443c839.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e8c4fc-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687501294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501294, "uuid": "9d54375e-1764-4858-9cfc-1f3a0c8ded08", "comment": "Malware payload (Amadey)", "value": "e9d33407c4190b8bc7dd6bf25986b481", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501294, "uuid": "4a6ed20d-19c4-41aa-9eca-ff0495ac667c", "comment": "Malware payload (Amadey)", "value": "84d1f573c7fe6101d3aac115049a39af76fff74d0c1764aaef650dc5d4ba4f25", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501294, "uuid": "85f304e3-684a-4fa8-8457-074b61354b1d", "comment": "Malware payload (Amadey)", "value": "20600bce5abee0a63c41a7c9cbdf949db0fcd15c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501294, "uuid": "7d860c9a-31b8-4738-a819-719630d4b34e", "comment": "Malware payload (Amadey)", "value": "fb52e843fc746dc8d94732c40263a6b5281f6beb63ae16aebebcf4f65d373fafa156942c2a53d02572f2ea91c8fd9b81", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501294, "uuid": "7fea4822-065d-4c27-97c5-c97ceebe640b", "value": "T1E5B4F1CA264048B3CE67DDF2D4EFE8CB4E7A712107714BC7030D49F68A516E4A61B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501294, "uuid": "a6f04e3b-6fb1-42f0-a402-1869c99308a1", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501294, "uuid": "3429a1b9-8bc7-492b-a2a3-eaa35743fd2b", "value": "12288:RBVcPTey5srwfWUwKkleyFr3yR27w5YQEN1FLwnTpkVMQJQmZ:RBVWTey5srmWXleM3yR2w5YPFOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501294, "uuid": "04dce37a-3935-4ea1-8a19-bfae0188b14d", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501294, "uuid": "7ec134f2-f750-44a5-b161-cf5883dd4883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501294, "uuid": "6332aa5b-5d8a-4f1c-9b5f-17e71ac89306", "value": "e9d33407c4190b8bc7dd6bf25986b481.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d87f6d1-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687510303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510303, "uuid": "19e13cb1-cc20-4ee0-919c-0017df18dd11", "comment": "Malware payload (Amadey)", "value": "48f1ebf309d66a608b9b86df9e6541bf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510303, "uuid": "f05afcde-f093-4836-9280-8564bced0166", "comment": "Malware payload (Amadey)", "value": "8501f38b8e1c0c5a99a68e7133614652a1e85848cdd399bd733a370642160f26", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510303, "uuid": "c8f13f47-fc8e-4ea1-bcc7-ae0f581e92da", "comment": "Malware payload (Amadey)", "value": "9da01de53326834b387c90fde64c78320aef1b3a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510303, "uuid": "94084e16-7d8b-40d1-93aa-5fd9a8090e0c", "comment": "Malware payload (Amadey)", "value": "572005bf643d9e97c4bcab2f7ecab75da340827e9c3c4b35098f7698a194dd47e4ff28584a05978fcb844e21c1e2854a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510303, "uuid": "56d04f62-6c9d-4b0f-b25e-e9b93278f9a6", "value": "T134B4F1DA21804973CF73CCB2C0EBE9964F7970210B654BCB130D5AF94E852D5A62B97B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510303, "uuid": "d08de8fb-aa58-41c7-b4ba-cbe31a90d159", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510303, "uuid": "58ef35fb-c5a5-4371-bcd7-e894dd1ddfdc", "value": "12288:hee25Tey5s7HPtF7LLcDLMYrOno6QJQmZ:hee+Tey5s7vtFLADLvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510303, "uuid": "521b0694-a885-4e2e-ad85-6a23677f5ed4", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510303, "uuid": "0a564c2c-791e-448b-b579-ef5aedb972c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510303, "uuid": "8cfca564-a058-4d22-b334-113c66e39709", "value": "48f1ebf309d66a608b9b86df9e6541bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4206fe-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687510299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510299, "uuid": "5db955e3-ee8d-49d3-987d-b7dd44a93fab", "comment": "Malware payload (Amadey)", "value": "24239196d8c41d15652831cca1250655", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510299, "uuid": "5ae86439-837b-444d-ae83-ddb9332da9b2", "comment": "Malware payload (Amadey)", "value": "8533c12e9eb5af4589a1e0709e2ff953fc2c31c4d1f3e6a99ba30f646cda4995", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510299, "uuid": "e3ba30b3-6ced-41fb-8f97-e45918d025c9", "comment": "Malware payload (Amadey)", "value": "7886305a72c46e74f6c6329cd4c52391bd72713a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510299, "uuid": "4bcf135a-45cb-46cf-9390-6737741a077b", "comment": "Malware payload (Amadey)", "value": "d3834dafd8531c4f88e3a6161433b557cb33f3005e0b90810d063c0ecf38dd558dacae7b2f16a5616adafc22976dcdf7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510299, "uuid": "ba342268-30aa-4608-9d32-97f4ae7575cc", "value": "T1CAB4F1CA20408973CF63C9F284EFF8E64E7A702107754BC7130D89F68E556E8A61B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510299, "uuid": "4a5f318e-422f-447d-a399-7dc207b2848c", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510299, "uuid": "78fa12a4-709e-4cbf-8ae0-da2cfa6fb700", "value": "12288:S052fTey5syravwbuVvnPvzKtg8+PJbI2S7QPkCQJQmZ:S05kTey5syrWVfP2u8Ui2S7E6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510299, "uuid": "7fd034b9-c348-43a4-b322-25b0ec8e9fe0", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510299, "uuid": "83e80429-ff4b-47f1-8b2e-279ef7af10fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510299, "uuid": "4a224ff1-5d5b-43ba-9438-493b8fa69f80", "value": "24239196d8c41d15652831cca1250655.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a4a01b-1190-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687502294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502294, "uuid": "511a6d94-dd49-4d02-bcab-f2416c9f1e58", "comment": "Malware payload (AgentTesla)", "value": "d4c2a5e99847ee0c522fb28f51cbe282", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502294, "uuid": "f391ced5-de62-48d0-a3b1-f0417b6827ea", "comment": "Malware payload (AgentTesla)", "value": "855d86a041b0c711e63ed79ec626cbca5a9d7690f115bc2b71c7e534acfd9cf7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502294, "uuid": "05ccc3b0-a61d-4854-bca4-324d1d6b6d6b", "comment": "Malware payload (AgentTesla)", "value": "d458bd44b26c42d5dfc2d7d9f625f3da2cb542ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502294, "uuid": "25620ca4-2f8e-4cb0-8deb-c7bb49280baf", "comment": "Malware payload (AgentTesla)", "value": "26d8c43bb81c78e2d1e813894fbd5f76f29d3e4488cd736eebf48edd3507b481f0f29b394c5aba3acf4dd04f3e867bf5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502294, "uuid": "bb7f9932-dc84-49af-841a-5828eaca5c94", "value": "T17A92D02F9B0F4035E7E7C23AB2844B42F75C1642A7EE81BD6C61B0D9B693C531B6244C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502294, "uuid": "608eeab7-816f-4a3c-be2e-2602d04c62b0", "value": "384:Y6R7K115jk3B5WGtel5Yx3VaG4/2FAd9pSZ1C4vNGgSeiJUm7yxjPC6cLBfxV:JJW15g3j+lux3P4+adjSHC+8j5puxjP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687502294, "uuid": "64a55144-e880-4b05-ab6d-d9d5324a3714", "value": 19907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687502294, "uuid": "5e1a83eb-14df-4b13-a5ef-facfe3198e4f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502294, "uuid": "b667c8d9-59c6-413e-ad3e-e75cad753f6d", "value": "ORDER TSB489000USD530KKS8679, TSB489000USD120KKGS77863.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13944193-11d9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687533452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533452, "uuid": "1a7abeac-9166-428b-9c24-49614ed9b7f6", "comment": "Malware payload (Amadey)", "value": "95e7a354b7f0c975bf2cd9b8d153733f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533452, "uuid": "cd0a2994-96b9-4261-b81c-4587c13618c7", "comment": "Malware payload (Amadey)", "value": "85db2d7a82ef5c31f46c59f0bc497ff796183549d6bc177577a14037dab0d202", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533452, "uuid": "222fa57f-78d6-40e3-89e8-309b3302413e", "comment": "Malware payload (Amadey)", "value": "e63aa66276fcadf682da95148c1e848a494d8d35", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533452, "uuid": "94ba9c23-2b5d-475b-8168-38b70bdd1432", "comment": "Malware payload (Amadey)", "value": "e66248d0c824857a72f522added868305a8ed462137156e02aaf970ff15402c6841eb4c92f1f795d647248fcfea09b38", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533452, "uuid": "7d16d981-8f5a-464c-beb6-8f3683080b9b", "value": "T1630612792900E673EBD72939C5A7529F48596AB0065FBC8A7F670C3799A34DCC030BD8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533452, "uuid": "3be8a55c-1f32-4161-b4cf-edf1fae1382b", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533452, "uuid": "8f30b70f-d372-4231-8116-5096c645e16a", "value": "98304:L/35fPgoy/sgkXxcjAr7+s+/Ug4BfYQJr/qsrfoMZBjcQUPAvydIPAuVuqBcsnkx:L/35fYHMS/Ug4BfYar/DYQUYvyywmky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687533452, "uuid": "63d56b8d-80aa-4ef9-893a-feb511447f5f", "value": 3784704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687533452, "uuid": "1e978f73-ca5e-4838-b7f1-da15bba254a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533452, "uuid": "f54fbe26-600c-41e2-8e48-7a4c1fa010a0", "value": "95e7a354b7f0c975bf2cd9b8d153733f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38cd1bf0-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687510322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510322, "uuid": "5524d58b-fd39-4ce0-bb48-47e7d35d0cd5", "comment": "Malware payload (RedLineStealer)", "value": "5d3c0d095be4f5def99d514834a390b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510322, "uuid": "7f9254b0-af31-4c27-9803-8e7b0a4c2bd0", "comment": "Malware payload (RedLineStealer)", "value": "85df34dd2d18f50b53d23692584502bc1241b2e998fb1266f579061b6941f82c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510322, "uuid": "6cfc290b-0ddd-4daf-bdef-e34e9358f4de", "comment": "Malware payload (RedLineStealer)", "value": "63140c0365d3837a00ca000a3b92f6eac6e20505", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510322, "uuid": "9f4ca368-8806-4723-8233-8977ef4390c6", "comment": "Malware payload (RedLineStealer)", "value": "50e605c587ccc5f695c75c05d0fdd52b3fa9da550eec1fde216ebd8f726f370d0fc4942cf3c560b5970cf01198ee82a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510322, "uuid": "dad81bac-52a0-4d00-8941-76b49af186c1", "value": "T181444BFB52D1D460DD0FA4B02C5EE1BDEE31B461DEA284CA1ABA0952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510322, "uuid": "40f9eb78-fd87-4269-b97d-d67aeb127fc0", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510322, "uuid": "a0f9daef-f654-40d0-bdce-6a8d71b517b8", "value": "6144:Ue+upigt0poiRG/XvLNUgYhuE22uQJQmT:Ue+xgtAoiRG/fSv2QJQmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510322, "uuid": "3acf1a07-caeb-4ea9-9d89-4fb681065665", "value": 275779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510322, "uuid": "d169b975-85ff-4124-969b-7a82344ad2ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510322, "uuid": "39369f25-9d9f-4560-984f-4cb4494a8225", "value": "5d3c0d095be4f5def99d514834a390b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301f1e66-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516320, "uuid": "b9b4a6ee-baeb-49d4-b29a-5cb5da47ad0b", "comment": "Malware payload (RedLineStealer)", "value": "2e1e4105a1df1a38102e42fe28d98a74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516320, "uuid": "640c3bba-64f8-49c2-a514-6e9d5ee03e05", "comment": "Malware payload (RedLineStealer)", "value": "8639555d6cde2dce1604b97c77e0c8fdddf84e32e2672cecb72d6f36d5aaf2e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516320, "uuid": "fea38f3d-13f0-4baa-afce-955ec7c75adf", "comment": "Malware payload (RedLineStealer)", "value": "0981395b0a988e23cad5a3fc5d2907d78ae873e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516320, "uuid": "e4cfb3bd-c7c8-4ab9-ad31-69fa4332bafe", "comment": "Malware payload (RedLineStealer)", "value": "ba39244e1583c4417541b93628adb3a75018c76ed93303f69895f247e7ba35d36d4ff1a0f67f3aa9a642ec0c614ca0b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516320, "uuid": "90af19ee-9255-4ec9-b2ad-ab86d45c9106", "value": "T187E401CA76404627DF63CEB1D4EFA9C34F7862250B354BC7120D8AF54E86AE4A50B53E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516320, "uuid": "5ac7ac66-4d15-4731-ab0f-a2d74d96f4a4", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516320, "uuid": "7200af90-b8e9-44f6-b6cf-8271581c8ba6", "value": "12288:JRkQgmTey5sd/qCaVupFeboi35GCwZjJ7uumXK9pV0x3iF6QJQmZ:bkQnTey5shhqupne5GZ9jhpVwSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516320, "uuid": "65dfb32d-35b5-482f-a82f-04fc3e3108a1", "value": 714048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516320, "uuid": "bc6a414b-15e1-41b1-8bee-cd99a5b59803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516320, "uuid": "34623dc4-666b-4866-8221-0c3fa4f7d82e", "value": "2e1e4105a1df1a38102e42fe28d98a74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba5b388-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500046, "uuid": "27290e1e-a05d-4126-abb7-657d05096759", "comment": "Malware payload (RedLineStealer)", "value": "5fbdc93b1026d7aa21109e8393a70986", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500046, "uuid": "c16f3dc3-e801-4d38-987a-7e9bb9af4aa0", "comment": "Malware payload (RedLineStealer)", "value": "863c00f5624678f78b6668618ebcae6e2ca0aa7b5bd82b8ea8cb75f95c65d9a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500046, "uuid": "a2abfa88-b6ae-4697-a253-09e65a5576f9", "comment": "Malware payload (RedLineStealer)", "value": "5f262e2485884c04b672d0b1b5acce39263f4520", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500046, "uuid": "2ef9c132-2ca4-4043-b79f-2f863a64da5c", "comment": "Malware payload (RedLineStealer)", "value": "e1987f3371f3c278fdb0e13edf08309defc581b50ac3914114cfcf9bae46ac9b9ee04c4e7fca36615bea17ab6c56b04b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500046, "uuid": "ee006348-5590-447a-8e90-2ba7d0d2e4d4", "value": "T18CB401CA61804973CF33CDB1D4EFE8D68E7971210B614BC7231C99F68E551E4AA1B63A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500046, "uuid": "d570c663-6af9-41e7-9628-b7c03ecb8f65", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500046, "uuid": "a31c3935-c34b-416c-bd7e-dfb29cd07ab3", "value": "12288:U3oAA3Tey5sXrGbYxDpQd4nCBT8ntYyGL1YQKQJQmZ:U3oA2Tey5sR1pZnYTMYpLu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500046, "uuid": "6b3b29b7-1883-4d42-b4a4-bbedf66f3d3a", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500046, "uuid": "8681c98f-479f-44e5-948b-c5d6a6779e1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500046, "uuid": "9f5be17a-3f4c-4494-b1ac-d00006f8c556", "value": "5fbdc93b1026d7aa21109e8393a70986.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7b9169-11da-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687533976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533976, "uuid": "f0a23fbd-1057-44c8-9968-d9b179735050", "comment": "Malware payload", "value": "5d689ec59594a8db04edb4d067863a6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533976, "uuid": "f7607139-af40-49c4-bd1a-2576f5ae1468", "comment": "Malware payload", "value": "86720cebad6762a4e050a1eb8df5b4fc76460152d9c2330d3e37ea6e64b4608b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533976, "uuid": "d99a8d15-fa0a-4737-b2ea-cd38d40c406b", "comment": "Malware payload", "value": "a57a11cdeb650990e90485db592e97ad7be6ed8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533976, "uuid": "fbe5422e-615c-4a1c-a08e-ecaf8bd94537", "comment": "Malware payload", "value": "a355f5aadbaf771257640b00290951ea863599266b5f9cda2283bf7a2f4ef53fd7a42d46c36b8620e4e919413b784058", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533976, "uuid": "45271546-e66d-45b1-8fab-c588239b0eec", "value": "T1A074E672B2F541D6E1AF16B1EF6A4E1001E2BCBDECE1930ED5C8395695B23C1209A71F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533976, "uuid": "b08e076e-8874-4786-aa45-cda5d221a25c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533976, "uuid": "0478648d-c0cf-411f-9510-c4d568fee2d2", "value": "6144:Nkzpkc86ueZHV56NwBAGhQuImtCoGRmd+BUKCP5LtuEulM:686uNNwB7CTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687533976, "uuid": "55d7bd39-dfa4-4983-b042-877b4dc8de93", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687533976, "uuid": "becf356d-2e7a-46a3-9101-1d0912563088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533976, "uuid": "90a97187-ae26-417b-bdf6-56d8796f265b", "value": "DHL KULI500796823__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0216afb3-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500352, "uuid": "13bdc280-5b2f-4c63-b75f-30ea236603d0", "comment": "Malware payload (Amadey)", "value": "7edc0c7338f7a307b7edcb728ac2b761", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500352, "uuid": "98ec3b6e-462f-40ba-a132-b3675888570e", "comment": "Malware payload (Amadey)", "value": "86cf7e2d8f16df730547a7e0320acbdd4714e71d083ac10045aaa68241c69a29", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500352, "uuid": "e0b4fba3-d271-4e6e-890f-30b11b40a30e", "comment": "Malware payload (Amadey)", "value": "9fe801c4b76be7527dc1e4d846cf43430734d11a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500352, "uuid": "625cdbbd-fc0d-4e8f-9a50-4fe6b0d99bc9", "comment": "Malware payload (Amadey)", "value": "78eb87e804e959f43d5cd96b6d5a4bc7d595a608d63bf24d734399a71ba523a77961666d0203882a57d8603bb409d969", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500352, "uuid": "f08fbd37-eab5-4628-a2f5-99b7f748663c", "value": "T15DB4F1CA76400473CF63DDB2D4EFE8D68E7A71220BB18AC7120D95F54F426E4A61B53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500352, "uuid": "91092de2-b2a3-4f8b-a01b-f0beda8eada3", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500352, "uuid": "bbfbde48-0011-4e1d-b71a-a7ef4a448ed2", "value": "12288:V3EAZjXTey5sD1OdBIokJaNXz96XDzIdhQJQmZ:JEAdTey5sD1OdCoUaN4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500352, "uuid": "e0cadf42-645e-48e7-b00a-f27be5ef3934", "value": 540992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500352, "uuid": "f4c1d45f-7c03-4d0d-8f9e-dd94abf71fe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500352, "uuid": "0251625d-6636-4d48-a410-f79ae083e4b9", "value": "7edc0c7338f7a307b7edcb728ac2b761.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a070fa20-11bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687522522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522522, "uuid": "9a39a6dd-37f7-4828-956a-9e51ed7c3f8a", "comment": "Malware payload (Formbook)", "value": "3ec85ae7b9827d811d77de50bfc05d55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522522, "uuid": "28a5fff5-eb6b-472e-a48a-ade6d409967e", "comment": "Malware payload (Formbook)", "value": "86e5af89c88058cd0ed1e94c67bc931727aabcbd6a817776a979bfca282ea488", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522522, "uuid": "d3ecee1d-0b74-4f00-bf93-9b60231be761", "comment": "Malware payload (Formbook)", "value": "d92d9ed7e0165f3d93e98436bb99cf7875e99d3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522522, "uuid": "63b2dbb9-4c8c-4ea3-ac52-0945bb2170f2", "comment": "Malware payload (Formbook)", "value": "b64928dea6d7774a4fb0b4914cc9a963ac3541199445adb93d2afc334efeb3b457ad9cb6d2eb2bb6cb5947a62ff9e626", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522522, "uuid": "5407c0e2-0c04-47fd-86fe-1b05b3ef2491", "value": "T184E4122A52F00F59F27B5FB578788150D3B9BA855613E32E1EF420E20673B129F12B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522522, "uuid": "e33cd3cf-a5fa-49e6-95bf-319d63f2ddcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522522, "uuid": "bb3a3522-5d78-4af2-a59e-22b35f3bc194", "value": "12288:v2iNG4/mNUAy/4nHpdLZUISgQVedGjZ3DoAWbjakRuq4+W:v1M4/QUYnJFqfVedGN/Oj5R74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687522522, "uuid": "ec7a7fca-d348-4044-8de7-4846bbc970dc", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687522522, "uuid": "dde653e0-a4f6-4142-8e4f-18e93c723ec1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522522, "uuid": "b170103a-4f6f-46ac-8946-9cd29b2fd65f", "value": "rIMGSCANN01Bankassicopia.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e711b2-11df-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687536164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536164, "uuid": "636053af-6495-43df-bc93-0dad7243a6ab", "comment": "Malware payload (Amadey)", "value": "078c1f757693b46fc23606b4ddc446a9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536164, "uuid": "58628dc7-ab03-42ef-b14b-339d28304cb8", "comment": "Malware payload (Amadey)", "value": "87110b5760efb27f9c86aef51ae91d7f8cc10557537b1b9ed407c6cecd118ed1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536164, "uuid": "21a5afeb-36f9-4de6-9306-07bd99246c35", "comment": "Malware payload (Amadey)", "value": "35752320a0b8a0cabf7db4be088b26ea3673f5e3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536164, "uuid": "035c1713-f39d-4c1a-950a-2abe4d9440b2", "comment": "Malware payload (Amadey)", "value": "f6156e7eeaf40daac6299691dcf64259ee1fa2f0eace184c761dce631ae48aaa153f7d462c3ee717dd2cb21268a21dcf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536164, "uuid": "e902c3b8-f4b2-4c18-88a8-711e8b121f00", "value": "T1C40612792A04E233DBD72531C1A3969F189C66B1164FBC4A3FA70C2BAA934DDD035BD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536164, "uuid": "39b95a2d-00b0-48a0-bb49-a3232c5f2369", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536164, "uuid": "f60f4165-1909-4009-a6b1-518bcd0cfdf1", "value": "98304:eIpWnhcUVN/timN9CBRLZmjRhFb/CLV94GBdvyglhH7B9yU5PMQPEcB1yqmup:eIp4Jti5KNhFb/uBThFcQsVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687536164, "uuid": "820d95fb-786d-49b0-909f-c2254ffcf468", "value": 3788288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687536164, "uuid": "3c36eb17-c226-4d1b-b233-819f16fe5ee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536164, "uuid": "2ad3c03a-7eb8-470e-a7a5-1a13c07d42ad", "value": "078c1f757693b46fc23606b4ddc446a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec51788-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500078, "uuid": "a59a8863-98fb-4a27-aa1f-3389e5d45f79", "comment": "Malware payload (RedLineStealer)", "value": "7510d4812bfe7458a25892e4edc8361d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500078, "uuid": "5115075b-4482-4f5a-9674-0991581ff173", "comment": "Malware payload (RedLineStealer)", "value": "878b8bad60ddbab8bff28f1586fdc045ad1876b781f29ffefca311503ed938a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500078, "uuid": "38e50d10-cd0a-4e4d-b8a0-a437dea2ea05", "comment": "Malware payload (RedLineStealer)", "value": "5fc1a78e7efa47790579dee603adf3f6d4a91d07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500078, "uuid": "0c3541fa-9bde-4da6-9dbf-617af1cc1bba", "comment": "Malware payload (RedLineStealer)", "value": "e94447d62b720c588598f8fb3cb93ca9eceabbc0784e825284e9acb8a02cf33377257a57be792f90c729abc2525ed419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500078, "uuid": "21108687-0e79-4cd9-af38-616a6af493c7", "value": "T1EBE401CA61804967CBB3CDB2C4EFFAC79E7661250BB247C7120D09F94E465E4E60B53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500078, "uuid": "d9892e2f-27c2-4353-a97e-f9c8310bf43a", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500078, "uuid": "a8e353ee-ca64-44cb-9452-7096f3f12c85", "value": "12288:DgqXNwTey5skfl2uMAC8YxvSdsWo5sJbpqy1aT3w4dp9ZH1ar48sjQJQmZ:sqXmTey5skdhMf8Yx6xppeN7H0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500078, "uuid": "454d027b-bb2c-46d0-a283-7e6e11f4d995", "value": 715584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500078, "uuid": "88a73fa9-ab15-486c-916d-8ccb75ffd0b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500078, "uuid": "cd26ae22-f807-447d-bbfb-6f49385d12b3", "value": "7510d4812bfe7458a25892e4edc8361d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac7aef3-1190-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687502407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502407, "uuid": "61f3f8a6-14e9-4048-a5d6-f46f40a9ed69", "comment": "Malware payload (AgentTesla)", "value": "7e3ac546b33097355d29cb39f90a39d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502407, "uuid": "52dc5b1a-f641-41b5-8fb9-ab03265412f0", "comment": "Malware payload (AgentTesla)", "value": "87906945ebd70a92dde5f4acfa84cc5896adc712b1031732c244db82ae297c36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502407, "uuid": "2b8a0bae-6441-462a-a69f-1a7f46e9b2d1", "comment": "Malware payload (AgentTesla)", "value": "8bee7becce64fc6039dc6ff7261592130372b9cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502407, "uuid": "5c71338c-6360-4ee0-bf31-b762074f4772", "comment": "Malware payload (AgentTesla)", "value": "d82b17ba1d996db78481e18e2f1ff667f00c676e968d4b2ed02dcd5f322d16ee28245b8963d334a72f01245e8e682398", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502407, "uuid": "55739205-7144-44fa-b48d-a5e2b5738f1f", "value": "T1AF54231476A8C423DAB388330DBCD52FDEE86811A0E9975A27405EADF925551EE0F3F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502407, "uuid": "095fea37-6dfc-4b6a-8b7f-331704a6f7d7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502407, "uuid": "d8fb3f93-9407-4855-97dc-4e7edf48d397", "value": "6144:/Ya6HyJ/CHc00djjdBOtbt2rRqGgbWBXiFlk/acg+zuSk:/YVy50cdBwo7gbVkCvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687502407, "uuid": "fe7013d0-72ad-467b-9ccc-dcbdd7f1379f", "value": 289274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687502407, "uuid": "08445c47-9ceb-4173-a697-16bb3a445902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502407, "uuid": "70f7e55c-44ca-43aa-b482-a4981083175b", "value": "Outstanding invoice_0235648397_6258379565.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24177ee5-1200-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687550230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550230, "uuid": "4ce82587-4cbf-44fb-a64a-77bd19504b91", "comment": "Malware payload (Gafgyt)", "value": "f648c2c03b23773e8f6e390ad3fad641", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550230, "uuid": "ef00f4ac-6fa5-466e-8022-3089472e403a", "comment": "Malware payload (Gafgyt)", "value": "87eeca4494d17c364e0178a584d237ad52e0d9788b621fead565a92cd6a678bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550230, "uuid": "376a86de-baf8-4857-86ec-fc0478b50ecf", "comment": "Malware payload (Gafgyt)", "value": "95414e1a96b06d51876eb9f2f0b8bc0e67dd3f4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550230, "uuid": "5fbdede5-2184-4c4a-8b32-4db67e0ed1d3", "comment": "Malware payload (Gafgyt)", "value": "637f68cc8f49ba202b1395f0d22b1d5538b7dbefc577482fdd98f1d3d204398a6b43cf0190233131d265ae38b32a5482", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550230, "uuid": "bacea28d-75c1-47da-bf84-9b78e2939ae3", "value": "T1EEE3866E3E21ABBEE16886310BF76F70C39529D636A19342E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550230, "uuid": "8cf01207-1f5b-4a93-a8e9-cd0790e6dea7", "value": "1536:mVNs7K797V+nv57gbj6l6T6B6v6N6/6AePe1ebeZe5bwClA2rKQA1dXAQTI/e0hW:vY01ZkXAQT4Nz9//ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687550230, "uuid": "25da118d-3f9b-4494-bcd3-3a9bc9c5bf19", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687550230, "uuid": "6ae788d6-a78f-4197-9143-aa9286d8453b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550230, "uuid": "3281215a-4837-4e95-8318-dbf01717fd57", "value": "f648c2c03b23773e8f6e390ad3fad641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f03675-11fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687548913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548913, "uuid": "e2b76382-b98d-4d52-a34a-4d066f752029", "comment": "Malware payload", "value": "2b2b70ad026c427ec1fedb03c391040f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548913, "uuid": "9a4c4b2d-ad3d-47ff-8b01-8adde9dd46ff", "comment": "Malware payload", "value": "88590eb81c23e50c1a52a49e48b37b5bc72ead1868ca45adc4ffe5c8485a9626", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548913, "uuid": "0ca6d3bb-5b0d-4e47-86ad-5aa1393d9f6e", "comment": "Malware payload", "value": "bc2d6fb45b37c3dc15015deb1541b484df30ade8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548913, "uuid": "edfbd4ba-41ac-48c9-a2d1-ff8c9fd55736", "comment": "Malware payload", "value": "e37ce65683a805075ddeac7d9ff121cd1fe592488cbb44e2075891df229a189f9ab1fbadc9403f6c62e847a7b7daef7b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548913, "uuid": "0d16583f-0658-494e-9374-15fc59e0d16e", "value": "T15074496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548913, "uuid": "9524fc95-8e55-441e-991f-9b48ed04ee4e", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593i:fIS1xbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687548913, "uuid": "358e1cf6-a1dc-416b-9ac3-04d3eacb403d", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687548913, "uuid": "b66152af-9420-4467-92ad-785704ef669a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548913, "uuid": "6c0181ff-835f-46de-99df-03a036209200", "value": "BSN-180302337.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb4ebb6-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687499751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499751, "uuid": "68999361-f38a-4cc6-a982-91c5e12751f4", "comment": "Malware payload (Amadey)", "value": "2468ee9edeabf62395c186fdbfe5f29e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499751, "uuid": "fa61a1b0-9dc6-4fbd-bac9-473cfb4f1f7a", "comment": "Malware payload (Amadey)", "value": "88716991f4783701f87361c25ed3a93900c24a435f326d136dc1f8eb8339c45e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499751, "uuid": "0d9bba65-457a-423d-9613-97983941d9fb", "comment": "Malware payload (Amadey)", "value": "dd8484fa07a441958801dc06255c7dd620547f55", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499751, "uuid": "39bdd42d-7f84-472d-81cb-12ff95724106", "comment": "Malware payload (Amadey)", "value": "679d75a35fdb5c8b34ff4e7122723e8d9a1e180e77d2534db6a6c306c9d26cf33727f72f07d04b7fa42eaecbdddb0a32", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499751, "uuid": "eed183d4-e63a-4cd8-bd8f-834992f27fee", "value": "T16CE401C626408573DE23DDF2E4DFE8C34EBA71310BB24A87120C59F64F562E8A51B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499751, "uuid": "2420acd5-5a03-4bc2-963f-ce262e70aee3", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499751, "uuid": "67bbb7d9-a711-4fe9-9478-8b6d34e95138", "value": "12288:tW0ue6QTey5sCfypXC1rTUnGwSMfynsIHl2wYZfvXjBUl9/H/w/umQJQmZ:A0u8Tey5seyigQnFH+f/j69fk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499751, "uuid": "8b7e80e8-68b6-499e-a008-4e68bc9850f2", "value": 715072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499751, "uuid": "7e9050a7-02eb-4b4e-b7f4-268941f319e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499751, "uuid": "ca2df651-a6b8-46ea-b4d8-9e24950c9ed5", "value": "2468ee9edeabf62395c186fdbfe5f29e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df15c647-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499434, "uuid": "6533f95e-d779-48e3-a403-1579a97aacb2", "comment": "Malware payload (RedLineStealer)", "value": "111ccb9270f59d899ccbb919f8a023cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499434, "uuid": "6296c597-2331-4dc6-85da-68907dcdb77a", "comment": "Malware payload (RedLineStealer)", "value": "889650c0b340b1e5ad279c4341ec550bca8e3491d517d2f8554d2a6fa672cee9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499434, "uuid": "ac1ea3b4-3d3a-4a90-a080-f599f5122c5d", "comment": "Malware payload (RedLineStealer)", "value": "912da5c6fa2a760bcee101ef31eb15d434e51656", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499434, "uuid": "e382b3a9-ccb4-4fe1-9e1c-67e22a12cc6c", "comment": "Malware payload (RedLineStealer)", "value": "6c2cc535f3fdf734930916d2b48290156cdf5a27307f924ffd3bd1ded742612a8dc60f4b766670069fb52372306661d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499434, "uuid": "e4c6168d-c9fe-49c7-a023-bf37c72d17da", "value": "T135E401CA664045B7CB27CAF290DFE8D64F7A702107B64BC7120C4AE58F512E8E61B57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499434, "uuid": "3ca2386a-1093-462b-8fc6-e908d2c1c902", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499434, "uuid": "21e3e4ce-b5ab-448c-b6f4-f731e7b5a055", "value": "12288:FV8l9Tey5s6P7jQorn9IAhtFvs5MASd2fB0IIhPwt0s/var/TCKqL8nBxotvILgK:FV8jTey5su70oDFIbCIILs/cLznB8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499434, "uuid": "ce2a6c21-df2d-4ffa-bcad-0ceab6ebe426", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499434, "uuid": "658d5896-baca-4534-82d4-a38dac8bd5af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499434, "uuid": "44b23e70-4aa9-4aba-8249-417f86ee2cb6", "value": "111ccb9270f59d899ccbb919f8a023cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e32256-11ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687528948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528948, "uuid": "7f90126c-32aa-4795-a980-a69ece0ff1ed", "comment": "Malware payload (RedLineStealer)", "value": "1413dc8aeb6617f8902f70deaff37fe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528948, "uuid": "85dbb1a1-4b3b-4ef5-9503-3a2bd7db4e9b", "comment": "Malware payload (RedLineStealer)", "value": "89c1c23cde78ea40c3756301a8612949e23b86584ed5fa2f49ac2589b61bca15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528948, "uuid": "0912fec5-0614-4c45-bf08-83d8ecc8b5c9", "comment": "Malware payload (RedLineStealer)", "value": "2a2f2e2097c0903b8dc00d98acf803007bb37489", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528948, "uuid": "ff622061-ad3f-4379-9b93-9924e49188a1", "comment": "Malware payload (RedLineStealer)", "value": "10b678aef5ff4f1241fee4ea829e718ce84f71eac81c9a45f4eaeec1565fea657e71fff7ac3943b488315caacb95372a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528948, "uuid": "cc55c200-906b-4feb-8434-0d0083889a8c", "value": "T19855AE83EF491973EA412473E92F77932842A4F1139FB0BAB35F0A96E65383D0574B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528948, "uuid": "d6e723db-5bdf-4f35-ba55-039e177be720", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528948, "uuid": "b22e7eb3-f0a8-43a6-94e5-62f8810cce41", "value": "24576:pB9SxO5eGINl5ZbeV2yznaeouVFHeZcLwTZTWAdNjEP3/kDHwGDOowNcH4443DOb:gwCdKFm6kRBdW0rwBkIW8kkSVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687528948, "uuid": "9a00c863-e192-40e2-8fcb-3f28ed07f021", "value": 1357827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687528948, "uuid": "7d102004-e4bc-451c-bca6-41e177e7e005", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528948, "uuid": "5283c6f7-ef99-4717-ad4f-37f88d871b54", "value": "1413dc8aeb6617f8902f70deaff37fe7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09eb2cc7-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500365, "uuid": "3c788c7c-5bb5-4515-ba4a-cc118b166298", "comment": "Malware payload (RedLineStealer)", "value": "8f321dcea6db9d7876e945086d619a0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500365, "uuid": "9d4b5dc0-81e0-4ae0-ad69-7e6b75265fe9", "comment": "Malware payload (RedLineStealer)", "value": "89ede846667958e0c98117216c764189edc9944b4f41fcade596a20063c4a89f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500365, "uuid": "b47c08ce-b446-4a95-a70d-ed57f7bb16c7", "comment": "Malware payload (RedLineStealer)", "value": "eb1760dd2a9f36fc02df3ec7ca3b8a7a0983f54c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500365, "uuid": "f8d1eacf-46c7-43f1-b267-9eeb648f7bc8", "comment": "Malware payload (RedLineStealer)", "value": "64637bb1e7abc1cdaa4d1d17867040f71e6710fffdf6fc4e94c26ed305b0bf5142fc0225710ab3d718fc051a1dca9643", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500365, "uuid": "e7e4f268-ac4d-470e-bf9b-6473386a5328", "value": "T10DB4F1CA264085B3CF23DAF2E4EFE9864BB9703107714B87134D4AFA4E455D4A61B53E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500365, "uuid": "4fcc6c33-952f-4f0c-bc4a-e0406b0a813d", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500365, "uuid": "f0e33334-5da1-4ec5-a14b-32d72b923c35", "value": "12288:cfkvw7Tey5sP41XiAsnFzjRdC+QsIo9CYQJQmZ:cfkvOTey5sw9slR8+Qhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500365, "uuid": "a27e6140-d819-4110-8304-e63a130223ec", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500365, "uuid": "eb0d02c6-e5fc-4495-ac0a-8f2ed988b838", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500365, "uuid": "92c7f1d2-34d7-433f-9069-058f447897f4", "value": "8f321dcea6db9d7876e945086d619a0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87149028-118f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687501863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501863, "uuid": "5b5e72ac-14b2-4f24-ae5d-046c744dda4a", "comment": "Malware payload (Mirai)", "value": "a004d1d10039dd5995fb3e20405ab319", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501863, "uuid": "1e103e74-67f8-4e86-b48a-ac5593fb55f3", "comment": "Malware payload (Mirai)", "value": "8a050eaca74c54bd8d6d7379ae359eb8df09af7ab78ca934c9df01ea311ebd2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501863, "uuid": "fb9a68ed-4e69-4681-9819-6186fcf01f9a", "comment": "Malware payload (Mirai)", "value": "608017973ee3bc67ffb3db1891ed30713d287da5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501863, "uuid": "b72a94df-63d5-4e30-9939-65b1f8704ee9", "comment": "Malware payload (Mirai)", "value": "6a83aa0b000f3b1a3cb82971184d8cdb9cbbe9e78a5967e964e9a65e62daec2f1f311845c9d54a7771038ffe2d74ed10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501863, "uuid": "e0b5d0dd-ddde-4a67-8005-9d355a9b57c0", "value": "T116C2E091E1B62E85FB366E601EB5C2C177A04E9EB7B7CCD3255D9F0408A721B07097C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501863, "uuid": "24d23f8e-321b-4a12-b36b-389b999aee9a", "value": "768:yG959yM0HWubJsWDYcGj74uVcqgw09S0D:4M0HRJswYcG34u+qgw09S0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501863, "uuid": "956ff891-cf53-49ae-8d74-c92e5c00847e", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501863, "uuid": "90c0b1a6-d5b9-47cb-b86b-ea8db60cfc2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501863, "uuid": "e38f4d0b-2e68-4970-ae40-ce3d2f668a9c", "value": "a004d1d10039dd5995fb3e20405ab319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8fed5d-1191-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687502864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502864, "uuid": "6aef1386-ad12-49dc-823b-ec9bbc9daa73", "comment": "Malware payload (AgentTesla)", "value": "c63e4cf08a74c1967b56097c76460144", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502864, "uuid": "8235c033-1030-426c-86dd-7726535ef079", "comment": "Malware payload (AgentTesla)", "value": "8a0cffcfb250244f00f8e61597d33ba01be11300b420de556cac6768f602ff00", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502864, "uuid": "f6938874-62b8-4c33-838f-e229df09e450", "comment": "Malware payload (AgentTesla)", "value": "f0b2622105e587db7bdc951c5963dee2a4ea0570", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502864, "uuid": "31ca5c3c-9e39-44de-8b17-2002163ae41f", "comment": "Malware payload (AgentTesla)", "value": "0b3a403acac8378a45d6b8fa6dc809f433c8139f9d14e9257feff838a212ac518ec6af367874e1f3f8cb119faecc3230", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502864, "uuid": "b0de7c7e-cae7-482b-ad29-5ff4ca6338ed", "value": "T1FCF4332717B610D96DD9A9E212344F2DF33608F28BF79BC6187172D20B9756860AB733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502864, "uuid": "0dacd025-2464-497c-a05c-d2345bd4da6f", "value": "12288:5ONkXJwdkWSb7YK1GMdQ+Ltq+MKv9yHXbqlZ1P02Xsu7K5z4jGMue/i7/OU2crc:5hJbHGMdQiXMY9YLqpdgmbT2/yc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687502864, "uuid": "0ede8534-c81b-40c6-90d9-214476519335", "value": 790184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687502864, "uuid": "86055ca4-7e7e-4391-92cf-fc7b5458664b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502864, "uuid": "cc4ebf1a-8837-4bf9-893c-1426482a4775", "value": "Signed Contract.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d8ee0b-11a1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1687509701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687509701, "uuid": "edae4bd2-86cd-48b5-a6ef-5969e959fe47", "comment": "Malware payload (njrat)", "value": "a745b7496568d9d632d8d32193810f11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687509701, "uuid": "2d3516ce-b9aa-44f3-b7e3-48ed278a7f20", "comment": "Malware payload (njrat)", "value": "8a26c4b35b56433759f483a737bb1b0a30c018ad3871dce4285742c8b595088d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687509701, "uuid": "0deaa39a-2d2b-4d10-a2ce-779e3ca08a22", "comment": "Malware payload (njrat)", "value": "f8c1de0e5e977c53f24303672d034624f2573970", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687509701, "uuid": "12203ee8-cc9a-46de-88ef-348a95562b2a", "comment": "Malware payload (njrat)", "value": "dae9cce483a6bc6849c459ac6fccebfc78d94dedcbb6ac516732586a17cd8a0d399e662da5f26f726c5f34c35cc14a59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687509701, "uuid": "c4ac38f5-bb5c-4c67-8fab-2697b59b8752", "value": "T1A5C2F72C37B68232D1EE067E4562DA5143B8D44BF226FB0F0CD998E94B5B7C60B41EE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687509701, "uuid": "25314c6c-1edc-403a-be31-4760ede0dd59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687509701, "uuid": "10fc205b-84e9-4f1b-9a85-46e7ccdd7cf5", "value": "384:4LlbBaMG4AvIRolGG9+PUimiM4AQk93vmhm7UMKmIEecKdbXTzm9bVhca26Kr6eW:GVcZCQb4A/vMHTi9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687509701, "uuid": "bc63aadd-ebf3-4b9c-b792-817351677a30", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687509701, "uuid": "5c954270-6d43-42a0-97ba-b401662b7b8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687509701, "uuid": "5d540bbb-ca8d-49f8-a035-892304645aa1", "value": "a745b7496568d9d632d8d32193810f11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a474db-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516625, "uuid": "9a89b12c-ee06-45a8-b31b-827e2627356d", "comment": "Malware payload (RedLineStealer)", "value": "56a704940737eabbc8dd65aedc2dc4a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516625, "uuid": "e46d480f-8d61-4fed-80a0-b01029d55c0e", "comment": "Malware payload (RedLineStealer)", "value": "8b1ee809b01bbe04f8e5c01e1fed17b2edd91ddf3f85f7eac614ae0d270f473e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516625, "uuid": "8834acb7-dbf6-4f3c-b7fb-5a82bd7041ef", "comment": "Malware payload (RedLineStealer)", "value": "40f1cb1a75bac569deaa49034205e9cbc2e0b6dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516625, "uuid": "6171df37-70c4-4914-9f1a-2c34ab26434c", "comment": "Malware payload (RedLineStealer)", "value": "353e9280b653d561211a7024f2015b4b5925b2db839d429ced72e18ee322c82265326ae46472126abfea6340ba08a7e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516625, "uuid": "0092a91f-2f98-42b2-b490-e3878d26ac13", "value": "T1DDE402CA65804573DFA3DEF2C4EFEAC70B79B1210B6586C3120C96FA4E551E5B20B639", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516625, "uuid": "02b4e0a1-b483-4d86-9b88-876dfa48654b", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516625, "uuid": "55118fde-39a0-40f0-a660-26f8a3b3862a", "value": "12288:OCKBkTey5s5JiHTltraEdD8hcVw0ypwambedpkzsptQsH9tUXQJQmZ:OCKmTey5syTlRaEBAusCE8spldtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516625, "uuid": "663bab1f-fc41-453d-a3ef-e284f23841f9", "value": 713024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516625, "uuid": "fad445ff-e718-4ce6-ac6d-fed093a8d17e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516625, "uuid": "435b27e9-463b-4aab-8e93-ff51f28bfcb0", "value": "56a704940737eabbc8dd65aedc2dc4a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e87605-1181-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687495795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687495795, "uuid": "3cfc098b-e3db-4deb-8c3a-d5531cc308d4", "comment": "Malware payload (Quakbot)", "value": "9f8a7a3bb9d1452c19dc6c8e74fc72b1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687495795, "uuid": "cf7f69a4-bce7-40f6-96a5-188adf98de3f", "comment": "Malware payload (Quakbot)", "value": "8b4ab5aa06ef9fd1a22b64e472dab1b9ddcf4f20b5c3f3b6c46a52ee9cf7bd75", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687495795, "uuid": "d28fae72-e3ce-4a3e-b1fe-33b3bcb27b1a", "comment": "Malware payload (Quakbot)", "value": "aae3619afbff1fdfe8941a830d3cd100dc5610b8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687495795, "uuid": "e9a29239-da03-4908-919f-f3ffb43227c4", "comment": "Malware payload (Quakbot)", "value": "da8b1aa9b38e3f29bd2b62fe4a7a4bcdc2e334e0e171ca133b7f8893c2136a538409a78dd0af6a40c7ccad9319c15c58", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687495795, "uuid": "e9cc6e04-9385-4236-a3a8-d22d70edb98f", "value": "T112558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687495795, "uuid": "1608e61b-3d76-4214-ad2b-c32a1cd05c8b", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687495795, "uuid": "f0992e70-3609-4d96-87cc-6102c3e4e3a3", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4ylQ:QbkS7XB1EsOSNPSp0EAt2bUeM4ylQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687495795, "uuid": "25151a81-91a8-47a1-8fc5-12528b140234", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687495795, "uuid": "3009d9be-956d-4ca0-9bc2-b57a225265f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687495795, "uuid": "ece1f071-d6c2-479c-9758-b9006b2e858a", "value": "1_qbot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965cb311-118f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687501889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501889, "uuid": "ec3a6710-3552-4c4b-9538-fbe4d2d7b17e", "comment": "Malware payload (Mirai)", "value": "e45f474b457e8a97df4378be3b251527", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501889, "uuid": "8dcb9583-c91e-4287-9065-5b78d8ba3794", "comment": "Malware payload (Mirai)", "value": "8bcd61da96bf2a6a1162840ebc4c2c1927a20a84ddbc6ea8d661c6b7ccc3e994", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501889, "uuid": "86627ffe-8d3e-4e2d-b440-fc6d98e1f53a", "comment": "Malware payload (Mirai)", "value": "6d3f711583c9514eb1030f1c58b7b9368f4188bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501889, "uuid": "b4f5d269-2b28-4b55-a46d-02bfc1551fb2", "comment": "Malware payload (Mirai)", "value": "a83579a53f8145b0977e97f549d1fc387d2efade99c1e7fcf7bb873579c25db9b9fd3ffd0e51a1ec81a1a6661374b9d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501889, "uuid": "0cd606b2-ec50-4559-a550-4f78b924573f", "value": "T19233F1B692AB9D61C17046F7153EA49D64162338E2F1F003A6250470EACB1F399FE7C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501889, "uuid": "23b0761a-8f16-4692-8d4f-fc71d7733df0", "value": "1536:uCoqsGR4eB3g0Vmh1IxIpC8JvL9VE8amFZP7R3W:Xoqs2Twh6P8JvLJ9ZP7R3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501889, "uuid": "4c5cf371-c10a-40cc-9aaa-588be9294fd8", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501889, "uuid": "c2495f6d-dd9b-4acb-af77-2b1833575b55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501889, "uuid": "41584144-ea77-48b9-a3d1-cdc1afedf315", "value": "e45f474b457e8a97df4378be3b251527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94766ef1-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499738, "uuid": "dd907481-76a6-47c1-8662-cde4ba2f321a", "comment": "Malware payload (RedLineStealer)", "value": "34e66edaf62b11ac880246406447a556", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499738, "uuid": "36308de8-47a8-459f-9aa2-57111014cffe", "comment": "Malware payload (RedLineStealer)", "value": "8c1b6fc7da57ce7c965094b46b0dec1bf8d891a5f796a43c6dda79254b151678", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499738, "uuid": "669a3563-1e52-4370-a68f-96fc593db307", "comment": "Malware payload (RedLineStealer)", "value": "2e000b9d798131706c13819e187cab0396f72164", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499738, "uuid": "335c0d09-dfd9-4563-aef7-659ed2eba1a0", "comment": "Malware payload (RedLineStealer)", "value": "d12f21d58cc66801eab8fdab702304c936012799e313755f5ca29c846111d27b265fed7ed4535122636753c102124b1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499738, "uuid": "4f77bc04-20db-4bbb-b358-22ef81e7bc9c", "value": "T1C8E402CA758049B3CF77C9B2C49FACD68F7A31220B660787120C5AF54F551E5AA0B93E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499738, "uuid": "349fd4bb-4a07-4e45-978e-a8ca0584fd13", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499738, "uuid": "eae276c9-ef15-466b-81fc-b4a6927e12f4", "value": "12288:d+OeqqTey5s91wG+V8qIsL1TPgohEwGoxbRjIOuw8iu/VG0+LQJQmZ:d+OaTey5s9+GP01DR9ljIOOVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499738, "uuid": "20e0ce3d-f52c-446a-88e2-e6716db5c248", "value": 714048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499738, "uuid": "ca335d5b-a7e1-482f-b4f5-25faac07ede4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499738, "uuid": "fb34686f-6e48-451a-a865-0edc22f9d329", "value": "34e66edaf62b11ac880246406447a556.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732fa524-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500971, "uuid": "e611b7df-9fd6-4742-a891-af066a99ae29", "comment": "Malware payload (Amadey)", "value": "b37bd69a8cd4096acc79e320882ccccd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500971, "uuid": "e4a6cd18-c279-40f7-bcb8-3c884e6ff960", "comment": "Malware payload (Amadey)", "value": "8cc98e94f8ba986aadeb6a9f731feaef0fdf5cfe24971f97bc9c6132e9fd13ac", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500971, "uuid": "e5daefb7-3513-40ab-b150-35dee3c270a3", "comment": "Malware payload (Amadey)", "value": "2aa26f670d4ade48b78021596dbe613f6b66d508", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500971, "uuid": "8fc634d5-5fc4-45b4-9bc4-1d5c650577db", "comment": "Malware payload (Amadey)", "value": "ed4af82e962802422c327ccd0b3d874efca14352c434e73de0dbe6a8236558723efbe66226494b7f7b2c1ac88f4f8fcb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500971, "uuid": "f48506da-3f0f-4da9-a844-13953c329f4a", "value": "T1A4E401C626804273DF73C9F2D8EFF9D64A7A71210BB6078B131C59F98A416D4E20B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500971, "uuid": "7fc01b87-2b1a-4c26-906d-b68b8e17cb6c", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500971, "uuid": "3c43cd15-03b2-458f-b0e4-2757e9dd4222", "value": "12288:WzI0TOzTey5sXl5d2yg3OlL9K0O+cIUBYw473iUik6oFstW8MVQJQmZ:Wk0T4Tey5sXn8yg34d+gOjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500971, "uuid": "85d53460-be41-47cb-b94d-f642c390f4fa", "value": 715072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500971, "uuid": "a75377af-1631-447c-bcc8-20cbeb2ab385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500971, "uuid": "73d464b8-0d3a-42cf-9694-3384bad09c33", "value": "b37bd69a8cd4096acc79e320882ccccd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e264a3be-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501587, "uuid": "1b10fd1b-3133-4673-aacb-583c22d4666a", "comment": "Malware payload (RedLineStealer)", "value": "e2cec8b58a7eb8b25f6423833a71a569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501587, "uuid": "29203745-d0b8-40b0-ac5b-675064299bf8", "comment": "Malware payload (RedLineStealer)", "value": "8d1788719d9a348516118de8bcbbf59209bce30503d5fc41fb016e0cea196727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501587, "uuid": "c24cd7aa-6887-49a0-99d0-14a03e581aad", "comment": "Malware payload (RedLineStealer)", "value": "f82922b52076e3240091c6d504ee90ba2ca9565b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501587, "uuid": "6d195228-de9c-4ae9-8c8b-64af28a39717", "comment": "Malware payload (RedLineStealer)", "value": "b7feb050d5975a2a8ddad5e4e0be850594d4621038130036fe7b53bcc1504420503053abd53a60ed713ca6d7a074a54f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501587, "uuid": "7b3a9a4b-74ab-41fe-bb57-ce1c328ca57a", "value": "T14CE402C726804473DF63DEB1D4EFEEC74EBA70214BA14787120D89F58B062E4965B93A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501587, "uuid": "9ccc63ec-747b-4533-b00f-5ac34fb50cad", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501587, "uuid": "19ba0b8c-6ced-402b-9561-46ba2e518fbd", "value": "12288:5EegXSTey5sH5l+mDVnmW9uuxuQyOGEvTFwKw9NrpbihCx+znigKdQJQmZ:6egCTey5sZg+Vnmw3xuQMoRwrpGhcInH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501587, "uuid": "bf362ca1-9813-42a6-841f-5539308b2a54", "value": 715072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501587, "uuid": "a7e83b98-f832-4b3a-9fcc-9025048d15fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501587, "uuid": "79b2f130-8a35-45c1-940b-d74550fb7d21", "value": "e2cec8b58a7eb8b25f6423833a71a569.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1e8cb8-11da-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687534002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534002, "uuid": "f07a20b3-2218-4b7c-9cf0-8aedc48d7f5f", "comment": "Malware payload", "value": "3a165c1d82d062cb924bababda9e0076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534002, "uuid": "af1feafe-c004-40a9-9cf1-ca118f1f1deb", "comment": "Malware payload", "value": "8e3c95bcf195b498bdd53c1ad2adb5329718601ed0abac5fb45ecdc9c8855916", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534002, "uuid": "e73dfd1e-dd2d-433d-b6af-e96da5832e12", "comment": "Malware payload", "value": "2c3f0e76ec3e753db92dc91a45d1f2b48d8113c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534002, "uuid": "6c7c7632-d5a7-4293-9ab2-e39448abdc6d", "comment": "Malware payload", "value": "280eef78be4692e0cf1962e1fc1a56ef15dacb3bc5aa38260ba2e56973c62b171905661e9f7e3fba4cdff05f0a09efc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534002, "uuid": "855f406d-be29-4ffa-b001-d98393b178f9", "value": "T1FBD4022961A00E12F63E9FF669B48550D3B5AA419703F63A2FE520F20773B219F13767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534002, "uuid": "2ff12f3c-c3fa-4ed6-814e-f51d12518599", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534002, "uuid": "28fb9477-f4c7-4ad8-82ed-c41db6b5fe20", "value": "12288:N2iNG4/mNUAVL6jaMVCz4V4DmDMBmSlNL1VCot:N1M4/QUUMVWhPnKot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687534002, "uuid": "bfd69265-c191-41d4-9a59-fd814acf88db", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687534002, "uuid": "31b52b7d-11b6-421e-8e2a-dc9da2edad12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534002, "uuid": "489d39f1-b40c-4bae-96c6-238c0385b1d3", "value": "Bill of landing DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3397ff0-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499441, "uuid": "665c32b8-16c2-4352-8c28-bf3f26018169", "comment": "Malware payload (RedLineStealer)", "value": "2df1cca755a4a236f184aaeac6aada7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499441, "uuid": "fd68ff33-3cb2-4268-9b40-241f1ddbd0aa", "comment": "Malware payload (RedLineStealer)", "value": "8e76e570a33f570b591e52ebf07ef17d0fa8882cc4462b1d8338eb21e345ef51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499441, "uuid": "f8c405be-801d-427e-ab14-29135db975e2", "comment": "Malware payload (RedLineStealer)", "value": "5f54ba70c1d8e0a3c18db505eafa08d0654a2080", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499441, "uuid": "0f4a4fa1-177b-499c-9d3c-34caaa5c6c75", "comment": "Malware payload (RedLineStealer)", "value": "cdd110e5d2fd8d23a1e24c8d8a8eb31fa2d4c66ab62407ec64d173328cf3d364556b79ce88770e4357e6058115af5e82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499441, "uuid": "792f529a-d533-4c71-be0c-7339bdf5a07b", "value": "T1ECB4F1CA25804973DF73CAF1D4EFE8D78EBA71210BA14BC3020C89F58E552D4A61B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499441, "uuid": "6356cc25-2a98-45ce-807a-962593a0b853", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499441, "uuid": "d7fc4dfc-f702-4adc-805d-f8355f4794ae", "value": "12288:Ie+QpTey5sGO3fspQzstYg7z/onlJOR37Ys7I/f3QJQmZ:Ie+8Tey5sGafsss9/AyY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499441, "uuid": "44f4ee61-6368-4705-985c-90163c17af3e", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499441, "uuid": "a1d5df0b-fcd9-477f-853a-94df404aa91f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499441, "uuid": "b900b1cd-6c87-499b-8440-0c39073ef8d5", "value": "2df1cca755a4a236f184aaeac6aada7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbdeb4e8-11fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687549223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687549223, "uuid": "719509c9-dd8d-48c1-87d5-340d950f7d81", "comment": "Malware payload", "value": "99404d638e22e6cd63226c2813467378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687549223, "uuid": "50e253be-bdcf-4f18-8722-af95f98e61cb", "comment": "Malware payload", "value": "8e7c2890227d1b9441cacad8f01d2e5519094f7886f2477377aa5e2989f75f0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687549223, "uuid": "825e6483-773d-4844-80e0-2cbfc2087f04", "comment": "Malware payload", "value": "74d4dae484e589d43eb1ebb86f28cf545b6391f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687549223, "uuid": "f519d007-f1e8-4abc-b860-e289b3e549ce", "comment": "Malware payload", "value": "8c92de404a42952339d9de7ff3f0e359e0187f5824bec2b9f34c94df12d36c42ecd25ad101dcb91ef764b59991080930", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687549223, "uuid": "cb05fb4d-c226-4ff5-875a-560c4756569e", "value": "T1C634D0217ECC80B2C4AA1A34547E8A665A7D7A313730C6477BB8426DDB50BF0D23B797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687549223, "uuid": "10666266-6c3a-4d75-8076-d08b371d5bbb", "value": "c8681af63c4b3bc7041fe674efea6dd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687549223, "uuid": "c4e18718-3aac-43a6-b791-66197d3cdeb7", "value": "3072:/eB7gI4HKm/lgYs+41whCinuHXp9NEOqr41TY6INx8WrW5BXDTu:/ehgIo1nB7nKNqc1TY/L8W6zvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687549223, "uuid": "4a933ef4-e0f6-44d4-91d1-2f58b6d8e15d", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687549223, "uuid": "47011563-e984-41ea-b11d-741c1c597c7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687549223, "uuid": "094a0f0d-a545-4ccf-922f-f3c10981694e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927c4a91-118f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687501883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501883, "uuid": "7ee10171-02c2-4ccd-8b9d-0172760319a6", "comment": "Malware payload (Mirai)", "value": "a29321cc9d7ecb4007877c3ac7443ee7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501883, "uuid": "66190a66-4a4c-4e0f-a449-fa481de1457c", "comment": "Malware payload (Mirai)", "value": "8ebe475ddae7bfa76873a7b3280c43ca6e4260346fdc3236bcc540780868709e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501883, "uuid": "a8b9391f-fe89-426c-9d46-5f2e2f5004d8", "comment": "Malware payload (Mirai)", "value": "73c488fa82143e2f982289dea7b0174606643514", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501883, "uuid": "bd2672d2-0b1a-4729-98d4-169fc339c068", "comment": "Malware payload (Mirai)", "value": "466b61fe19e4af29319586bf43f0c952baf8b927a608b972313e6e1ceceb243eff65a4439665fd76add2504e7bc1a003", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501883, "uuid": "2c945f52-5a60-4cd7-a0fb-874511d9f0ed", "value": "T1B2E2F111652A847DEB30C471E0F5868667691FBC7AFEB0A64466024D9CC294293E1ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501883, "uuid": "f5f7e82f-3572-499d-9826-12c38ddeec62", "value": "768:TEKkUgXAnURCr6HmDFStmYt+q9q3UELdK:/kEn7uHEemvfLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501883, "uuid": "f45326c6-aeef-404e-aafb-622e14883627", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501883, "uuid": "9646615d-33ca-405b-be65-70454b5fd3eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501883, "uuid": "7d6e2052-5bdd-4c79-9fb8-dbd410df1016", "value": "a29321cc9d7ecb4007877c3ac7443ee7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed85ef2-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501313, "uuid": "f21a022b-43a0-437d-8e9a-10d9598cb3c9", "comment": "Malware payload (RedLineStealer)", "value": "c39f874daf9c187e14712700e63af0dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501313, "uuid": "80d52c37-d8f6-4a57-bcba-ad563ccab5b0", "comment": "Malware payload (RedLineStealer)", "value": "8efc9d535f787d9505ade0d9048d3e317eb328d1223280265ea9483010306193", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501313, "uuid": "d9f062f0-c42c-436c-90fa-5f81baa5318f", "comment": "Malware payload (RedLineStealer)", "value": "091d61e5d39f5ec4573105b2a4db4a73fda2cb1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501313, "uuid": "75d17408-2c48-44d6-b887-f698846428ea", "comment": "Malware payload (RedLineStealer)", "value": "3f621554f5d2ae92bfd9d03cdf2c23148dae31d615c77ebab58023caee194e2740630f271985f2de222c52f203cec0c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501313, "uuid": "8dc25165-02a4-41d3-8c92-8b2d3d24b9a2", "value": "T154444CFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA284CA19BA0952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501313, "uuid": "36ed062d-f662-4f14-bae2-89afc79abe25", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501313, "uuid": "1e651b21-64b9-435f-b45e-064daf106c8d", "value": "6144:j+chaigt0poiRG/XvLNUgYhuE22fQJQmT:j+cfgtAoiRG/fSvXQJQmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501313, "uuid": "29fa8fc1-e05b-4738-8030-b2f43cd44a7b", "value": 275779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501313, "uuid": "cd6a2ad3-36d9-413c-8ef2-c4e618e32d55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501313, "uuid": "94338334-2c42-45d9-a484-c6fa8df023b9", "value": "c39f874daf9c187e14712700e63af0dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ca9d68-1159-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687478804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478804, "uuid": "7ee1f69a-03d5-47dd-b55e-eaeb48b88519", "comment": "Malware payload (Quakbot)", "value": "89b3e79dd30a56ea0c5c5dc1faca9d08", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478804, "uuid": "0019a610-9c6f-4034-a728-a4c6f84c615e", "comment": "Malware payload (Quakbot)", "value": "901dcf8dd0ff1b397c7c109e7dd575dd25e8a5d42620cc2bed7074d7f998ddf1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478804, "uuid": "debdb5d4-6cc5-4a5b-9228-5d539cdd2bdc", "comment": "Malware payload (Quakbot)", "value": "0891cabef7bfa378dc706d7042d554278f0e0fb5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478804, "uuid": "51ae65e5-f18e-41cc-b588-a4648f7f7ea1", "comment": "Malware payload (Quakbot)", "value": "617aa000d28f4feed26cb52f57330f4b7719d07d4f2c5c28f058c5ecf79b5bd15b426e779f04ffd5340b7a2e4c439408", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478804, "uuid": "b45acecd-7d6f-4614-b4fe-adcb74ae52fd", "value": "T139558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478804, "uuid": "4c8b0ee1-45d2-473d-b276-fed3310dd79a", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478804, "uuid": "3701c153-1ba5-44a0-a220-a964fe3f0728", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4yfQ:QbkS7XB1EsOSNPSp0EAt2bUeM4yfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687478804, "uuid": "1d2c57c0-623a-44d6-aa16-c04c04a7f48d", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687478804, "uuid": "92d10b83-3f96-4cc3-b08b-3154a454e946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478804, "uuid": "41aecb55-a977-447f-9eaf-a890a850bd81", "value": "01qbot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92d1957-11aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687513517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687513517, "uuid": "ebd9d402-c2af-4f80-8cc4-bd09e8dd9788", "comment": "Malware payload (AgentTesla)", "value": "d2dfae510841f26b52b3c64f97ae1f36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "methobsindia-com", "colour": "#1B56EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687513517, "uuid": "ee159aed-41b5-49ff-9bae-27d07e1cbf0d", "comment": "Malware payload (AgentTesla)", "value": "903ea42c02e8a30f6ad63666de0748b4fd4c2758c220b39af57269d1eebebb9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "methobsindia-com", "colour": "#1B56EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687513517, "uuid": "73271aad-6b67-40fc-a6dc-fdecb9c66760", "comment": "Malware payload (AgentTesla)", "value": "75daa6a232a21e8be184a9cfb1a1d1b56350aa65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "methobsindia-com", "colour": "#1B56EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687513517, "uuid": "33c16ea9-70de-41c2-860a-60445ac9b1af", "comment": "Malware payload (AgentTesla)", "value": "d4f7ad4e736aab4135b9984cb6ca247e9f0b4642b2813da611a0748795e73d4b314f8274dcd996291cd5e84ac68a1af6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "methobsindia-com", "colour": "#1B56EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687513517, "uuid": "1952814e-6fe4-4f84-855b-ada0d5b8696c", "value": "T139D4017A12A00A14F57EAFF570B48064C3B6BA909B12F22A7FF520F51272F415E1776B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687513517, "uuid": "fe1db8c0-e857-448a-b731-fe9020fbe19d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687513517, "uuid": "cd2610a3-cda5-4c05-84a4-43c54b88ad48", "value": "12288:C2iNG4/mNUAV0NCCVYb+9cH4/LhXVebnI+s7Xlmalce1NiQi:C1M4/QUNVYC9cK90bIfLlmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687513517, "uuid": "affccc62-0a6d-4cf1-9c6d-a63db4bf4e55", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687513517, "uuid": "3e0817e3-1169-4669-be3f-889fcdbab522", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687513517, "uuid": "56df070a-8f14-4ee3-b5c4-073768868eac", "value": "Invoice # 10623-27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98995d11-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499745, "uuid": "d746a315-755a-4f34-bb40-b904546fcc97", "comment": "Malware payload (RedLineStealer)", "value": "228827e85c2af1a7bfdf904912f09101", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499745, "uuid": "1054aed3-5c82-4e42-8c2b-cf705a4e13dc", "comment": "Malware payload (RedLineStealer)", "value": "90683d108e56389d7474700c9bc1eae64fb3b835fa3d403ca7ed1b4f861c8c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499745, "uuid": "5853e437-c3ca-44b9-9108-9d2e60124697", "comment": "Malware payload (RedLineStealer)", "value": "c35bede4f86ce2356bc93442ed39aafa1220ec3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499745, "uuid": "23181a8b-148b-4cf3-9be7-bc6a10dfc5ba", "comment": "Malware payload (RedLineStealer)", "value": "94d01d4b495019f9097f164467bf795b0151af2f23e6003e3e6cef52ca7833c96b3adefa6ff341ebdb11c30481939414", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499745, "uuid": "195709ed-d442-4c51-b06e-9a96eb14e4e1", "value": "T130444BFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA284CA19BA0952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499745, "uuid": "7ad48cc7-9091-456c-987f-0f03134a84ca", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499745, "uuid": "cc51953c-ffb9-401e-963e-ed4ea13885c1", "value": "6144:WeJ/5igt0poiRG/XvLNUgYhuE22WQJQmb:WeJsgtAoiRG/fSvuQJQmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499745, "uuid": "3d493a9d-6c6a-427d-9806-86844922d82d", "value": 276289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499745, "uuid": "72cc68ec-5bd1-40b8-ab7a-ad5064ca31ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499745, "uuid": "64bb7dde-7090-4132-805c-66ea83c57d76", "value": "228827e85c2af1a7bfdf904912f09101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76dcd1ed-11fc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687548651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548651, "uuid": "1d602a7e-a348-4610-9d2f-ee027da92f94", "comment": "Malware payload (Quakbot)", "value": "6e788d37f2213ba3e6a6b5cb0d97f496", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548651, "uuid": "adaa9d32-2502-4b8e-993c-f2716df8a055", "comment": "Malware payload (Quakbot)", "value": "90d800f250c1951c9f015b95bd590263b550af0ba56b0719325af093f184839d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548651, "uuid": "0cc839e0-6501-4842-8b5e-97b336332e6a", "comment": "Malware payload (Quakbot)", "value": "1de7148ccebd5837294fbf2a37347dbf95e396e5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548651, "uuid": "1a280c9b-6fa0-4a73-8654-1c098612c469", "comment": "Malware payload (Quakbot)", "value": "29e4715772b84273977e9dad36dd1bb722a6edc895f1683136c21db11ac7b231f6d73b99abb19f9f5bc64e5a4ec0e7a2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548651, "uuid": "90eb101d-941b-453a-8417-552a04465dcf", "value": "T19B558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548651, "uuid": "eca59fb1-0fed-4e0c-9056-87b08d4e1279", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548651, "uuid": "0b4e726a-02f9-4a2f-a11f-d07779ffd4d1", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4yrQ:QbkS7XB1EsOSNPSp0EAt2bUeM4yrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687548651, "uuid": "7349b8a4-0b11-40cd-82a6-95b0a2a75faf", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687548651, "uuid": "16eb5a07-0f4a-40fe-9dfa-686bfd381991", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548651, "uuid": "8a955ba6-b348-41d3-8ac9-e8ba71f29db4", "value": "08qbot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5144643-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499766, "uuid": "1d9e4994-0d7e-43dd-b75a-723dd85461cc", "comment": "Malware payload (RedLineStealer)", "value": "51040ad1709b78fb3be926be65ff40f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499766, "uuid": "5dd58448-dbab-4a6e-a062-dee5769b2b51", "comment": "Malware payload (RedLineStealer)", "value": "9112df55986b8203fe6f009b040a6b9df4becee47874d361306091ab06cefb38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499766, "uuid": "c8692dc4-35d1-4605-9a2c-5bb178d6430e", "comment": "Malware payload (RedLineStealer)", "value": "d49f4b9e087cc4f7e5b9fe93fbb0a612639f98fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499766, "uuid": "02c2ff08-c90c-4d08-ad97-4486b2c10e36", "comment": "Malware payload (RedLineStealer)", "value": "2128f297bd07d5b81e04e413cc6045f9986436469e8e9e078959876efcb6dd98e3792682eb0d3249974550a8d33094f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499766, "uuid": "4738368c-5446-4d25-b290-c6f61c1be64d", "value": "T194E402CA29804663DF73DEB184EFE8D70E7A71220B7246CB170D9AF14E455E0E61B53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499766, "uuid": "2618475d-8b7b-43ea-be4a-c81611b9ff80", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499766, "uuid": "16d8f2a3-4f3f-4c48-889f-704ff917f60f", "value": "12288:/sBVTUTey5s6q4JcLyezu5Ex/H5pZjUM9DEAEwn2bj/cjWqzWC2f2f3QRBUioQJh:0BVwTey5s6q4Jc1zu0H/Zn9Gj0HEkyBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499766, "uuid": "5229e817-beb1-4845-b2c1-e528b506affa", "value": 713536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499766, "uuid": "937627b8-9c70-4717-98d3-f26fc6355058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499766, "uuid": "2f72ae8b-0663-4361-89b0-4e948349edd3", "value": "51040ad1709b78fb3be926be65ff40f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0feb899-11c2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687523838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687523838, "uuid": "e6b54cad-b8cc-4c69-83b4-ab355731a8ed", "comment": "Malware payload (RedLineStealer)", "value": "390e15e7b92c938a6dd34cf53ad0da79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687523838, "uuid": "f1a364e1-8429-495b-aaf5-0436a7216099", "comment": "Malware payload (RedLineStealer)", "value": "92efae6877872a8c2ec5db5746d08ff0f21b086edfaf9d69bc8800fe398ee51b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687523838, "uuid": "f019596e-ad5e-4fce-ac77-ad14af9c1aa3", "comment": "Malware payload (RedLineStealer)", "value": "c9ffb2c7e95efbe46079315c9797f6b6f0c4f695", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687523838, "uuid": "c46c8543-a917-4dc7-bc88-cdb865826482", "comment": "Malware payload (RedLineStealer)", "value": "d908980ba2a3639c6e3a901e2298066a02d5376e1eb2f225c1dc399fa1f96490d1bbdae287195d08f24f95f9f1d245d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687523838, "uuid": "120093c1-7165-476d-ae27-221bdb46d90c", "value": "T1EBB4F1CA268045A3CFBBCDB1C4EFF9D64F7A61220B714B83130C99F58E405E5A62757A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687523838, "uuid": "0cd1fba7-97e5-4517-901c-6a522861b9a3", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687523838, "uuid": "ba93b2bd-4aa9-4343-8b64-4fb5298708a9", "value": "12288:IqAMhTey5sJoZi+r143q2v76NuWYxdOnVdeMQJQmZ:IqAUTey5syK3F6NxYxdSVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687523838, "uuid": "34aac331-bbfd-492e-8534-139cb1cbbffc", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687523838, "uuid": "7d397558-fd0e-4888-b5c9-00f065e209ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687523838, "uuid": "d070a6f8-2d2b-4996-a1fe-b50208f6267a", "value": "390e15e7b92c938a6dd34cf53ad0da79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5c8e40-11da-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687533870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533870, "uuid": "1e4f6fdf-3554-4794-b986-f571ad76477d", "comment": "Malware payload", "value": "ee8032f9790e6d87fff0c452c10cda82", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533870, "uuid": "66a96f52-a41a-4b13-8a5b-fd9d52c026f0", "comment": "Malware payload", "value": "93ef7fd920b450b18e7385384160d345bab0947dfd8659cc87430ab7ce49748f", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533870, "uuid": "4b55ce18-f0b8-4685-af24-43f0dcb564e0", "comment": "Malware payload", "value": "5fa46943e004604d77013fb8075e8fc936bae575", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533870, "uuid": "4e2ba5eb-60fa-4ffc-baf8-fc641b26b44f", "comment": "Malware payload", "value": "ded763436d6f51bb0d921aa45e0f91e8945b62920ca8b40b156db4de949fa6728dc347e816b41ebb5eb606e82060bb9f", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533870, "uuid": "a50e60e5-b001-4de5-b3b9-0ed48a4ec2f1", "value": "T1D884D772B2F541D6E16E16B1EF6A4E1001E2BCBDEDE1930EE4CC395696B23C1209971F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533870, "uuid": "fb9d4049-0da1-436c-91af-8ee6734b1520", "value": "6144:skzpkc86ueZHV56NwBAGhQuImtCoGRmd+BUKCP5LtuEulM:d86uNNwB7CTRmd+xv/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687533870, "uuid": "b23bb88c-9ce9-4abe-8117-455fe24c2c7a", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687533870, "uuid": "3a21d94b-b689-4bed-b2d8-c1bec5e5059b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533870, "uuid": "03141cb6-b976-42e6-b7ff-2f197bc78999", "value": "nDHL KULI500796823__SCAN DOCUMENT.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb533fe-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687510305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510305, "uuid": "9b751c29-08b8-43d8-90c0-9fbd8b209f96", "comment": "Malware payload (RedLineStealer)", "value": "081be69fa8d1f8f949610b90300772fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510305, "uuid": "47acd04b-a6cd-4505-b965-392343cc0244", "comment": "Malware payload (RedLineStealer)", "value": "9437b42764621fb7f37353132107d4bd82f86ccc3ad267ede3b569268e2e55df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510305, "uuid": "02477dc4-09e4-49f7-858a-5451faedb92a", "comment": "Malware payload (RedLineStealer)", "value": "c387cbaaa66ec59d684d8ad4a1a0053c2d413dd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510305, "uuid": "ed2650e2-9b1d-458f-9b23-d9431229d828", "comment": "Malware payload (RedLineStealer)", "value": "a6a320b1557ac3c6d549a05c252c864c52de8c7e7713340095b1cb5cee4f7c776a8edbe35692fa4223be2e423364b20d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510305, "uuid": "f77ac55a-0af8-42ec-8394-50a4f4b61f1d", "value": "T16FB4F0CA25408973DF23CDF298EFE9D65E7670200BB14BCB120C59F54A462E4B61B97E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510305, "uuid": "99f08996-eeac-4868-8b0b-5b189b4242aa", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510305, "uuid": "5e71980c-1649-4ae8-83ba-0a4101a2a979", "value": "12288:lAeYWvTey5seANCkM2Kb4kB4ccyDnQJQmZ:meYMTey5s7NwBBEy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510305, "uuid": "faae2821-2274-47cd-b899-1f5fe8e0a0d6", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510305, "uuid": "b912ff5e-eb2f-415c-be33-61f53dfde0d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510305, "uuid": "1a600f63-128d-48df-a70e-76070a2337cf", "value": "081be69fa8d1f8f949610b90300772fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661ab9f4-11c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687524142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524142, "uuid": "d75cce45-20f5-402c-b950-3a495616a636", "comment": "Malware payload (Amadey)", "value": "75d703e702dafff0217b50e3c734e835", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524142, "uuid": "b7af1f2a-18fd-4efa-90d0-9b06c0ae56c8", "comment": "Malware payload (Amadey)", "value": "94fa91b87a0f0cb35591393539f2196dfb607cfdbc816272051b6f01f19f2434", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524142, "uuid": "3e02ec09-91d5-4de8-9548-86d40bdf73e0", "comment": "Malware payload (Amadey)", "value": "3ce3dc1911c70607da7fc01389ea4a181f05a1ad", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524142, "uuid": "bbcad135-d061-4270-8140-9c473781e159", "comment": "Malware payload (Amadey)", "value": "35161019666e159641a67495663aa5e1dd21b0bdfe79dab853c7c9c10e374a8cf2fc89f647281b4b9e005f52847b7897", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524142, "uuid": "8a983947-302b-4493-8d37-a622b738dd2c", "value": "T199E402CA66400A63CF37CAF2D8DFE9E38EBA7021077547C7120D59F54A465E4A20B5BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524142, "uuid": "827baee4-87ab-40e8-9ad3-d48859dac961", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524142, "uuid": "c5c1f3ef-2e7f-4e3b-81cc-4e32a01c35db", "value": "12288:m4mO1QUTW+Tey5sQKZcqBzOIAfPmMEwFeerLwibp7g75xVQMtuQJQmZ:m4mO1QUT9Tey5sncqUIAfPrVvlk6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687524142, "uuid": "a41abf0d-f69d-45dc-b1b1-44568875388a", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687524142, "uuid": "87ca28ce-bc5f-4e27-b209-e6a1196daa83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524142, "uuid": "c883c19c-3252-44a1-ba62-a83e6ec08401", "value": "75d703e702dafff0217b50e3c734e835.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c2ef57-118f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687501856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501856, "uuid": "be9fb577-a125-41ba-bb2c-6e3d650b3e61", "comment": "Malware payload (Mirai)", "value": "a77865bad6cbe85f1c800e650568da7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501856, "uuid": "3d79ed97-4162-4652-ad74-6f654150593f", "comment": "Malware payload (Mirai)", "value": "96c4fe2bd82c23365ae06254ab2a4c9c9e05855c42d042031596766a2b447155", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501856, "uuid": "52a9a3c8-a363-436a-b4b7-24ea66dc03b3", "comment": "Malware payload (Mirai)", "value": "3490e926e708d84190f50c14f5ec52cde1076257", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501856, "uuid": "93e70783-b377-4347-a0bf-2fc86f94e170", "comment": "Malware payload (Mirai)", "value": "2b6c91a75b39d6c0c91e2797d055f5d33163e29dac8e38b8fca91c34686e4bbb5a58948e072ce5790693a8c6554080b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501856, "uuid": "25ff632a-f47f-4de3-84b9-ce1d68a480bb", "value": "T11D534B99B4028E3DF88FE97984160E05BA2023D112931F276BAFFDE37D331659D16E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501856, "uuid": "c9b3bd53-ab3a-4460-b01d-73009716ef92", "value": "768:2eY49YE204qEkRf/36fmODeiuQlJZvTgFHq1euk8B8vpG97ErlfXySJ1oX6o7P8:2Y7EkRfPh3iDx8Fq1Xk8B2aErlfiSJMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501856, "uuid": "2a7ce837-3e58-4cbc-82c2-027dc9fd85ad", "value": 65096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501856, "uuid": "b78cd89f-7e25-41aa-804a-4ddc69755401", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501856, "uuid": "433a55ce-13c3-42fc-9511-33b8731fc27c", "value": "a77865bad6cbe85f1c800e650568da7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d6300d-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687510339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510339, "uuid": "de30529d-17d6-4a88-9c02-1ade860fa9ff", "comment": "Malware payload (RedLineStealer)", "value": "d5038000d4b8990a470d4b2b0d2c58f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510339, "uuid": "3e9275a0-e752-4ede-b366-540e7a3cf927", "comment": "Malware payload (RedLineStealer)", "value": "997b4d20dbbae2a542a091e8ab0bc0f5bb3aec08c50ebfc3cff8deb412070d8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510339, "uuid": "6ad39c75-1280-4142-b8d1-63454bd35bdb", "comment": "Malware payload (RedLineStealer)", "value": "0b08a2ff74e93d56542e2847a096f2ac96994c87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510339, "uuid": "7467616e-12a3-4512-ba81-2d59f2173314", "comment": "Malware payload (RedLineStealer)", "value": "60f2ba429168b7f4fe66da6b95d5b04ae4d1bb875ed4e98eeb07fbbe0cbb778c014ced0b444dab83424b527f5d334225", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510339, "uuid": "a72b85c3-65fb-4401-910b-b504f1a176a9", "value": "T17DB4F1CA25404973DF23DDF1D8EFE9964EB970220B710B83120D96F64E462E8E61B57B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510339, "uuid": "96efe15e-ec0f-4479-949e-ad1b7efc8774", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510339, "uuid": "6ec7bd95-8758-4b61-b255-2f6782c9131c", "value": "12288:L+Oe+5Tey5sgIheA6oID5qNakQipJqY7nb5QJQmZ:L+O5Tey5sPheTwNrbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510339, "uuid": "412be7ed-45f4-4f68-afc1-de75006f47a5", "value": 530752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510339, "uuid": "57f68d4b-fc35-4904-a9be-bb544bbda38d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510339, "uuid": "62cfe04b-100e-46f0-ad11-668951ef96ce", "value": "d5038000d4b8990a470d4b2b0d2c58f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6a6f94-1193-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687503399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503399, "uuid": "ca49f39d-5823-446b-99ba-cc5489b9ec3e", "comment": "Malware payload (Amadey)", "value": "3e5e17209712654a455c5c448a435d4d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503399, "uuid": "a960876d-fa5c-40a8-8c83-a3ad23c8e629", "comment": "Malware payload (Amadey)", "value": "999cd40c939e1b7bfc399b411333f4b1fd07ef1309bcc57bc5a6f4050a3a9bee", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503399, "uuid": "1918f9bc-8fcc-4a6b-b3f9-87ddb7206ff2", "comment": "Malware payload (Amadey)", "value": "d54e0d9f87e19393f30ed82af296b49376b172b8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503399, "uuid": "1425cedb-8d0c-4ba6-b77c-5f27859aa3eb", "comment": "Malware payload (Amadey)", "value": "c6cd84d285d947911430b0660f2b396a74ef9afe6f6f11c9b65c5eaf2c3655aa073d39293f26a1a80b7fde0d95beef0a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503399, "uuid": "725f9aef-d97f-42bd-81d0-14a7e09bda2e", "value": "T115B4F1DA25404973CF23CEB194EFE9D78B7A30224B714BC7121D85FA8E021E4E65B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503399, "uuid": "48f7f55f-6658-48e8-95b7-3f4577a5eb3d", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503399, "uuid": "cf8af56d-4b2c-4f2a-87a5-75c15b0118ac", "value": "12288:RkevElTey5sH1jRJ0QgAQWGvsiUzAiG6QJQmZ:RkevwTey5sJRJXg/5vsf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687503399, "uuid": "d31da4f0-14a6-4bf9-ac26-2658f27bd0ef", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687503399, "uuid": "e0e88050-bbc3-467a-bd23-039d3a3fda66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503399, "uuid": "f56f9ad0-2f10-49f9-a73b-cd3a707d83f3", "value": "3e5e17209712654a455c5c448a435d4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936da25a-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499737, "uuid": "ddfc7bf1-5dd7-44fc-b7a7-b1a88320208b", "comment": "Malware payload (RedLineStealer)", "value": "357cc6bb4a28f1839fb1f6928a629c0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499737, "uuid": "c8662ac2-d4b6-45ae-bcb9-0bff0086f93b", "comment": "Malware payload (RedLineStealer)", "value": "99e915cc6f7b25953b7f2c56b6c4c5bc0ff022eae67fb09ea46dd5938850bfdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499737, "uuid": "c286807d-d29e-4ed8-bfe8-26868f2dd684", "comment": "Malware payload (RedLineStealer)", "value": "52d12c656834b4dee93c006c9198f88cb629375a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499737, "uuid": "fcaeb16d-e85f-4d44-b823-ee8b4c4773b0", "comment": "Malware payload (RedLineStealer)", "value": "dbd0b2070d3fa5cd229fcfcab7ce8ddb241c9efbf080e7e057ee988ddf06ec6f82fd93fb6628a7537c6f9fd778b2fd5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499737, "uuid": "b8395211-8c93-4690-ab9d-c80155df93a7", "value": "T1D8B4F1CA26404673CF63C9F2D0EEED924F7A70210B614BC7130D8AF94E552D5E62B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499737, "uuid": "ac26177b-e9a2-4959-b9cf-f8da23ffc325", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499737, "uuid": "b3632772-a9c2-4f64-aa84-c472d2def216", "value": "12288:QI1BnTey5sBmIg6BWrsXTgSj4m6cBlx5omjwTgQJQmZ:QI1hTey5sBm4FXTCm7lcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499737, "uuid": "327f97df-9b08-404c-a7c0-43941f5e798d", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499737, "uuid": "3dd2920f-cee8-4d69-aaf6-7f51f2d10e95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499737, "uuid": "31d2ef6d-0f59-4306-8d83-db9cdc8ffe72", "value": "357cc6bb4a28f1839fb1f6928a629c0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b0182c-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500682, "uuid": "c84dcb91-e3db-46a1-aa76-0ed190a0fd48", "comment": "Malware payload (Amadey)", "value": "b0e79799dc8d915dfb39b1ce69ae348e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500682, "uuid": "f088ea8e-299d-4540-829d-9121681e671f", "comment": "Malware payload (Amadey)", "value": "9a6e82182f889449624ce89de3070143a387ac0797848b212c68fe284dc1374e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500682, "uuid": "93005117-d088-4958-9c7c-e4920ee408ad", "comment": "Malware payload (Amadey)", "value": "8946f8803a18de7360bab1423ed75b830094174a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500682, "uuid": "6409c00a-4afa-4415-a0ab-0235638c0d9b", "comment": "Malware payload (Amadey)", "value": "719aa17ef4238af29bbdf661c1420fcb77e17b8158306e89f821cce1c976970edff35d2858fa0fc80d22ce301c538339", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500682, "uuid": "b01d5ae8-8d20-48ff-9cd7-130d3930715a", "value": "T12EB4F1CA65804473DF73C9B2D4EFECD29FB9B1210B614AC7031D89F58E512E8A50B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500682, "uuid": "d63b03a8-b696-4f76-9b00-6082d17c6e63", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500682, "uuid": "48a94236-b478-4958-a72a-5810c252120f", "value": "12288:CepoZTey5seV4nkfYjFOwdm4a90fogsVwQJQmZ:CepETey5sg4pYwu90fogY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500682, "uuid": "782c474c-102d-4614-960b-d1806d661579", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500682, "uuid": "b05cfda7-9503-4d14-9cef-7bdde3592f59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500682, "uuid": "e6ad5c6c-23ff-463f-8d00-85c7f362e173", "value": "b0e79799dc8d915dfb39b1ce69ae348e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064a7670-1200-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687550180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550180, "uuid": "2f0594d1-982f-4dfe-86e7-51bcf6180d6b", "comment": "Malware payload (Gafgyt)", "value": "f8667ddd17c09e29b08c02a37f026f9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550180, "uuid": "d85a4be9-19a4-4d3a-a189-9c8971e95dff", "comment": "Malware payload (Gafgyt)", "value": "9a76aa2e38d05c282587ccce987482cd25bda872b0f63251ee11437d85151eea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550180, "uuid": "9d837ca8-958d-4284-bf2f-20e05cc245f1", "comment": "Malware payload (Gafgyt)", "value": "6013d1e6515faba228b88772cff06bb810ea8ac1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550180, "uuid": "d7d4da89-9ddd-49fc-8015-e5a58326ac43", "comment": "Malware payload (Gafgyt)", "value": "b4b37cd99e39f4c6252d3d9ac9f389e3ee31a3d6e5975fae590221d57187041918e001bf6f73862fdb12437174afb01f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550180, "uuid": "7f67f25b-43e2-495c-9520-fce2faf09912", "value": "T148933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550180, "uuid": "c5786ddf-628b-4022-a2ce-711763756993", "value": "1536:msqmQTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emmGMUNLe5um7WAgcVjmZIcBI:msi2UVUtBUI8GwPfHkk8rseLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687550180, "uuid": "d24e3ac2-3668-4376-9bf6-82765eefab45", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687550180, "uuid": "74854443-859b-4f31-9212-2c72342fa687", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550180, "uuid": "be2a8e6c-7af7-4923-a88a-a8a9591b5a1a", "value": "f8667ddd17c09e29b08c02a37f026f9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783b2be6-1194-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687503986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503986, "uuid": "85a50313-694b-4d99-ad36-f469b3a4b269", "comment": "Malware payload (AgentTesla)", "value": "f1704d78a43bd138305e179bfadc3665", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "sarahfoils-com", "colour": "#A5BFA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503986, "uuid": "f676a476-b7c3-4b50-a897-83782df30412", "comment": "Malware payload (AgentTesla)", "value": "9ab4351395cfc81d8afabb133e442989b54696cad65e22de72d58398505762bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "sarahfoils-com", "colour": "#A5BFA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503986, "uuid": "f42c8477-3e03-4648-b282-8ce50c214cf2", "comment": "Malware payload (AgentTesla)", "value": "580c3e407bdcd605bbd9aa8b028e38d646cd5f88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "sarahfoils-com", "colour": "#A5BFA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503986, "uuid": "15491210-84b3-4dab-8d56-b2edcc42e27e", "comment": "Malware payload (AgentTesla)", "value": "53bc5d2a8c1a9ffe4228fc95a3efffb7d9674ebd783e5895829a4600f04428b1b18b4974aa4195b339f5991a713e97cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "sarahfoils-com", "colour": "#A5BFA1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503986, "uuid": "d39ad25b-ce76-48f7-9ce3-852db5c9a4df", "value": "T1E0D423383719475AE66C9FB60DE34224137B2B483426DB6A8DEB74C16AC37026643FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503986, "uuid": "2a9babe0-66ca-4b68-a01d-b720b64614ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503986, "uuid": "ba4016e5-c077-49fe-a758-7ea1cda1a2ee", "value": "12288:ok54/mNUAviJiQ8pVcGrylGbdOrtv0vrKJTCwXRnPfQ1:ok54/QUAiY/ZylGJOBS2CoPY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687503986, "uuid": "dfd26c23-44fc-4280-a784-96bffccdec91", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687503986, "uuid": "a084344b-a651-4c54-9745-bbe8a5c80279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503986, "uuid": "e6572975-701e-4377-80a7-328456875ac8", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc0e564-11d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687532852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532852, "uuid": "f746f32e-38a2-4d03-99f9-c146db254276", "comment": "Malware payload (RedLineStealer)", "value": "a2994b24d1e7f0464ab10383514ff512", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532852, "uuid": "cfd137dd-6325-40db-9cde-904791c22123", "comment": "Malware payload (RedLineStealer)", "value": "9b32eb26b980043f8f4c7c13b0956cf1e753d1935bd96056dccbc5a2727f51ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532852, "uuid": "cbb17218-e31a-4627-a918-9ee9da3fb229", "comment": "Malware payload (RedLineStealer)", "value": "440d5f57c1493730b0ecad4a078b6b662703ddab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532852, "uuid": "7602d87e-6bcb-46b2-a9c7-c9546dc8dbc3", "comment": "Malware payload (RedLineStealer)", "value": "a519a29c0bb24dd9e1ece5189978cccaa4f5ff61c6f3630226f7c4118a8de0e4506b0b5b8d335a1f29ec1e9b6f3e1419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532852, "uuid": "809a1b84-c28e-4b9f-9390-6042e9ac0479", "value": "T14155AD83EF491973EA412473E92F77932882A4F1139FB0BAB35F0A96D65383D0574798", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532852, "uuid": "ebc593db-82a0-4d7e-96ae-fce9f6841d84", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532852, "uuid": "42bdf6ea-8d60-4d3f-9404-db97ff25b233", "value": "24576:Xd2HRMlk5y2jeLX0q69s0BQBhfOyoWYt6E6Nh7qK8lxi+BXoQX12sM41IEyMXeSQ:/lkod6YBxOyoCE6Nk5BpFDiVODA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687532852, "uuid": "556a8f4a-eaaf-4a8b-a8fc-b8fabebe44bd", "value": 1358850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687532852, "uuid": "840d7999-4101-485a-8252-52fd7d437cc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532852, "uuid": "68650127-0f15-4307-92c8-dac8003a320f", "value": "a2994b24d1e7f0464ab10383514ff512.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df81785-11bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687522330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522330, "uuid": "37f1b97c-fe03-4a72-ba15-d032637f992a", "comment": "Malware payload (AgentTesla)", "value": "a324c8818af15aee00ff8c82d81b4085", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522330, "uuid": "9ae7591d-331a-4b0f-8397-97629b552405", "comment": "Malware payload (AgentTesla)", "value": "9bb644e02618e641e44354b2daf610ec4239844873c1c8bea96c07aa0447414e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522330, "uuid": "b7b53ccc-4e54-4471-b307-140da7bba6de", "comment": "Malware payload (AgentTesla)", "value": "a2dc5b0e02796c9720cab697d4ccc758adc4d52d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522330, "uuid": "90326387-1eb0-4a92-94b2-4176f3ff265c", "comment": "Malware payload (AgentTesla)", "value": "de2fb20256f62011340b3bb7bc6598574d49afa304d8ac054ff952192106eef8056760ff1dffdc4edefb593617237318", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522330, "uuid": "bf5e1e8b-80d8-45bb-8201-20a0ec874f97", "value": "T1E235F7B8699026ABDCB7E7A24161044DF37B7422B223CD7826D712C5463251E3BEF91F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522330, "uuid": "72c42186-69c5-464d-97ae-b6e71f031d63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522330, "uuid": "31ffd075-964c-42cf-9a0d-54461e662b81", "value": "24576:A71thenV8B1gT9fWjo3EoGaLI/aeMvnW:A7E8T+Ws0oOBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687522330, "uuid": "97b09304-15df-4141-a132-c95011ea3428", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687522330, "uuid": "1a09d018-5d01-480c-9e45-f0bd238d0e9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522330, "uuid": "d74c5ef6-c411-43a0-9353-4a43f46274d6", "value": "rAdz7Ra4TIGmFwkW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119dde76-1200-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687550199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550199, "uuid": "88794296-8bca-47fe-b145-b241439d8385", "comment": "Malware payload (Gafgyt)", "value": "276d462653655ff1fc290bf287ebe29a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550199, "uuid": "267e4f12-7199-45ad-84f7-123359426bf7", "comment": "Malware payload (Gafgyt)", "value": "9c1d5d407796baafa0dcc26ad07cb3d15cfad83e65d8e195d1dc5b69cc2f6d49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550199, "uuid": "65679ef2-87c1-473d-a776-ee78a49f275f", "comment": "Malware payload (Gafgyt)", "value": "d8561171e7886ddc5596576b45cd073267edc7ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550199, "uuid": "f407a5a5-006c-4d28-b791-a08de3095aaf", "comment": "Malware payload (Gafgyt)", "value": "a75886b2f0f2dab1e52f36bbfc88d863bf92745bd2bae74965ae35c21c0419b6842e31076cc8a7a621d3682c3afdbe8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550199, "uuid": "cf2c0c16-ce57-4cd5-a1a2-4137a2c5f6a6", "value": "T19FA35B8AD743C2B3CC530AB2124BA66A4621FD3B092EAF49F7197DB09F374C97125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550199, "uuid": "f0383fd7-fc8d-4da2-9b8f-9bbe334a37e8", "value": "3072:4WCjQrLpnr85EdT9Oa8vqbVr7c/CEgmqAgcVyZIcBI:4f5EdTbpr7cWmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687550199, "uuid": "958f8b8b-ffb1-47d9-a511-c6894ce671bb", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687550199, "uuid": "5a66b73a-0e83-4ce6-8338-44d1fbc3d886", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550199, "uuid": "741539de-5cbd-4d79-a4fe-36c4c2d3a4a7", "value": "276d462653655ff1fc290bf287ebe29a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd12bfd-11db-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687534359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534359, "uuid": "cb6cf626-8569-4f8f-89f8-a86fde4a14c0", "comment": "Malware payload (RedLineStealer)", "value": "947460e88c6bb1f68e4b69083c39c9e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534359, "uuid": "54f4b172-8c05-449c-a640-6c5549054379", "comment": "Malware payload (RedLineStealer)", "value": "9cf5a6a3199e46b269c3b4f7095d9b6051adec99fa82365b5c85d9636eefd38e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534359, "uuid": "72888ab6-42b4-4f42-944f-e2bf17ce1724", "comment": "Malware payload (RedLineStealer)", "value": "d085c414925a7bdfe4404006cb5d8b22978198e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687534359, "uuid": "369edb0d-c228-4271-b4c2-cea7f09fc39e", "comment": "Malware payload (RedLineStealer)", "value": "0900cf9b4206fdaaa44f51f49b211f36abf044dc61bc79489a84ffdf720fee42f7b6c3a7df69d10953deffff3af96c61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534359, "uuid": "c388498e-ab58-411b-834c-3a0843ce919d", "value": "T11E3601792680DA73D7CB7332C053816FC909247596EFB48EA7734DEE696B8BCC860944", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534359, "uuid": "70c80494-b9ab-4c6d-8d75-bb6b2877e461", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534359, "uuid": "7c3bc33d-33a4-4b14-a61b-c1a239169c4f", "value": "98304:rdda0wRemPkXsZBZ5GAltpZpY0Txa1NnEiGhIH78N3ET4SZsIjC+TlUIG8zGabbu:JE0wQcZBPdZpY0FMNERhygN3EBiIj5Ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687534359, "uuid": "2fe669fa-3301-458a-a1fe-5eafea4b95b3", "value": 5243392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687534359, "uuid": "74a1ddf1-d186-420f-885f-14793200ebbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687534359, "uuid": "b958e01e-1fdb-4784-8879-2a47219d7e96", "value": "947460e88c6bb1f68e4b69083c39c9e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6173e27d-11bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687521128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521128, "uuid": "80e29ca4-0b39-4c55-91e2-b86dfb2e8cad", "comment": "Malware payload (RedLineStealer)", "value": "67754deee8258ff327bf66dd415b10e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521128, "uuid": "ba9ba90f-9b07-476e-8226-0b780f584de6", "comment": "Malware payload (RedLineStealer)", "value": "9cff0b078c6aa9d0d067e678963025b1a5fc19a75acb2e08870702f8e35ec11c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521128, "uuid": "c635554a-c642-4118-99d5-b2ab8b2a8353", "comment": "Malware payload (RedLineStealer)", "value": "3ed608baa2d3820ef99720992ab6c595500dbbb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521128, "uuid": "2884772e-6a61-4546-985c-d5a483cb3aca", "comment": "Malware payload (RedLineStealer)", "value": "28b102c0e5532037f74ecb7187d566af3d833b261964888fe2786030bcba1bf7c9ede4b8075bed411db3dca926c4317c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521128, "uuid": "4c4aef5e-8365-4e22-9ad9-806e34d74c53", "value": "T182444CFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA184CA1ABA0952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521128, "uuid": "d446c686-972f-41e0-a7e8-43b1ffae25ca", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521128, "uuid": "19ffed28-0207-4328-a2c3-65a59404a34e", "value": "6144:PdF+chaigt0poiRG/XvLNUgYhuE22AQJQmp:PD+cfgtAoiRG/fSvYQJQmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687521128, "uuid": "cb97b7fe-2ce9-4a5e-a3a3-3b5f9a5164ea", "value": 275780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687521128, "uuid": "6967549f-3538-475b-96a7-4e488318be01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521128, "uuid": "40bedcfa-5b11-43a4-8b38-99f7d7a097ed", "value": "67754deee8258ff327bf66dd415b10e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904316f5-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499731, "uuid": "dfc1be00-7f21-47ca-8ea2-264e6296e663", "comment": "Malware payload (RedLineStealer)", "value": "34a47e95e251b4f472e9233ccadd3388", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499731, "uuid": "aa20ac5b-6cff-4526-820d-360329223f23", "comment": "Malware payload (RedLineStealer)", "value": "9d16c3644d9c90fa28dfd5777663bc3a6f886403f2bbdbf64a4e453ee3d5e08c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499731, "uuid": "1fe1a58e-64b6-41a0-9c62-df2e6ef84e16", "comment": "Malware payload (RedLineStealer)", "value": "ecb5ff12a6b9895e6539faca42573c87b27e4ab9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499731, "uuid": "d489d2f2-f6e1-4a2e-b179-0e9080de9044", "comment": "Malware payload (RedLineStealer)", "value": "1c06e5c48f8cc1beddbce4fffabcdb10bffbb16a2b84df708d80da1bdb071ab5b88d1ac33dd68107a8a79a581e7edfe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499731, "uuid": "e8b1dde7-418c-4594-b8fa-045be64008df", "value": "T1F5444BFB52D1D460DD0FA4B02D6EE1BDDE31B461DEA284CA1ABA0952D3430E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499731, "uuid": "75879689-fb6e-4745-b101-2fa2ce3d3165", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499731, "uuid": "6b674971-173b-4924-9841-d47d81bfcffb", "value": "6144:ftSKJigt0poiRG/XvLNUgYhuE22EQQJQmp:ftS9gtAoiRG/fSvMQQJQmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499731, "uuid": "d0f3db43-75c9-4b46-a4bb-aae86f8201d6", "value": 276292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499731, "uuid": "cc511586-50c0-460c-8c10-46f97d987ea2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499731, "uuid": "15512bad-06df-430a-913e-c2cb8856e7a0", "value": "34a47e95e251b4f472e9233ccadd3388.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f73b27-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687516632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516632, "uuid": "0482a731-1e92-4da9-be88-06ca0dc5d78c", "comment": "Malware payload (Amadey)", "value": "35ce5d639e613167581f53fdeb082941", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516632, "uuid": "c4814bd7-c3ae-48dc-a5a6-9bdf4054397f", "comment": "Malware payload (Amadey)", "value": "9d5d0fd63d75297c678af975fcbfa5314b34d9bcec0affd867c52255cbc24f01", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516632, "uuid": "235ff9cb-af2d-4eb5-88d2-f9c608db6845", "comment": "Malware payload (Amadey)", "value": "90d2935fe8b21681770ebb4cb1abdc77d62d8bce", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516632, "uuid": "bc791b34-8509-4f0a-a434-3bb64e31018d", "comment": "Malware payload (Amadey)", "value": "699ebe825df0f439840444270a06a93075e2a7801f1233e9bd2c068b231b9a27ec23e1872bc94ec0b89bb656e163f418", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516632, "uuid": "c01d1d88-32e6-48b5-81ac-09e8e7480190", "value": "T144B4F1CA61404973CF37C9F198EFE9D64EB671210B724BC7234C8AF64E456E4A11B93A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516632, "uuid": "c5a101fe-e465-4bda-a3f1-fab01aa7bf6a", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516632, "uuid": "305a0c89-90b3-46ef-a98a-7d0b8da0d102", "value": "12288:9+kQB/Tey5sBl6QyQAcgxPk5gQJk9olkPC+zz/YaWZ0MQJQmZ:9+kQRTey5sj3yzxPEgskqqK+zz/YaAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516632, "uuid": "b915bb05-d434-4248-9721-b0a098207474", "value": 540480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516632, "uuid": "bd127087-03bf-4fcc-b5a9-2882124a8f73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516632, "uuid": "90df0c4b-c239-4cb9-adfc-90bdb12c6b8c", "value": "35ce5d639e613167581f53fdeb082941.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d3ba59-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516629, "uuid": "f9b78c90-cd70-46de-8376-2044e6563aa1", "comment": "Malware payload (RedLineStealer)", "value": "ad652c98142a97dfaf5b8675c0857d26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516629, "uuid": "fc630782-d07e-492f-900a-af024f5bdff4", "comment": "Malware payload (RedLineStealer)", "value": "9dc1da6e3aedc1fc1e8d472cacf667341d3bc2ef1e13df1f0e1329415887ba1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516629, "uuid": "c0a2584f-c34c-4b74-bc18-74054dadef5b", "comment": "Malware payload (RedLineStealer)", "value": "3e87ee47557c0b0ab3e07841f3b8ae5a49395260", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516629, "uuid": "d80f3e95-aeca-49ec-8745-f939d292ac4f", "comment": "Malware payload (RedLineStealer)", "value": "33dd669f9b64f868e710ce146e1d551670f5180bceadb7bf16a7ad4f20fd9515a7f1dd9b70f9ac0b3a08d2a1ac5e5793", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516629, "uuid": "96722704-664e-4453-a97c-d1588dd63095", "value": "T103444BFB52D1D460DD0FA4702C6EE1BDEE31B461DEA284CA19BA0952D3530E4BCE798D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516629, "uuid": "7b329dc6-6057-46e1-ad92-fa02ac697e35", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516629, "uuid": "79dcc628-0903-4d6f-9805-db01813eefd6", "value": "6144:QkUdqcigt0poiRG/XvLNUgYhuE22nQJQmB:QkUdigtAoiRG/fSvPQJQmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516629, "uuid": "33c194f9-431a-4ab0-8ec1-13c6be233585", "value": 276290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516629, "uuid": "4a6f1f1d-d1c6-4ef3-a6af-7817e5f8cde6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516629, "uuid": "53d7034c-9788-453a-8544-b25e237308c3", "value": "ad652c98142a97dfaf5b8675c0857d26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55eef2eb-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500063, "uuid": "6d6b26cb-21cf-4ac6-9150-ce9488407519", "comment": "Malware payload (RedLineStealer)", "value": "675366121b423ed877376aae482ebe0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500063, "uuid": "1dd6b9d6-62d5-488e-91e1-d32686d1ce7a", "comment": "Malware payload (RedLineStealer)", "value": "9e4cd26ce162e81ef77c3465b400a661a910f0da9d6bdecedc1883192b1215af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500063, "uuid": "2bb503cf-6f7f-4794-9478-937659067896", "comment": "Malware payload (RedLineStealer)", "value": "187a94118c4f378170a7d9897d080dffaf8d3278", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500063, "uuid": "7ece7136-7334-45a0-9e02-5e9719b5a2fc", "comment": "Malware payload (RedLineStealer)", "value": "2fc413b9003ee22e0e709caf74cc55a8c0b5e29bb930ce238bde88f5588c7506b163eae078996fbe468fb3b44f0085c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500063, "uuid": "af98d91d-39ac-4ca0-87df-0300e7b56a42", "value": "T157E402CA36404533CF27CDF1E4DFE9E64EBAA12007724B87124C99F54B465E4E62B63A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500063, "uuid": "97294e93-3973-45b6-9011-763bd189bd85", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500063, "uuid": "74175650-3ccc-405c-a906-10633c7a5819", "value": "12288:YpQvzVTey5s2xpNgqY+J4SewgkF5lDVR8kVbBySnelQJQmZ:YpQvxTey5sANg4F5dfXySZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500063, "uuid": "7cd1802b-b99b-4513-985a-82eeea32ec18", "value": 715072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500063, "uuid": "558b5641-4409-4018-97e7-238575265e13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500063, "uuid": "ad9b0e1a-5986-4788-b2cb-2963d10c2fb2", "value": "675366121b423ed877376aae482ebe0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d1dda8-1220-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687563954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687563954, "uuid": "6ddff3ed-ad8a-4fa5-8157-cd60fb124180", "comment": "Malware payload", "value": "2e7d83aad840e875de69239376baede5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687563954, "uuid": "86036dbf-877c-4126-86a7-b6d3e90e990c", "comment": "Malware payload", "value": "9e9b942334161f4815f8101c575914155cf6aaf6e9e5cad6395973e66094eaf2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687563954, "uuid": "c7e67c89-5e04-4f5e-9c78-5ee0b7331694", "comment": "Malware payload", "value": "2a54f096509c584ef6eb1845923467b2b256e9b1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687563954, "uuid": "1f8da425-33c7-4b7f-9e71-94b0e3808623", "comment": "Malware payload", "value": "10c276e5d90679dfd74a57430385957522a05bfd1049a6b24fbf1ef3e8c8dff736db67712f4f2920fcef14bc4c88d8a5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687563954, "uuid": "e938af0e-7c07-43a4-87b5-8fbaef44e0bf", "value": "T1A4711C33A94DDE52D29952D3C54C7DF89376F25302CBA6815083E8B8147B325DA2BDC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687563954, "uuid": "360c7d82-a229-4c6c-84cd-f64f8a25961a", "value": "96:LoQBw9H4cc/hqicZ/YH0iNkXBsuX8cMKTpujUfjF4l:LoQBw9e5qzSUQkauX8aB4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687563954, "uuid": "c8114868-d722-4344-9ed1-a90541ec1bc0", "value": 3638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687563954, "uuid": "d45bd496-6f70-4ddd-8581-01417f3287d5", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687563954, "uuid": "e74f16d8-94b5-4050-9b67-8d556cad72a3", "value": "SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.13354.28314", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5555bed-1193-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687503686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503686, "uuid": "6fad2968-3fdf-4f14-88e7-415645e38afd", "comment": "Malware payload (AgentTesla)", "value": "14af367cdaf137a5b46a9b1c76d71d33", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503686, "uuid": "f7243a0d-4baa-44a3-8322-47dad8c186aa", "comment": "Malware payload (AgentTesla)", "value": "9ea3cfe9f3453a21a9777b1418ce96d4e90c161bd3eab7acaaee1fd98bb50371", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503686, "uuid": "dfb30224-0412-48ed-af99-12a8a101701d", "comment": "Malware payload (AgentTesla)", "value": "f5ed5daa5da2616a0d4d72ec84582e056f76c22f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503686, "uuid": "33328753-da1c-4d80-b35e-07f8d4c97609", "comment": "Malware payload (AgentTesla)", "value": "2254ea4c3fa79d24e556b9ba6865c46d7824b12f19a36daff57948e7384e1de20038e9372efd13d6b1c54849b8943002", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503686, "uuid": "b96aa351-0934-403c-98e2-ebcc0056c7fa", "value": "T1AA541260B1E5C56BD9629E710B3B2B4AE7A8AC27B4E0560F1B505E5E7C33BD0A05F370", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503686, "uuid": "9244bdeb-48de-484e-b1f6-a83a5f651678", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503686, "uuid": "b2808b67-ca3d-4b22-bde9-ade87837e149", "value": "6144:/Ya6zDRmtFAUMoXRYX+PyzAI5F8nzH+YDZjmyHaDoexkd2i3:/YhDRYFAxohC+yAI5+H+ijmyhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687503686, "uuid": "78b76db0-f0d7-45d9-a962-19330f8403c9", "value": 289194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687503686, "uuid": "fe45404b-5cba-415c-aada-06b4c0bf1d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503686, "uuid": "2a5200d2-fae0-4f2d-a785-958c9c3b2240", "value": "SALE ORDER_23062023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c44afe0-11e2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687537359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687537359, "uuid": "ed1bd542-8ddd-45e4-adb6-1d30be9c14ba", "comment": "Malware payload (RedLineStealer)", "value": "b3c78334055b541515621b762fe3944c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687537359, "uuid": "a357ab10-b4db-458d-8e69-bfc0bcccdcd8", "comment": "Malware payload (RedLineStealer)", "value": "a0866d3b88aa80c674e1bd8f4c53144877add3f2e82cc9ecdb75e397be8a53c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687537359, "uuid": "9a452710-2a68-475d-be65-950a6eeb74b1", "comment": "Malware payload (RedLineStealer)", "value": "a9215a0a56d6d7e927bd1ae6a8d7c86e06dcc890", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687537359, "uuid": "0cf1931f-b4cb-4d15-b9e7-7e40dab83874", "comment": "Malware payload (RedLineStealer)", "value": "bc9c20a3f8cad4fc36b6128f463a472a28b710914ea07b42cd96d6bc37e3d89449b4dc768a1cbd8553071ad78fd39ed8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687537359, "uuid": "939d8f2a-9159-4c8b-a0e2-a2e781ebf069", "value": "T1C924F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687537359, "uuid": "d524d4d6-b8ff-415b-8ff4-6b95dafc2bd3", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687537359, "uuid": "78b8a642-bbd1-4e4f-8db8-890ce4c9d40c", "value": "3072:meTRJ0kHbnpN23kQKp5XzutZXKGrpeN84LuZAIybiy3xEfbi:FTR2AnpN2wDurXBeBuZAIMEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687537359, "uuid": "ae6c5a2e-d9e6-4d78-bc0d-574e1a330d83", "value": 219915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687537359, "uuid": "5be7cb56-d6f8-4b05-b24a-cf767db93cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687537359, "uuid": "2b80845b-4926-467d-a623-74384d8bc027", "value": "b3c78334055b541515621b762fe3944c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df415765-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687516614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516614, "uuid": "1a297792-9b7c-4042-a8f2-dfc6f2304082", "comment": "Malware payload (Amadey)", "value": "72105d8c610f197c14d67540b8d5eb8c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516614, "uuid": "4e7a1523-8866-4d85-9038-1129ddb34338", "comment": "Malware payload (Amadey)", "value": "a097e2bcf4842f47aec18728232b24857b64a91286dcb4e56fd7c0979a13c144", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516614, "uuid": "8b252a26-caf9-4fc0-99a1-7a1da037cff2", "comment": "Malware payload (Amadey)", "value": "d95ac47c310eefdffb8badefb7bd3cad95837efa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516614, "uuid": "309bebcc-4724-4a23-bb78-8d5dec26a8c5", "comment": "Malware payload (Amadey)", "value": "76a94ac24e84de90cbc84339fae3e5c351e74bf75853ff9a29bba4f0ee977142cd5bf91e56c6836f778ad23890b0cbbb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516614, "uuid": "528d49ac-454f-413b-96d4-d2fe8ca8939c", "value": "T13DE412C7618049B3DF63CEF1D4EFEDD25E7AA12107A587C7120C46F64E465E8AA0B43A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516614, "uuid": "6d76cc08-6119-4f24-8e4d-4a9ae395887e", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516614, "uuid": "f31fdc2f-5948-4e1a-8d0e-ff008e31e53d", "value": "12288:Uh+mcTey5si4z728iPOfO+r4TIw/DE86lKUwugeNuQJQmZ:Uh+7Tey5sB2AkJg8X7uBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516614, "uuid": "14996318-dd99-4cdb-8712-af3484edf17c", "value": 714048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516614, "uuid": "4fda84fb-6c44-4947-852c-9e3b90d3f885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516614, "uuid": "d75e4c18-9359-4554-9d66-10755d27a0e4", "value": "72105d8c610f197c14d67540b8d5eb8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c399d3-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500361, "uuid": "3d593af7-da86-4724-8bc5-3986df97b5b6", "comment": "Malware payload (Amadey)", "value": "80adadf9fabc5a69d45aa7d78a147261", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500361, "uuid": "4ac7e077-d00b-4bf6-8ed4-5706f7baf061", "comment": "Malware payload (Amadey)", "value": "a0cf6d56e6d5bc3905ea5f89439cb786c005a5d4321119e5e33a7ac7867fe888", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500361, "uuid": "4403a20c-c417-4535-a1b1-e1240d3f2854", "comment": "Malware payload (Amadey)", "value": "dc5e2417015e8848c6b7d68fcde193f3e74d4567", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500361, "uuid": "29bac1b9-c297-4b9c-b9d5-fd3bc3b79796", "comment": "Malware payload (Amadey)", "value": "f7530cde425f75e7dbc8317ca712630d65050811a5f92f3251500000213c16d1b4cf6010bae7e54ca6b714f36c499324", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500361, "uuid": "b992b03b-3198-42a6-8c5c-6ca51bfc1ec3", "value": "T195E401CA21804973CF23DDB1C8EFE9D75ABE70220B724787121C99F58A116E4E60B57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500361, "uuid": "9a3bd438-9531-4c5b-9cb0-14b06ef6940f", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500361, "uuid": "9a519028-1e5d-4a66-b4eb-025db1e5c0d5", "value": "12288:9UdmITey5szg/MlyOW5hrzA7foZ4JwiGmBUodAlAR7Wz82LJtLqIQJQmZ:9UdXTey5s8/wyb5hwzo2GSU72WYuJt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500361, "uuid": "a435144b-b56a-41e7-8c7d-8ef2fe47aeb7", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500361, "uuid": "0ffe6484-5350-4c6a-b12c-58da517c4e63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500361, "uuid": "86b2bb21-d686-48f3-a3d3-96ba3008100f", "value": "80adadf9fabc5a69d45aa7d78a147261.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a31e1c-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501594, "uuid": "be5d8f52-a5f7-4dc9-a2f2-4c0aa27787a3", "comment": "Malware payload (RedLineStealer)", "value": "cf7acbc74802d1c7555f2ba2f482fabc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501594, "uuid": "a7230bfa-7dc5-428d-a705-e279c461198b", "comment": "Malware payload (RedLineStealer)", "value": "a1cd08c2ccee6b8dbc8937670df812b9de45d5ef3428758de3dd366f14c030fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501594, "uuid": "c0c43a8c-ec88-416e-8a57-ccd43082d839", "comment": "Malware payload (RedLineStealer)", "value": "18e89bbb74765db5b407139616e6c34e2465cbdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501594, "uuid": "412d3c2a-5a82-421f-8af7-4193aa6340d2", "comment": "Malware payload (RedLineStealer)", "value": "d7276368bde45931c7788b0b1a2a6131d2a5e210b19c3d7aecd0805b2cb936bcf68786f25b95d2538c88ac62482dacd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501594, "uuid": "fbd79108-ea5b-4763-bdd4-192932d38501", "value": "T130E401CA65804473CF63C9B2C8DFE9D64E7A70310BB247C7125D9AF14B496E8A60B53E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501594, "uuid": "c47cf784-c026-4949-b149-f90afacef732", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501594, "uuid": "13944c7e-cbbf-42c2-af9f-fe88e2f2167a", "value": "12288:ow74mO19epsWTey5sMgnWA+1G0rvALM2wCPE1/iUdmJXEjMIARKL0RaF5NpQJQmZ:ow4mO19eprTey5sMVw0r0vs1KdXoPARX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501594, "uuid": "e3d43d26-c866-4305-b9e7-302500bf9c73", "value": 715072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501594, "uuid": "abc51e7b-fa72-42f2-8c00-00f2425f3da4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501594, "uuid": "a4e10510-b61d-431b-ba85-40607a0c70b3", "value": "cf7acbc74802d1c7555f2ba2f482fabc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408d7d9b-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687510335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510335, "uuid": "c5021dba-431c-47a5-bd05-0361e5212566", "comment": "Malware payload (RedLineStealer)", "value": "ca904bbe461b2e5ff02b8499869fa088", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510335, "uuid": "43499414-3485-4c45-8514-f83e510ac728", "comment": "Malware payload (RedLineStealer)", "value": "a24696bc91814d3da6eae746775f924b93d040bfd8b2951d13bdbed35cc43226", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510335, "uuid": "e08efec7-e4da-4120-ba76-0d7a54f1f618", "comment": "Malware payload (RedLineStealer)", "value": "0aa9800bbd2eef23d928b7bd70eb20ec743d67d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510335, "uuid": "89bc4982-b34c-4c41-bbbb-ce3203065035", "comment": "Malware payload (RedLineStealer)", "value": "19d8437b6f24aa547129dbd18d46f53a7d116586a97ea16d71620d5a42d982a8326086e9e682df686b4a564352939ddd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510335, "uuid": "3291337f-1008-4bf4-bc34-19c03a7ea486", "value": "T17BB4F0CA25404673DE63CEB2D4EFE8D60FBA71210BB28787130C8AF54E455E4A61B57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510335, "uuid": "112a3336-feb6-48b5-83b8-ef0a4a811605", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510335, "uuid": "cf9c37f6-5a6d-4d5d-bac7-b495efeef7b3", "value": "12288:gkvZXTey5sDgbDFMo5vjWAz0c9BsQJQmZ:gkv5Tey5sDIMo5bV0c9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510335, "uuid": "c8b9179a-a98d-4221-abdc-1d600ce1b4ac", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510335, "uuid": "e12a2aa9-b3d2-465b-9ba4-d21600316286", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510335, "uuid": "fa7927db-6333-4b52-ae6a-dd242afa3def", "value": "ca904bbe461b2e5ff02b8499869fa088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0832909-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687516643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516643, "uuid": "d977a968-a1d3-4a2c-8b45-88127efb5b2b", "comment": "Malware payload (Amadey)", "value": "e8b51ffa3c36a9135443b17bc060dfb8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516643, "uuid": "f3ac14d3-3a77-410d-9ff7-c510468da2b4", "comment": "Malware payload (Amadey)", "value": "a29570bb2fe1d094f7a69b9456291d724f7e01cb8a9f05d925b02934cd8a9f43", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516643, "uuid": "54954136-0176-45bd-8094-dff80b6fb1c0", "comment": "Malware payload (Amadey)", "value": "4ee0288f73c4bd1c9461ca885fdff4da6736263c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516643, "uuid": "f3af1410-b507-4df9-a514-759619e52d74", "comment": "Malware payload (Amadey)", "value": "499c3bfe0f92bda7eb07e4c4ceb798027ab8b8d3c0562a9c57564027069a3f03daed40541a42019ae7eb8ecf50c9210a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516643, "uuid": "7cb3e10a-7953-48aa-b3f8-71bc72efa812", "value": "T126B4F1CA25804973CF33D9B2D4EFF9D24E7960310B654BCB124D8AF58E416E4A52B63E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516643, "uuid": "7e7156e1-edc6-44bc-85c4-28c215010c56", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516643, "uuid": "55b2ee73-162c-420b-8a2b-08db522715d7", "value": "12288:s5ItTiqTey5suFUTv74biDFLZGmfF6nsikjPLVyni1QJQmZ:DtThTey5suFUTOY6mfF2kjPsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516643, "uuid": "913b50d7-f8d4-4b35-866b-8bba00417855", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516643, "uuid": "5dac4b86-aea9-4a9c-8593-5a624bb85185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516643, "uuid": "d537e35e-8634-4ea1-a34d-26b1b256256a", "value": "e8b51ffa3c36a9135443b17bc060dfb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3755966-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687501589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501589, "uuid": "ffaf0ad6-58b1-42f4-9d4c-c04ea23ed83a", "comment": "Malware payload (Amadey)", "value": "f769f616dac2fe2a88afebe893736a69", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501589, "uuid": "20c8c41e-ca7f-4107-9a89-06b2dc2c8392", "comment": "Malware payload (Amadey)", "value": "a384dd560652723b10f1df5176f8074e213299282b2fd26ed9add8246c02d8cc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501589, "uuid": "1b461a9b-e304-42a6-a35c-1c6baa7ddc81", "comment": "Malware payload (Amadey)", "value": "38589bea95201df9e1c09fb6d9a43060eca9182b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501589, "uuid": "735ee72f-03c6-448c-a11e-ba96f622a2b8", "comment": "Malware payload (Amadey)", "value": "efa57c20bc5984d8ff386444ece2c1916f7d9142531432c449813c8506cbb41081148372ff3da11a1f79f85f55ddd1ba", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501589, "uuid": "06b09e3a-8ccc-4ed9-b5f7-b7644be2fbcb", "value": "T12CB4F0CA26804573CF63DDF294EBE9974FBAA1210B724B87131C4AF58F512E0E51B53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501589, "uuid": "b1db20ad-6a93-43df-9785-531398a666c0", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501589, "uuid": "50e310fc-2ba7-4869-9271-5169e215e055", "value": "12288:h0jYLTey5stoWTpaaGf2lQbXzVtlyNQJQmZ:h0j+Tey5stoW4aGeSb5tb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501589, "uuid": "97433211-ad3b-4a67-b8af-5046d3fb5bff", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501589, "uuid": "27f1c5e3-b787-4113-88a1-5c357374a33e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501589, "uuid": "a3840c19-54cb-40be-b010-010ee6939765", "value": "f769f616dac2fe2a88afebe893736a69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87586e7f-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687501005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501005, "uuid": "40c888bf-11ed-402c-9bbe-5acbe7b0e170", "comment": "Malware payload (Formbook)", "value": "3542967f946485176bf307fab99e5495", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501005, "uuid": "e537970c-b0b6-4507-aa72-687a0a13a771", "comment": "Malware payload (Formbook)", "value": "a4b897caab7668255e8c84808b12e4aad213b800fe87dec34ced3853cf3d2bb2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501005, "uuid": "2eddffa1-2202-4220-a372-dc39aaaa89a3", "comment": "Malware payload (Formbook)", "value": "6ab933c5349556460136301fba3da974b334149b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501005, "uuid": "709c855b-14ca-4c73-b994-da02699ff42f", "comment": "Malware payload (Formbook)", "value": "eabeabd6c56a8122c23d96cf69d38d3e28eabb4322451290c4d7e6ceffd7833f9fdd07384d1f03d1b9ace6c250c848cc", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501005, "uuid": "854b1592-2c31-47b8-a08a-db2ce1ebed25", "value": "T1804533D5DF805DCABC4318BB5E51393E2F6DE007B7A9464440E2EA07DFE6A813AF2518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501005, "uuid": "e3aabf9c-d985-4f35-b13a-9a4f6640555c", "value": "24576:s/8jluzE786vLrlwZHSEj0h/sfuoOAxRYTK/OtnNIfVa0lhh3K:njluo46jGHHmoLsK/qnadfja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501005, "uuid": "ae395eb1-c8ad-41b2-b602-7ce3c0dd9b98", "value": 1267516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501005, "uuid": "11115dca-7363-4a05-992e-21eeb5efa657", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501005, "uuid": "5c965dfc-babb-48fb-94d3-8ac22f03bb12", "value": "GCD-43216-25045.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10724d25-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500376, "uuid": "24b67695-addc-4261-bc73-1d5744ca761b", "comment": "Malware payload (Amadey)", "value": "7f5ea3dcb3d4963de6d868b57448daa0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500376, "uuid": "c9beb163-35db-4a8d-8c55-ff4e29ed0969", "comment": "Malware payload (Amadey)", "value": "a62c45020100ff0e732f5c23118d8294244b25d06ed11634111ee04b37a92616", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500376, "uuid": "a19757ed-8480-4f54-bdd7-a55dccdcabc2", "comment": "Malware payload (Amadey)", "value": "3db76dad6156aa90de6cfc4fca28098020dd09ff", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500376, "uuid": "826e8d93-35b6-44d9-b0aa-d034f8192100", "comment": "Malware payload (Amadey)", "value": "5a9f8f16d6f05150d9d2120fa6a002c7065906d151d2cee0e0b64b6ab188bbaa85d8954ab0144567d8fa2361fa0c083b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500376, "uuid": "2977a34a-3637-40b5-aec9-edd9cd18324f", "value": "T196E402CA62404863CF27CDF2D4DBA9D74F7A70200BB54BCB120D4AF59F426D5A51BA3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500376, "uuid": "eea0d60e-4f83-4753-a6bf-2e453f764eba", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500376, "uuid": "f20416ac-e1f2-4eb0-8ad5-fb61aabb7bba", "value": "12288:PEAZvyTey5sgG/8BqHD+6yfC4a3NJw9BUEybfd8MZEm7zPRbQJQmZ:PEAcTey5sg1tqqMJym7zI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500376, "uuid": "ac3947fa-965b-413e-a647-152e38eed91d", "value": 713024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500376, "uuid": "edb2fc86-f063-48fe-b73f-45821befd97f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500376, "uuid": "fb0ebf0b-3e6c-44ce-8200-521abeeb8de4", "value": "7f5ea3dcb3d4963de6d868b57448daa0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd446f71-1193-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687503699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503699, "uuid": "801d7c27-fd9d-40d3-8439-29e60da1a605", "comment": "Malware payload (AgentTesla)", "value": "8d46912471827747b7ea74be2f6eb1a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503699, "uuid": "1af95ff4-afab-4625-a214-57daf9b227c7", "comment": "Malware payload (AgentTesla)", "value": "a66b73a03a1ca865e7f9eb36e57a3667e5d20127fa3a9c7212fd29e951f8a3e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503699, "uuid": "199f41e0-8f7b-4cf9-b747-2c4277e8bd0b", "comment": "Malware payload (AgentTesla)", "value": "67195572fb2b56b62eaf72ecc912b3bf02b382bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503699, "uuid": "313bbbe7-f7c0-4ce4-8463-036da56679fa", "comment": "Malware payload (AgentTesla)", "value": "c3d502d40c29484f81b83b8b4f9a9a2e3869d4394fda7c2f9135e9651f2848e957deff4b501ae3dd70c11244b73d5c31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503699, "uuid": "c6d371bb-37cd-444c-814d-d62d9a8256bd", "value": "T1BD4422ACDD963E20C3E446D11539524BBA3C8A9F9F4F89D7B35A9C81F6C5B0E578C280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503699, "uuid": "6b2b7d6a-8c80-4ad4-ba10-5d4cb40ec14a", "value": "6144:Df9Z/7Lh2ydsh61BpOnbOY0rX//KUJE6ohML:5B79vdsQBQnKr6zhML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687503699, "uuid": "f3ffe923-12e2-474b-b389-6d66acbfc6d2", "value": 276729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687503699, "uuid": "69dfdf6a-da00-40ba-a09e-0ef647babd18", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503699, "uuid": "60937fb1-b941-40c8-a6c7-c4c1603c9264", "value": "94762156001348.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9810898a-11ce-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687528950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528950, "uuid": "1e296b34-eddc-4a74-9260-d39bc1fe100c", "comment": "Malware payload (RedLineStealer)", "value": "dd91e76da40ef2d28f90a11f89e5331c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528950, "uuid": "9e15ed6d-ff2b-472f-a69a-ebb68d9a312f", "comment": "Malware payload (RedLineStealer)", "value": "a67e1a296014ab986232d32f1836f815576f04ede2781b6c42f89098fb1c0368", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528950, "uuid": "12e3fb61-5b1e-4ad4-b7e5-8014551e6f04", "comment": "Malware payload (RedLineStealer)", "value": "22f92d495a73c1e92b71a280dfc6e32446363ae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528950, "uuid": "ea31485f-b006-4c3c-ad0b-ee44cc4a5003", "comment": "Malware payload (RedLineStealer)", "value": "2ce7bccba7f3d94903abe9d5a3eebda1b4b0144febfd3a8056ffe70be93addd187a42db146d37a756f9a51408597e4fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528950, "uuid": "2f322d3d-51c2-4e93-959b-a45f76004d02", "value": "T18B0612792A01E633EBD7243AC0A3529F485D6A71065FBD897FAB0D2799A70DCC035BC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528950, "uuid": "182fca78-6b64-4384-93cf-6802fe17f22d", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528950, "uuid": "56c7dc96-415b-45d5-bdcf-7d70f4508e8c", "value": "98304:Ens73tgUbsnSMWJOQpubSo5OvwvIMytAykbPiT7awItch7IraTRyM+60esMOWhZ:Is73tgUbsSAQpub55OgytVKiSLtch7W/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687528950, "uuid": "e47ea21e-49c5-4b03-a983-a280b8419b62", "value": 3784704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687528950, "uuid": "dedea577-5b54-4312-be6d-1f0db3d4c832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528950, "uuid": "d7f82bec-36bb-4522-b328-472e3c103f3c", "value": "dd91e76da40ef2d28f90a11f89e5331c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c9cf32a-117e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687494464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494464, "uuid": "3361a9c6-5223-4669-83f6-c1ad467892e1", "comment": "Malware payload (AgentTesla)", "value": "d9bd1cb79ac28a6b517ee79ad7c1fa48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494464, "uuid": "e2816fd7-a2ce-4515-bbc4-6d5f53a2a89f", "comment": "Malware payload (AgentTesla)", "value": "a74174da27ad7415025fd5f70ec71f0b9d87ec0b3227b7bc7355cc0fe82269e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494464, "uuid": "5dd28e63-0dfc-42a0-9591-c6c1b56cb5cf", "comment": "Malware payload (AgentTesla)", "value": "4af9944634c77090f3152b4f0409135576f06e2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494464, "uuid": "74d02069-0b9a-42bb-93d1-797f21329c47", "comment": "Malware payload (AgentTesla)", "value": "37384e6c1fb1794c0ced0bd04086f636bcf1af5517caf32892c8266dc6125e8ad9c586696f530f29ae5d5df2a2545728", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687494464, "uuid": "cd5ba706-0807-4839-b1aa-652742235ebf", "value": "T1B915230F3A6C6E13C1AE8EB958A61A11C3F9FD667113C30B7D7470436EE6B514C2299B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687494464, "uuid": "59ef1cfe-da03-4c0c-8be0-059a7d65db81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687494464, "uuid": "706b7116-21eb-4239-a1a6-1f5b3778c86a", "value": "24576:jc54/QUxI7jUU5yZML/GjM6FmJup/pMTNF5pksVmy3S2:v/6Tz8DgK/qHUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687494464, "uuid": "8fccca3f-e0be-4218-9eeb-14799d99d65d", "value": 916992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687494464, "uuid": "d65b0fb3-a785-401f-9701-76fde1eb9a3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687494464, "uuid": "c3c18870-b7ab-4bcf-a1e7-4a8e74b70c86", "value": "SecuriteInfo.com.Heur.31923.1569", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9d1a52-115a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687478891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478891, "uuid": "f079426f-974d-44e6-8b22-6eabe62bf387", "comment": "Malware payload (Quakbot)", "value": "acd886fcd9e8c905e985246e0ed211c1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478891, "uuid": "4a3804d6-730e-45a2-aa78-e1fca0280186", "comment": "Malware payload (Quakbot)", "value": "a7610b568f3936365966d1430812cb2990fd8d1810b927076601d2757cf5b7a2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478891, "uuid": "18bb1652-f3d1-418f-a104-c3f0398cc2c1", "comment": "Malware payload (Quakbot)", "value": "df4c7f90956ff0a72d2d6c66b875010f37e31fed", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478891, "uuid": "1d754725-fb13-4a5a-a7cb-95daf7050fcf", "comment": "Malware payload (Quakbot)", "value": "ef108bed080eaedc0491eca22b2417c276519e75f2388569efea6cf99dd2343cd50f685d2a61325cdded678c8d702858", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478891, "uuid": "fde3b7ee-4a73-446f-84f7-5b37fd6f2774", "value": "T15F558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478891, "uuid": "4a477570-b5ca-47ae-b70d-e5482ecb9c26", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478891, "uuid": "a1008b64-51d8-45f6-bb22-d7606176aac4", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4yCQ:QbkS7XB1EsOSNPSp0EAt2bUeM4yCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687478891, "uuid": "a50e1902-f6d0-4ebb-ba3a-074433949ba8", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687478891, "uuid": "4fad1e28-7ee1-4d79-a16a-d03314cc3f2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478891, "uuid": "c1db8a9e-84ce-49f1-8e2a-937298e29839", "value": "04qbot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59bba2b0-11fc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687548602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548602, "uuid": "eebe45dc-5eac-4a9a-a6b2-8c0c7b210a2b", "comment": "Malware payload (Quakbot)", "value": "2c386a129a000986b48ce1a11a7d7fee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548602, "uuid": "63610a20-77b3-4f56-ad16-9b95b47238e8", "comment": "Malware payload (Quakbot)", "value": "a7c1c835f738e944bd88f2d5b9860b1b093c84798e73b85fef71b88c66ed6c87", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548602, "uuid": "53964052-dd95-42bb-b984-157a1d52dc9f", "comment": "Malware payload (Quakbot)", "value": "8aa7c6daddfb65f794092690baddd987ac4a8e54", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548602, "uuid": "98dd6daf-402e-45dd-91ce-2ecd60f1c845", "comment": "Malware payload (Quakbot)", "value": "c313f35b733b3be902db35a9940c178da7f7c4b63a44b093030476a3dc6b4b304e29218148eba89797196842af382f5b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548602, "uuid": "aac4958a-c32b-44e0-8391-c4b52bb259d0", "value": "T12C558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548602, "uuid": "7c1cd988-9e40-4cdf-aa37-42a0e674c326", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548602, "uuid": "efc2e253-252c-4753-8826-f0cc3688f2c8", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4yTQ:QbkS7XB1EsOSNPSp0EAt2bUeM4yTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687548602, "uuid": "f126b200-8e05-46cf-bb3e-39cfaa734b0a", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687548602, "uuid": "c8f68466-c902-49c7-8316-8ff154c6513f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548602, "uuid": "996f68c0-b5e0-4969-ad54-180cff4bf54d", "value": "05qbot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c841b240-11d9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1687533756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533756, "uuid": "13076889-d876-4d98-909a-09cafc6d0deb", "comment": "Malware payload (RecordBreaker)", "value": "055fe92d19f804a8ace1edf70a937829", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533756, "uuid": "8d2ba2a5-e9f7-4eea-bfad-a4c6d706378b", "comment": "Malware payload (RecordBreaker)", "value": "a7e5b32109ef08c9950f9885208a11c8a9b5963c7a3aa5e77926515382d60fbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533756, "uuid": "105eff95-194e-44d3-a1a3-ffd07bca96cf", "comment": "Malware payload (RecordBreaker)", "value": "d24f4a1ef6f892918159a28ffcab84d108b9873a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533756, "uuid": "ed385791-f2ac-41ae-9d9a-7dc3d5dccb46", "comment": "Malware payload (RecordBreaker)", "value": "e88fcadcca8851c457db9d03b317e1d62c2cf8b4ed0b5e7bf6ab260baadbb2bb4051a0b2f5e99265d77315b98e919af2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533756, "uuid": "7bb99f98-5311-474d-a83b-22ab743d9b8c", "value": "T1AE342B1352E07D65E9264B739E2EC7E8761DF6508F5937EA2218AF2F05B00B2C273B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533756, "uuid": "d1a2f598-8f16-4b49-bcd9-21f1856ab1ff", "value": "92acb9e2b931263dcc3907daa41f63e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533756, "uuid": "cd5713b1-c207-467e-80ab-d72b6cf6f25b", "value": "3072:mAPKN1jbrG8KrZlIJVg0g9fXOKCZmP8T4xoK8+IVTuKGCSpq2H702:jKN1rG8KrIJVBg9ferZm7OKUirNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687533756, "uuid": "b362ed75-fd62-4d6a-a50a-1eafd629de47", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687533756, "uuid": "fbc56bfd-1ae2-40bd-9cd5-710e675a505d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533756, "uuid": "ad5d8691-e74b-4950-8dd6-b39e9f4fc473", "value": "055fe92d19f804a8ace1edf70a937829.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0209aee-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499436, "uuid": "999a1790-9055-49f0-bbd9-aac5fbe7f1f3", "comment": "Malware payload (RedLineStealer)", "value": "2c7c9cab86fb99ab118c8214500b7f48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499436, "uuid": "d6f44f7f-e764-4ceb-9a49-19d2ac5f0977", "comment": "Malware payload (RedLineStealer)", "value": "a7e7a20744c618ea0c6c85864335c4b8851d126786a8ec85d8a6475e06284055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499436, "uuid": "a70a2ec4-456f-4401-957a-c853194a7948", "comment": "Malware payload (RedLineStealer)", "value": "4e58b506c0b7c80e01ab9846beebaf100114b74f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499436, "uuid": "f1a4cf4c-ac03-4388-9c30-9028c027e000", "comment": "Malware payload (RedLineStealer)", "value": "4c0c00bb342da02bbf630e1a6576d1cca25a86c7a6d1fb1cb8254ba94ff0562243580299682ade55b0942c0245856fec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499436, "uuid": "64c3e6a6-8692-4609-851f-540c03aaea89", "value": "T16CB4F1CA25400973CF63CAF2D4EFE9D64A7A70310BB10BC7120D9AF58E466D4A61B57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499436, "uuid": "c20f2a27-f41f-496a-a680-d36a3ca7dc7f", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499436, "uuid": "ef1efb5b-70e3-4fba-be67-9dbf39e13daa", "value": "12288:CID5RTey5sLCwh/TbSDHWzmL+vMuDcy3QJQmZ:CID/Tey5sL9h/TbSrUEhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499436, "uuid": "067be303-1ff7-43a2-bb03-5c4251e59b7e", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499436, "uuid": "63067c71-d9c5-4e3f-b2e6-363c25d3d400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499436, "uuid": "b6b03626-e7ed-4808-8984-785d4abf63f2", "value": "2c7c9cab86fb99ab118c8214500b7f48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6faad87b-11ec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687541767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541767, "uuid": "589e83f9-f54b-4e0e-a255-494c9f508dfd", "comment": "Malware payload (Quakbot)", "value": "7b98df5770f842081bf8412a9ea15bbc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541767, "uuid": "9050d5f6-fc11-4054-9e03-e40ea5662831", "comment": "Malware payload (Quakbot)", "value": "a824e74f267831a500194fe885b326ca3fcc7fc4c58dff8f3eae11a969f7cb77", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541767, "uuid": "31df4ded-25c2-47c3-9127-335a8f53c3d6", "comment": "Malware payload (Quakbot)", "value": "7c6280b245879c6000126e32c25b9134e8cc88d2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687541767, "uuid": "1461cccd-16cb-40ca-9c77-16e3a89921e0", "comment": "Malware payload (Quakbot)", "value": "22ef235ab3b8d5a480ff51f104d43f75c7ab5259a9dcc51ddef3e407b27c59b8f893c38be7b6e799941aea1a52023a85", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541767, "uuid": "0a405eee-d858-4535-846d-81ea6e656225", "value": "T1EF558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541767, "uuid": "5c09512d-9195-4991-b9e1-fa29013def25", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541767, "uuid": "d725fe17-da9c-4688-b33e-c32bbe63946a", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4yHQ:QbkS7XB1EsOSNPSp0EAt2bUeM4yHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687541767, "uuid": "93df8ad8-c099-4f5c-80d9-32a370203758", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687541767, "uuid": "6ca305c8-f929-4561-aae7-19c9aa5b566b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687541767, "uuid": "727b306a-822d-467f-849c-a7d161ca6a20", "value": "03qbot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29414ffb-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687499129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499129, "uuid": "56d0ea59-4735-4461-9ca3-26cf5e2403cb", "comment": "Malware payload (Amadey)", "value": "2b00921fc09c8df4b0ca979c419a9115", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499129, "uuid": "edb2a06d-190b-4d60-addf-d9d9dc526944", "comment": "Malware payload (Amadey)", "value": "a826cb939a0df37bd8caa6c4c0795b97af2af5e064b419b41072c585e0fcbf23", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499129, "uuid": "05158f7a-e1b2-4a18-bb15-fde36b4e5d1d", "comment": "Malware payload (Amadey)", "value": "602762625294cae731ca0c67fa7abf06d735c300", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499129, "uuid": "ae869af8-b8e8-48ee-911c-c7ae6f9348c3", "comment": "Malware payload (Amadey)", "value": "cf2c9986b74eaefb51f9f2349d455ef2086f363cb1f75a91476fb84a6603caeba65461c5858b563574ba8db740431f71", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499129, "uuid": "292d2dad-9ae5-403a-a591-79f1f89d846a", "value": "T130B4F1CA36404633CF33C9F1D4DFE9974EB570210B668787121E99F58E421E9BA0B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499129, "uuid": "a412af5b-6471-4254-a60d-9d775aaf84df", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499129, "uuid": "f49fa29b-a8e7-4971-ba29-b4e8c755d101", "value": "12288:zegbiTey5s3gbM37nwkDxbcG77uYNcU+hAt+1/eBzPTQJQmZ:zegGTey5s3g4379xcu6YNp+h11mY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499129, "uuid": "891f6055-4ebf-4464-8901-601cd1be405b", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499129, "uuid": "a4916572-cc32-4752-85d6-1d69d1445511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499129, "uuid": "2daf5216-81c3-4d1f-b184-c97c04335007", "value": "2b00921fc09c8df4b0ca979c419a9115.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2f3bc7-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687500474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500474, "uuid": "806dfae6-e2b4-4e5c-ab38-c1dcd1e38cc3", "comment": "Malware payload (AgentTesla)", "value": "bfefe5a8dad630ebf2934ba7b79ed548", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500474, "uuid": "7d7e32e5-cff6-4ed0-8d3b-bd8859fd5adf", "comment": "Malware payload (AgentTesla)", "value": "a8ddb09a16d9a6989c8bdd783722c939082bc42b871b3cbfe1cfd8532176fe0c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500474, "uuid": "8b67f3d5-fb85-45a7-9ae9-ae2d4a7c2a3d", "comment": "Malware payload (AgentTesla)", "value": "0791eeca822cd645cb7a56d511fe70f92863a120", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500474, "uuid": "1b6a686f-9a00-487f-8fa3-be85f40fd7c9", "comment": "Malware payload (AgentTesla)", "value": "e56cdbf82482236dcc6f0f16ac88209e321e4fb77c9e3c0a5515088a3514c40a1ceeb2612a4513b67c6d519dffa6ed6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500474, "uuid": "54aafd94-3a40-4596-a865-61724623ce75", "value": "T13555F1503669AF60E47A8BF60860527157FA6E5BB03EF7094EC3B2DB25B1F118921F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500474, "uuid": "ea64d372-9d66-48ae-9249-adef47d7b508", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500474, "uuid": "3a132154-1cf2-41f0-a668-2ae138a9d0f2", "value": "24576:Z7MyuyF1dR7wJ1KNoQhDH/lmXHX0E9jcrZoc+Ox5zz9n6bjV6CDRbAns5/bxAfM2:Z7MyuyTTMJ1KNoefo30ecrZocBv96bjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500474, "uuid": "88314600-61bb-4b95-abd5-7c5e4cbd2b94", "value": 1327616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500474, "uuid": "ebbd0c6c-4630-4f0f-a534-058b87034ff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500474, "uuid": "e5c08ac0-cdf1-4151-8167-01ed58886d78", "value": "SOA # 87594094.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee638ac1-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516640, "uuid": "98c93760-e815-474a-ac30-273c84c87447", "comment": "Malware payload (RedLineStealer)", "value": "cb1298e4d1dc15b54fe6f09e58a5d8d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516640, "uuid": "e604aa6c-dd02-4d85-af86-33bb6accd127", "comment": "Malware payload (RedLineStealer)", "value": "a8fa02e31226a7a51472bb6acefc41d77ff136e7605da424b6c039a14d93aed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516640, "uuid": "16c05efb-3def-4e0b-9548-47936f2d780a", "comment": "Malware payload (RedLineStealer)", "value": "935d89472954a82c41f199bbc038452140b41940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516640, "uuid": "dc749c0e-4ac5-48b6-bd45-808d12f86383", "comment": "Malware payload (RedLineStealer)", "value": "0832bd14178d414abdf77cd1a69541d75997ac7fc3c94be89d22ebc18ef3c7aaae95d60e226c0069cf42d4ca8ac8e85b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516640, "uuid": "39c8359e-f325-4a4c-b456-f575f50d1d9b", "value": "T135E401C621804573DF63DAF2E4DFA9C78F7A71210B714BC7620C89F58E022D4A65B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516640, "uuid": "287f577e-ec3f-4a48-8e69-af36db9c14f2", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516640, "uuid": "76a6df0c-5d61-45fa-9a72-e39601613b76", "value": "12288:Lk7T2Tey5s1d5KinnBGkbIM+nv4rU4WN9wC2p4782FUqmgfGaTE0zQJQmZ:Lk7STey5s1dOkbIFwNSV7PiqmgOEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516640, "uuid": "bda243b7-1079-4ae9-8376-253a8b05fb8e", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516640, "uuid": "c3931ab8-e01e-400b-adc2-279a7662935b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516640, "uuid": "3710209d-7cfb-4f64-8c1a-b80377bae1ae", "value": "cb1298e4d1dc15b54fe6f09e58a5d8d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f997bb5-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687501287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501287, "uuid": "1eeaa9fd-9bb5-4f5f-939c-49f58f9742a1", "comment": "Malware payload (Amadey)", "value": "e40b91f90602a8dcff635fc5f6c5ed66", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501287, "uuid": "11ba3448-4eb1-4399-b5e1-f5d2eb6dc93a", "comment": "Malware payload (Amadey)", "value": "a99f9ae010294ccc7ee3ff1104247c820664a73dfbc5d21b0d970fcfb6ef833e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501287, "uuid": "97cf7cc9-71a5-42bd-8d41-ee38fc077d4b", "comment": "Malware payload (Amadey)", "value": "7ca351cef9a3d014ed8f1f4f6d8bb0e4f6e4af54", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501287, "uuid": "6e57f878-0829-4fee-9fa4-06fc52903079", "comment": "Malware payload (Amadey)", "value": "d6b8b579a24303a3736d35e4f7f14d8eb1138b388054095a33d10a17c59fb789578d1fa04512098242fcb14d1896e130", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501287, "uuid": "626274ba-1e20-47f0-b038-590dce5d9baf", "value": "T199B4F1CA228045B3DB63CDF1C4EFEE860EB971210B764BC7120D89F98F456D8A51B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501287, "uuid": "94f39ba9-dc61-41de-9136-2cc7a526d25a", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501287, "uuid": "d32295da-7866-48bd-99d3-b2e1ac1998ea", "value": "12288:+eiv3Tey5sdBO5pDMFBn6qKpZwJdikaQJQmZ:+eifTey5sTO5pDkB6q2yJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501287, "uuid": "3f0dde6e-2c47-465a-a043-0eaa1c972630", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501287, "uuid": "9d4f896c-2ec4-4c2d-af91-3b75aad63888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501287, "uuid": "32c4bc19-e484-4856-bc13-4a554d16e7c1", "value": "e40b91f90602a8dcff635fc5f6c5ed66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92896c47-11bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687521210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521210, "uuid": "d820c03f-9ee3-4b1e-94ef-27f1cff6b02f", "comment": "Malware payload (AsyncRAT)", "value": "b60b2b2f140d933b8842dfb895fb3711", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521210, "uuid": "66cda386-3df4-4ee8-8c19-4bcb4fe5b8d2", "comment": "Malware payload (AsyncRAT)", "value": "aa21f73eb2458dadbd00eb96322c1e56d2255244273c733159358d87275ac0cf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521210, "uuid": "02da8425-c987-4efb-98df-0f5cda5b0074", "comment": "Malware payload (AsyncRAT)", "value": "19e3eb466ebae48b9c2899ef31b07a0a2f5f163b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521210, "uuid": "38afee91-2bf2-403a-b8a1-45337f7fac16", "comment": "Malware payload (AsyncRAT)", "value": "2411c7e45ee260e91600f82ed9b96d9f55167d25d5d5a0a92f0728f2f83ba72b198a5a0b5b55b28f80d5037d7659a55a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521210, "uuid": "1eb8082e-b3c9-4c98-b456-9ad976b4c706", "value": "T1BC04382437E81919E3FFDBB8F4B001259B72B8236913E76F28A459EE1D62344D550BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521210, "uuid": "a0c27ca1-343a-457d-985a-7c1a7d2df043", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521210, "uuid": "859e2b6c-4060-4147-8a86-c5754cee2248", "value": "3072:G+STW8djpN6izj8mZw+GSv5hqIPu/i9bcJ2c9kz6+WpD:b8XN6W8mm+vvnXPSi9b4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687521210, "uuid": "1e7f2bca-5cf5-4f0f-88b1-c6167e7e056a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687521210, "uuid": "b0673413-3b86-4495-8860-85cb4be525cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521210, "uuid": "f82798ca-3308-45fa-aca8-6d52db520fb8", "value": "b60b2b2f140d933b8842dfb895fb3711.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a581b7-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500994, "uuid": "ff08360f-da6b-47a8-aeba-1522cf799024", "comment": "Malware payload (Amadey)", "value": "cf33a0ac6f56d4d36e951d99fed9a752", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500994, "uuid": "0b89a4b9-1595-4f27-b4fc-7d1d76abfd67", "comment": "Malware payload (Amadey)", "value": "aa3eade5516080c9c9ba43f2c1b39652da007cb0300b7d618a3bd58b8e2460c7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500994, "uuid": "f96f6235-f2fb-4b85-86cb-5b3806af40a3", "comment": "Malware payload (Amadey)", "value": "b214b153ba993c974b1f1b38d0b65689a3c3015e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500994, "uuid": "2d0c1775-2964-419a-8809-70d009602c59", "comment": "Malware payload (Amadey)", "value": "c3715e9b15c550b4b3076de9e82515561e7b8ae950a99b1e9268d7b3d552084883a49572c3bcc33bbffd957a7a5a9f4d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500994, "uuid": "e4424546-ec64-40f6-abbb-f05d6b9248b8", "value": "T14CB4F1CA64404973DF77D8B2D8EEE9C78F7A71310B7147C7120C8AF68A426D4A60B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500994, "uuid": "042d0b7d-4e26-4355-9209-5fe5ad5f5e87", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500994, "uuid": "78758c2a-d054-41df-b583-160c17af1600", "value": "12288:5E9ms/Tey5svYsBK0pkoCmUMQpqBWw97wQJQmZ:5E9mqTey5svYsBK0pkoBUMtWw93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500994, "uuid": "23bc8d88-5d1a-406e-9e40-ddc13d6918de", "value": 540480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500994, "uuid": "7d179772-9aa0-4c35-af41-6219571a73cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500994, "uuid": "271334dd-6e34-4628-908f-4be10f67d767", "value": "cf33a0ac6f56d4d36e951d99fed9a752.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb81f56-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516313, "uuid": "a6aa8e42-03e2-421f-9f11-550d46b098a0", "comment": "Malware payload (RedLineStealer)", "value": "4741b12ebc790d560ed20212ad63ccc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516313, "uuid": "201cec87-1284-48d3-98bc-8d2ca6176028", "comment": "Malware payload (RedLineStealer)", "value": "adc935f22a1620e7b9b2086c1dc0cb0789e6d8c1babb4bbdaf94550a7feb7c72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516313, "uuid": "5fa135e0-e5bb-41b4-8762-0eafb4c06475", "comment": "Malware payload (RedLineStealer)", "value": "54c3d689e33219a0934d1c33a52bc137f3c2e5f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516313, "uuid": "2120d33c-7778-4cc0-bfa8-e32c14853f8f", "comment": "Malware payload (RedLineStealer)", "value": "2d2704ff040fdbbdc785982f1ad7402f4abd6a9419b6347385c4e01e517c9193448688ad7895ea629ccea8cea1c6cb1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516313, "uuid": "4c7cf0ac-62f4-40c7-9232-188e95a967d9", "value": "T1D3B4F1CA76404573CF23DEF2D4EBE8D74E7A702147B14BC7220C5AFA4A406D4A61B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516313, "uuid": "f12a7752-9fa5-4e3a-9312-e9e714d67273", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516313, "uuid": "c7c06014-f7dc-4ba4-a085-adbc0b6c0da9", "value": "12288:bodM1Tey5s+cpOKZt3U+Y+E3hr7hiPlh+Z3I0W+QJQmZ:bodQTey5s+wOKjY+u7hQIZ3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516313, "uuid": "873cd8f1-0452-4109-aff5-c739636196da", "value": 540992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516313, "uuid": "530cdfff-9e02-408b-b286-1b3b7e809f94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516313, "uuid": "b3ba693f-aed7-4486-ae8d-5deb1a6e7c4c", "value": "4741b12ebc790d560ed20212ad63ccc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99aa7e34-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499747, "uuid": "bacbacc6-6e50-4ca8-850a-b1edd5c1169c", "comment": "Malware payload (RedLineStealer)", "value": "2a1545fc92e0cc62fb92ea65fa789ec9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499747, "uuid": "a964a2af-bf99-4923-8bd8-04eb0f306eba", "comment": "Malware payload (RedLineStealer)", "value": "ae31aad9098ffdc3b25a88516a0c5dd0e8df29c09d43f18c8c56e46c8cd7da27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499747, "uuid": "b218640a-7ba2-41b4-aa6d-10dafbd83441", "comment": "Malware payload (RedLineStealer)", "value": "e6298a86523f10fecd9141025c048af5ac95fcbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499747, "uuid": "d1864224-f14f-461e-aca7-06739091a70e", "comment": "Malware payload (RedLineStealer)", "value": "f60b396c243bb99d795696079272009473ff79fe1fb6c90ab1b4886678d9ad51efd00b403b6eb3ed17142ef52c0f4627", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499747, "uuid": "3494d030-e040-40f5-a80c-eac1ce7a4c33", "value": "T1F5E402CB26404AB3CB63DAB2C4AFFCE64E7971214B6147C7130D8AF64A455E8E11B17B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499747, "uuid": "7c4bb159-c4b3-441e-abb2-34bb69658407", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499747, "uuid": "8e191df4-9fc3-498e-b0d8-dac333ae80a2", "value": "12288:XcegUvTey5s10SGUE0ofXI/sI1h76u6g8FGlowWkRJkGNGlrBZfQJQmZ:MegKTey5s105UE0Qgn76u6g85wJFNGXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499747, "uuid": "016b6742-9d80-48e5-ad20-98a65a7b63ac", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499747, "uuid": "a14b7864-a791-4d9d-81ad-3d8847e97927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499747, "uuid": "f9d3b464-c934-434d-a6e1-e1b29e61dd4a", "value": "2a1545fc92e0cc62fb92ea65fa789ec9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aadab05-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687499749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499749, "uuid": "3b6a695d-2af8-4586-870e-a1a9ece4c6df", "comment": "Malware payload (Amadey)", "value": "3af7c2fb10a01b6ad62d1b86efdfad17", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499749, "uuid": "16ada3a1-1bb7-4b07-835c-1904b752864d", "comment": "Malware payload (Amadey)", "value": "afc4b941592e41d89299e50030a8748b9c950f77cb9c4f08786b33aabc42a6b1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499749, "uuid": "f4971810-3d83-4638-ae77-c49f4bb73c3e", "comment": "Malware payload (Amadey)", "value": "d3c0cf68d53cff27f1567a26c8016826235ecdca", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499749, "uuid": "b78818f2-c1dc-4744-9805-852da2ec3be0", "comment": "Malware payload (Amadey)", "value": "e4abe9e885ef042a6287208c95c217771e180ca92580a19f6d2dbabe9e0b58fb3a370710b3c9094dc2383aee7b6d4995", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499749, "uuid": "0d05a9af-fae1-4db1-99bc-a55f49f2a2f6", "value": "T185B4F1CA25804973DF23C9F198EFF9D74E7970214BB14BCB124D8AF58E452D4A60B63A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499749, "uuid": "aa16d1c8-69bd-4b91-8576-9e202b87efe3", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499749, "uuid": "52d262d0-8285-4465-a953-9cbf433079ce", "value": "12288:P4mO17+cM9Tey5s8E4fVVD1G/WfeH2Glwb7k9+ORTUwecYGQJQmZ:P4mO17+cETey5sb4fHaWfeTlwbADVUFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499749, "uuid": "6b80572f-5f43-4d60-8fc9-8a765eec1b05", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499749, "uuid": "64e9e2c1-f7f2-4716-a13b-541900fd4e0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499749, "uuid": "0a1b1538-f1fa-461d-af87-2bdfa0bbc60d", "value": "3af7c2fb10a01b6ad62d1b86efdfad17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b41e484e-1207-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687553479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687553479, "uuid": "de52b3ca-4bfe-4c9c-9f1e-3e55816c7c22", "comment": "Malware payload (AgentTesla)", "value": "a7d094ee6c9c95c3f6dcdfc1c2f64f05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687553479, "uuid": "a30ee0c1-d179-482d-8b39-de11e1a81c5b", "comment": "Malware payload (AgentTesla)", "value": "b01cb5bcdee9a635e42e6bec14d6cd09cc24749ab76c8e23d8a52185d9267897", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687553479, "uuid": "c499f61f-c8fc-4f1a-8b69-aa9ee2526cb6", "comment": "Malware payload (AgentTesla)", "value": "2b7c4bf22a6719a5ff9f363a537ec9c6420c439c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687553479, "uuid": "03ce29ef-e34c-4332-8c8a-5f0594b5170e", "comment": "Malware payload (AgentTesla)", "value": "e5af909b8688b30440f067ba61716b54db6163cc0cbcf188d1d4c9c7ee610bcbb0d076efc8a77efa6c73190a70d3470f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687553479, "uuid": "44e4c5be-0317-4066-b122-a744cb173d91", "value": "T10554AC0362EA0DC8B2F26A476A7744B44BF77D65693DC94C50CC190E0BE7A1C8D66BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687553479, "uuid": "7c0883f3-054a-4f8c-9032-3c52928d0dd7", "value": "3072:6pi6x6J6cM5vHUQFooHUZaHEHjim6cDe1q4uZog0k9T8De7Lhzf4oaw0h6gGMdR/:6pi6x6J6cM5wn2rMxzakw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687553479, "uuid": "a73f7276-2ebb-42eb-ac90-8b33970fbe2b", "value": 295952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687553479, "uuid": "850bcd07-3440-488f-b321-a8ed8bf10fa9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687553479, "uuid": "a0a88ad9-a7df-4350-9fad-def13057d4d0", "value": "zarago.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0794403a-1191-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687502509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502509, "uuid": "512ba73c-340b-48ef-8f01-18da108219d1", "comment": "Malware payload (AgentTesla)", "value": "255d1a6deb5d37413681e1b90a296bb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502509, "uuid": "9c927093-d06a-48db-a1b8-a1b29154c845", "comment": "Malware payload (AgentTesla)", "value": "b02c34b39ad80df8c4c857d64f977da7cbf9812725d4ec3074d02668810c5a59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502509, "uuid": "cf88da10-f372-488b-9341-39b2c0bb4d40", "comment": "Malware payload (AgentTesla)", "value": "d87861382d13bf5725bb61edba7f78c8417f4c02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502509, "uuid": "7e5db34e-012d-49b1-8188-a4ddcc2e2013", "comment": "Malware payload (AgentTesla)", "value": "49a88c9e5a20060dca3ca01cce173d715a6548715af966a1e17015cb11d348a773f5d6dee1779967d2dd8c505f7249ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502509, "uuid": "4e850754-32b1-4a7a-889c-b49054e03c2f", "value": "T1BFF4332717B610D96DD9A9E212344F2DF33608F28BF79BC61871B2D20B9755860AB733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502509, "uuid": "5a7d65c4-2f9a-485c-89be-bda4dc5e071f", "value": "12288:IONkXJwdkWSb7YK1GMdQ+Ltq+MKv9yHXbqlZ1P02Xsu7K5z4jGMue/i7/OU2crT:IhJbHGMdQiXMY9YLqpdgmbT2/ycv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687502509, "uuid": "9f83749e-58e2-4356-b55c-1b8ddffd3124", "value": 790196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687502509, "uuid": "d2853e51-739d-483f-ac5e-51db1a73803f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502509, "uuid": "a603beb9-2b69-4e03-b01c-fbbd7a1e7bee", "value": "ETF Remittance Advice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caef6d83-11c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687524741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524741, "uuid": "bf688aef-1383-42d1-900d-fca9f52e3861", "comment": "Malware payload (Amadey)", "value": "f7fe87d0fecd6f2f0fb2b46f00298b4e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524741, "uuid": "eba37bab-c410-4a75-9d9a-b54ad55dd7e4", "comment": "Malware payload (Amadey)", "value": "b0d32c1295a45f36093db61ae8522a7debeb100ca61897d4c266d18f9c195e9e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524741, "uuid": "4b8af82e-791b-460e-90b2-d0225703a47d", "comment": "Malware payload (Amadey)", "value": "e5a3e7e2c25ad586e6db80e24602921a7e194c72", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687524741, "uuid": "5b293851-0044-4cdd-9188-96f8835bcea8", "comment": "Malware payload (Amadey)", "value": "34cf9ca0cf43e58f66de8282d8c95e08dbce345ebacf1be46629e46ff41f81ef8611807d8ec1b2dd98ca12b2b2b42e63", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524741, "uuid": "9ea5f0da-6c57-48d3-8025-071b05ad8b05", "value": "T1D6E402CB61804573CF67C9B0D49FE9DA4EBA612007B28BC7120D9AF98F414D4E61B67E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524741, "uuid": "ad612545-2fc5-4c5c-9338-688d49a82c12", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524741, "uuid": "0fac11f8-3a88-4da2-bed7-c220031e5f8f", "value": "12288:zA0uefUTey5svvjDVzf2RoP7p4XJ6wBwxjqEGpyFZjTcerF1jJQJQmZ:c0uXTey5sVDpG4/D9FZPcus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687524741, "uuid": "92a6ac70-3669-4ff7-9f30-6a2618ad8928", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687524741, "uuid": "8ee811e1-7b0a-4ac8-b275-5fa15669732d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687524741, "uuid": "2509167a-9d58-416c-bf7d-52c8b3f7a6fd", "value": "f7fe87d0fecd6f2f0fb2b46f00298b4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8977e7-115a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687479139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687479139, "uuid": "0bebe479-d0e6-4396-8d8e-9873ff7b3a47", "comment": "Malware payload (Quakbot)", "value": "199965002e642b40151d4e71e7f99472", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687479139, "uuid": "65650699-9f07-4c88-bb51-595b7ffd660a", "comment": "Malware payload (Quakbot)", "value": "b3dfb683f9518e45a2d0a7e2d3907e977eafb57156e261e0f9e4078f7154dbeb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687479139, "uuid": "48b17222-d864-45d3-a8c3-fc86c778d67d", "comment": "Malware payload (Quakbot)", "value": "88d360f136afcf278bb58aec131c80c59c1b81e1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687479139, "uuid": "b1254521-2d27-4f16-b495-fdef5473c87e", "comment": "Malware payload (Quakbot)", "value": "48a7171547430a1504091ceb9f97dc3a627db4ff33e728a59f72773a0db00b5adb0345d6cfe26e4075e2274e976e9835", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687479139, "uuid": "12c8564d-94f1-4787-863b-d3e96082a13c", "value": "T15474496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687479139, "uuid": "1933bf72-fbe8-4434-b1d4-09236390dc79", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593O:fIS1xba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687479139, "uuid": "4a6a0872-ba8d-47bc-9612-62f28f2e4bfa", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687479139, "uuid": "b4ea9840-a3b7-4e6f-a76f-e5ca25d8efed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687479139, "uuid": "b7b4e92e-4360-4184-b770-40360438e2eb", "value": "BSN-50158390.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5b4881-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500070, "uuid": "df352ab1-99cf-4b39-b332-971b26d467fc", "comment": "Malware payload (Amadey)", "value": "6dff066ee51a776b81f73b1fbd763163", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500070, "uuid": "aaeabd88-86a1-452f-9468-c954a0ae8225", "comment": "Malware payload (Amadey)", "value": "b55dc0b167ada7d42d18b08e183f772cb74b990179155f0f4a703fb465c3031e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500070, "uuid": "f8ef304e-1380-45c8-b6c2-f79dff1acc44", "comment": "Malware payload (Amadey)", "value": "8b545c8bcc4fe2e5fdb8209ce3dfb79fcc0662e1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500070, "uuid": "910d2838-7bd4-4c04-9690-ffc639effc2b", "comment": "Malware payload (Amadey)", "value": "56ef8ceb845610a521502428409bc348e8191c8b414fdb25f7cda0f1ded7d3a622c14fe4b80b6ebaed14ad4a3b887353", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500070, "uuid": "fa0f4df5-8f7a-4469-96a9-912b65f6908a", "value": "T1DFE402C665408973CFA7C8F2C8EFE9DB5EBA312107714787230D8AF58E155D4A60B93A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500070, "uuid": "d527f13a-3c12-4edf-93ca-92368f2bf535", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500070, "uuid": "b63f63a2-e9f1-4572-a4b8-058b6d1a2b81", "value": "12288:lepEVTey5s6FaBWCGw/jFEyuQTawxpYa2Dj+UY2Nd531YLQJQmZ:lepQTey5sa+NG2EyllORiUT1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500070, "uuid": "0e035a5a-41ba-461a-be65-c90a332dce7d", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500070, "uuid": "4b4d64c0-00cf-423f-b24f-bf28c86c6dc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500070, "uuid": "cea97ebe-5d5a-4808-b049-dd1e92abe139", "value": "6dff066ee51a776b81f73b1fbd763163.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3ff022-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687510330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510330, "uuid": "0bba1209-c554-4718-86e6-375ad5277bd5", "comment": "Malware payload (RedLineStealer)", "value": "785ff3452e08e20a80e738937231d103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510330, "uuid": "4e501ab4-dfdc-4a3c-bffa-701bfd8584a5", "comment": "Malware payload (RedLineStealer)", "value": "b57b0b0833cee1ffd43ed55b852e70b41cddd020216a8d2630cf91dfab62941a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510330, "uuid": "997bdd11-98a9-490d-98cf-aaefc51cf880", "comment": "Malware payload (RedLineStealer)", "value": "5c8a30002da04c54e71ac691f0451f28f9d5fbc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510330, "uuid": "10004a4a-6ed6-4f14-b333-691696815a8a", "comment": "Malware payload (RedLineStealer)", "value": "dbf988025d8ceb9e3c349962ad2a51dcd8afa19366ef613341694109dde8f27d31073eb3010e00d1640fd7c0df2088f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510330, "uuid": "a4ad706a-f44b-42d3-87cb-6748015e9473", "value": "T1D6B4F1CA25904433DF63CAF2D4EEADDB4F7971214B718687120D8AF64E402D4E61BA7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510330, "uuid": "47af19c1-659f-463c-abe1-dde4f49706f2", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510330, "uuid": "dceb5582-39ef-4a53-903e-a1ddacefc45e", "value": "12288:m2tS8YTey5sAQMt2RbkA3fXQAxSuhgPTbU3QJQmZ:vtSpTey5sAQS2jzxSCkbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510330, "uuid": "94388d9c-6efa-4f34-a34e-80f4b5f314f6", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510330, "uuid": "9b28dad8-e5e2-4b4c-ab75-1ab236226eef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510330, "uuid": "db256378-e762-4ab0-8e39-4e7b9c97ef3b", "value": "785ff3452e08e20a80e738937231d103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ae4ca3-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500360, "uuid": "ed88743a-6a3f-44e0-b028-6b993c3a7284", "comment": "Malware payload (RedLineStealer)", "value": "813be74967b360c4e2282157a7b7c2df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500360, "uuid": "0228d31d-d40b-4bb8-815e-72946ab53ba7", "comment": "Malware payload (RedLineStealer)", "value": "b5e30ec0be5e4dae89f0a40937f4b173e97c61163f440e479ff0fc738d5816f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500360, "uuid": "39fcc041-b8a9-4c3a-83b6-f14c84052752", "comment": "Malware payload (RedLineStealer)", "value": "4189c8666a0de46bd7ddd58d07832c9121b3b7b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500360, "uuid": "b63e8e1c-dd68-49e6-af28-de84a5f5a9b2", "comment": "Malware payload (RedLineStealer)", "value": "4b00097915d3f60915f32bad418d3f62b2ebccf6a47ec648bcf42f8d03093ac085b212a6326cd9aeea491a938dc97dc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500360, "uuid": "71a670a3-1993-45b7-b49e-15de43e01d8b", "value": "T19DB4F1CA26404933CF23CEF2D8EFECD28FB960214BA64B87520D99F14E551E4A51B57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500360, "uuid": "5ea77d60-af68-40ee-ac72-2d06ebd3d1b1", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500360, "uuid": "8ef631c6-d0bf-402a-866c-57888fc451ce", "value": "12288:29EgT3Tey5ssFLtNN2POXmBvTOuNgYQJQmZ:oEgDTey5ssFhNjX8vzNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500360, "uuid": "7c9aca3d-6806-44b2-a10c-e9c87d3e9110", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500360, "uuid": "1ff0a53e-c790-4cec-ac7d-2c459c1cfb9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500360, "uuid": "d9c93896-6a5e-4003-aae1-4c923692816b", "value": "813be74967b360c4e2282157a7b7c2df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d34b74e-11be-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687522033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522033, "uuid": "4c75f10a-8ae2-4cda-9036-c4aebcdd9a6f", "comment": "Malware payload (RedLineStealer)", "value": "70cb38bb3052fff1f2e5311fc5017403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522033, "uuid": "b422754f-ead1-4f6d-9393-ceedaddc5b35", "comment": "Malware payload (RedLineStealer)", "value": "b65a199936bd6fc4f7555bfda10ef57fabe51958a466505037c3abc7c3adba07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522033, "uuid": "35b297fd-21ba-423f-a376-f24484239568", "comment": "Malware payload (RedLineStealer)", "value": "74ff69ac00cbcbbb5e2055d53df903541642995a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522033, "uuid": "66388f53-584b-4919-b4f2-bc88b38de3ad", "comment": "Malware payload (RedLineStealer)", "value": "21bf6e50c6ce0146714befca3f19e1a6da9d3716b1a286c48bc24dc81e52d0f438e6138b4dfa50be894573eabef3b3c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522033, "uuid": "b4e64cab-6eea-47b4-8c6e-55fce78f251d", "value": "T1AB444BFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA284CA19BA0952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522033, "uuid": "021e6cd6-7735-4984-aeb3-5a3ca8422a71", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522033, "uuid": "3f07b470-9a61-4d2a-8822-3a04fd4cd1b5", "value": "6144:qg0Tzsigt0poiRG/XvLNUgYhuE22eQJQmL:Z0T3gtAoiRG/fSvWQJQmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687522033, "uuid": "73ad6312-2d00-4ec3-b304-a7b89e5425ed", "value": 276293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687522033, "uuid": "a0926aaa-7867-4945-b3b1-35d5a7b756cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522033, "uuid": "8da5d2a6-5b8b-4a1d-9343-d8bd33547355", "value": "70cb38bb3052fff1f2e5311fc5017403.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c61b7d-1188-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687498826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498826, "uuid": "c9c850e5-afe3-4ef2-b0c6-6f617649f883", "comment": "Malware payload (Amadey)", "value": "0f4f7ea98cece09c456f77b379476c11", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498826, "uuid": "2f3dac34-e867-4131-b9a9-397dee532098", "comment": "Malware payload (Amadey)", "value": "b6c9fe5a8f92a10c26929a56599d16708541cf41e9615eca75702787cfd9108d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498826, "uuid": "56c27e71-b20e-4c9f-b601-2dc83aa20758", "comment": "Malware payload (Amadey)", "value": "e8e242f96fae670028d89a1a0be559c3422d1fd4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498826, "uuid": "7a037c9e-4555-483e-ab27-3b7ebf097964", "comment": "Malware payload (Amadey)", "value": "6a0385714712f7062e1a015af45bf381a3bd9d5ee59d9f5923c6965d350a4591289d8faa75464f83b67ab0918d881f35", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498826, "uuid": "e039d4a6-f5f2-4924-9623-2e72a6db0be1", "value": "T108B4F1CA25404A73CF73C8F2D8AFE9DA9E7971210B714BC7121C59F98E445E4A20F97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498826, "uuid": "0f4b9865-2a0a-40de-9b22-b729bb40f774", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498826, "uuid": "d0dddbbb-be1a-40c5-a6b9-4c87fac82bed", "value": "6144:pktSK+vhXJuqwePpsyJfsY4WomiZ2D1nVJcSej+nq2fWPS2QfrnpVWnqCmG6QJQI:+tSJHTey5sfO3JJqh8qXv6QJQmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687498826, "uuid": "d14070e9-0121-4abe-ad3d-6438b4661cac", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687498826, "uuid": "676b190b-38dc-4637-a059-3a63eb80555c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498826, "uuid": "e677fec3-5567-4b9d-a830-940856f6cd57", "value": "0f4f7ea98cece09c456f77b379476c11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef2780d-11b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516936, "uuid": "d7a5a64e-7925-42e1-a8c7-787e068a50d8", "comment": "Malware payload (RedLineStealer)", "value": "dca0cdad3e5f1d089f43dea5f493ed5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516936, "uuid": "63e64a8d-8a7a-451f-8866-26254b6c18cd", "comment": "Malware payload (RedLineStealer)", "value": "b6eec03ed1264aeacc65db9429fdb0e83a250332b48df3e1037253e3763eaaec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516936, "uuid": "9e45fdce-2af5-45e9-8665-8cb1db411502", "comment": "Malware payload (RedLineStealer)", "value": "2a8052451dbbf6203897efce21b07873d5e0452e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516936, "uuid": "fc2d4d7d-2732-4ae0-b7a7-62abf465a02c", "comment": "Malware payload (RedLineStealer)", "value": "4e65fa2572e4ecef8d4bd116502b9d62ed312e133b39e4d98c0a132da5b9c968f2740a96a25279521c566f2890697048", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516936, "uuid": "3e5dab4e-3ce2-4db0-a86e-a7c1c0b9e6b0", "value": "T1E9B4F1CE62804573CF23DDB1D0EFE8D74E79B1210B668AC7120D46F98F461E4A61B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516936, "uuid": "13f7eed5-3284-445a-a8cf-cb14440a9534", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516936, "uuid": "c155a993-08ab-44e9-82ab-4889a20d8d23", "value": "12288:9gegiLTey5sePd7cjwOn2eVaQgn0KSJxT5ZQJQmZ:9gegYTey5su5ewOn2eun0KSJxTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516936, "uuid": "61bd0afa-a99b-4fe7-8c19-e842631dff42", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516936, "uuid": "4b64f579-671a-4403-88a5-abbd06b74790", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516936, "uuid": "1a4c86a0-5d9f-485c-b6d9-7d1ebb371e41", "value": "dca0cdad3e5f1d089f43dea5f493ed5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e0b07d-115d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1687480522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687480522, "uuid": "9a1b7a32-fb0d-4972-b33a-c3c978fe6506", "comment": "Malware payload (njrat)", "value": "acf17fe8280e495973cd957f1a328533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687480522, "uuid": "e9e5b424-733d-475b-abcc-ad8df05c3ec5", "comment": "Malware payload (njrat)", "value": "b7098740658fb66196efab988c175380603338fd1aa242b24c56264679a87f56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687480522, "uuid": "80d7ed82-a964-4d63-8fea-a9f7c0ea97e5", "comment": "Malware payload (njrat)", "value": "96dc413013ceb85b976f1c2e0d912fce02fe93a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687480522, "uuid": "6b5d0473-0b07-43e4-b139-6be95c90f050", "comment": "Malware payload (njrat)", "value": "98a568dc7bdfe60aff0cdad9c5eb492213e23020a73edc32b80e60049b8a71369f6507f550dba101a33924f1f829b2ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687480522, "uuid": "d8205bce-3ede-44d3-bd3f-10f075472db1", "value": "T1A3F2FA8DBFE24594C2FD5E734671D1220376F01B1A23D66E8EF884B65AA37848E4CED1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687480522, "uuid": "e9429f55-5e3d-4eb6-9cda-d67a82b50cbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687480522, "uuid": "5097eaf7-ab32-41f9-a390-3ae22e6fb649", "value": "768:mtSOw5d6HkazXMgcNU+F2f8jEEhq5lxOBcmZPtv0jC:mtSOw5UHXMgcNUnfb5lxOWm3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687480522, "uuid": "c6235a97-429f-48b5-bd13-011344deb8dc", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687480522, "uuid": "805b9e28-4578-4a93-af62-3a913096f77c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687480522, "uuid": "ab2c9c86-0643-4426-adee-ae30fc7b3130", "value": "acf17fe8280e495973cd957f1a328533.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333ada34-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1687499146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499146, "uuid": "a8305fdf-789c-425d-9ec2-5accff737a23", "comment": "Malware payload (RecordBreaker)", "value": "bd016c8a81dbbbb6f8b5d41e6003b12d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499146, "uuid": "34a71480-4df0-4883-b86a-afa430e9335c", "comment": "Malware payload (RecordBreaker)", "value": "b777ca54d5d8a17240013432313cdd8068ae03e04e97dbd8dc1f4268964a6526", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499146, "uuid": "eb1fc950-9575-4f11-9a43-9b5257d93ca8", "comment": "Malware payload (RecordBreaker)", "value": "913686c51a5e22436ab21400f8e866fd5df01f56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499146, "uuid": "f04585db-040f-4ae4-b74c-c5051f6ffeff", "comment": "Malware payload (RecordBreaker)", "value": "9a54bdab4eb4dd743736d78b88ba932d382a7625ea6a438360430b20c19b7af236144056482204e04d306687dd99cf12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499146, "uuid": "0304d086-18b9-4fc7-b3c8-fb62c45f49a1", "value": "T1CB442B03B3A27C94E917CB729E1EC6EC761EF5508F597B6E22189A2F04B10B2D173761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499146, "uuid": "d09aa420-1e2c-4967-93ce-54dc0b24bf09", "value": "b007a513e8535ccdc15870a09f4ce9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499146, "uuid": "57ef71ef-745d-4ae3-a507-80c960165033", "value": "6144:ZUhgWSR44PGyleq0SBHeZvBcjC9mUWpu:GCEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499146, "uuid": "94b95f2c-aa3c-412e-8c70-83b93377a0ff", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499146, "uuid": "e295141f-a16d-409a-9820-8381ae4cf547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499146, "uuid": "6a44eae5-92e1-4ec4-b279-081fe63f28ad", "value": "bd016c8a81dbbbb6f8b5d41e6003b12d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516b1af8-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500055, "uuid": "4bf609b4-ba97-4cc2-8b05-3829d18ebba6", "comment": "Malware payload (RedLineStealer)", "value": "54ede268e28d4ee45f69e6f5d50ed5b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500055, "uuid": "ace060a0-47bb-4b58-83df-3de61fb60ef6", "comment": "Malware payload (RedLineStealer)", "value": "b84aa72ce603000fcfce58ed24c57af50cbb38193b6632b45647042c7aa1438e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500055, "uuid": "76ed9fad-9b7e-4087-b5e0-37365a9b02e9", "comment": "Malware payload (RedLineStealer)", "value": "bb660f858bd5dd3b5c4c973c086a7f8532035a35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500055, "uuid": "90cf400f-6021-4211-98e5-db03cbc0fbbe", "comment": "Malware payload (RedLineStealer)", "value": "4fbecc74a5b572e5cde376841bf87bfe07d48b133c6a5f139f8d72db048ba1a8f6af6eb449ca8442529cbdf9a2a49fc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500055, "uuid": "058157a3-3826-43ae-8953-3f117805c6e6", "value": "T157B4F1EA21404933CF73CAB1D4FFE9D64EBA60210B254BC7230D4AF98B551D8A61B57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500055, "uuid": "39a348b2-1cd6-424c-a6da-9e936d3bf6ef", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500055, "uuid": "539c837b-e0be-40d1-b221-5b88b78e73e2", "value": "12288:+eY9FTey5sCcm9QjehEYFwq31d5wp8c3pYK5QJQmZ:+eYPTey5sAhTFwq3f5TCKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500055, "uuid": "0b694dcd-6e09-45b7-a566-f23850acab07", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500055, "uuid": "b6ce01d2-fd95-42df-8c42-b091ff404db8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500055, "uuid": "f4db72a5-8ca9-4b4b-ba6c-a03609fa6af0", "value": "54ede268e28d4ee45f69e6f5d50ed5b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bea7339-11a0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687509200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687509200, "uuid": "df924085-385b-4514-8f51-b9eb89edcbf2", "comment": "Malware payload (GuLoader)", "value": "82a8b40c46dc0e2012b833d78df5fa53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687509200, "uuid": "a60c50dd-9e2e-42a3-a21a-6777c0143ac9", "comment": "Malware payload (GuLoader)", "value": "b85a7134387a04a5c317e7f0372a292dc9fc302531933daae9df4db121fee3f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687509200, "uuid": "5edb7083-5cc2-45b6-8d53-2cb1872222ed", "comment": "Malware payload (GuLoader)", "value": "b45b2b61efcbf1d4df9b8c744841ee92febf98ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687509200, "uuid": "55f8fcfa-e59f-4d37-8654-f1a4e0adf592", "comment": "Malware payload (GuLoader)", "value": "15315498ace8671c8b33e9d6bcff52c911a42e3aef16a050d71250134b20c8daf2e2e6983a3f01bb5f09fd95ede93c68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687509200, "uuid": "acb900b9-4c41-4fd2-ad5e-2fa24fcf816a", "value": "T11C84011D75C0D8A6EC22C2720A6BEF718F657D65D124994BF3D47BBB3CB11B2B90810A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687509200, "uuid": "98cd8fc2-69c1-487e-940f-8321d03d4701", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687509200, "uuid": "26386960-3076-416e-ab8c-09e1d815ebd2", "value": "6144:+DhoMMSoHnz2BSQminWay1TY/Alp0eaP70NXqEKWi2:DMMSoHz2BSQ1w4Jt7Eqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687509200, "uuid": "349fc31c-49c7-4520-ab1e-180c04f43aea", "value": 386033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687509200, "uuid": "aa149bf2-6e00-4f2a-87c2-98d7a0bd760b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687509200, "uuid": "a8d2ff8f-e487-443e-9a4d-6019669baadc", "value": "Glemsom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78568aa-11d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687530748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530748, "uuid": "c5e8265a-2d70-4b22-af01-00094788ffa8", "comment": "Malware payload (RedLineStealer)", "value": "59ea052c7c295806d23a291008313aee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530748, "uuid": "d4c91ac0-3a51-4073-9594-29e20215b5a5", "comment": "Malware payload (RedLineStealer)", "value": "b87fa196d4c5cda207dd80f2548412730a99158e5c6019130d23cbb1e6d0cb2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530748, "uuid": "c36a873f-4c25-4dc9-8df6-2c74f945f86b", "comment": "Malware payload (RedLineStealer)", "value": "1771ddb744084ee0ee9c4e2a1e29acfb9f2f44b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530748, "uuid": "704129b3-4e5a-4feb-b1d0-5f2fe14da3af", "comment": "Malware payload (RedLineStealer)", "value": "9a29c4c2365fed3f472b5a49a30233b1908ed822a3f30042bc333077b83be359040c90f3123da12d05afedb6253ad3f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530748, "uuid": "e113fbc2-58d7-4db1-b788-ac2ab69354fc", "value": "T1911612356200D57BD3D32930E883910F4C2A29B1AACFB545B39BCDEA15639BCC5B8BD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530748, "uuid": "089b088f-b85b-4a12-9c2c-3dc1a93c15ff", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530748, "uuid": "29a76648-1338-4808-927a-97bc389ab748", "value": "98304:KGtKBWsmtcloYTR4oO4db5yQKNHbrRSxNe3QVhbsfNwjViRLEXRW+6zZC1elImHs:7KBGcp4oO4db5jtE3QVVsfNcsRLEXRoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687530748, "uuid": "ddcf5dac-e746-4420-957d-769b16243d5c", "value": 4143104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687530748, "uuid": "742e0d39-06e8-4e37-9631-6906ff2ee756", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530748, "uuid": "fbb82544-1d53-458f-8cea-0c10321a2d3e", "value": "59ea052c7c295806d23a291008313aee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9cff3c-11b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687516932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516932, "uuid": "300bd820-b335-468b-819b-b5227812afb8", "comment": "Malware payload (Amadey)", "value": "b2ee2e0dea99a96741b542159484ce0f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516932, "uuid": "8c5a7b2f-619b-4c0a-8228-ee00a0447b0e", "comment": "Malware payload (Amadey)", "value": "b937e2e8e208ed909f78918664cc13e988d18ee3ac9167059e437e3f80d5fa58", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516932, "uuid": "3e098151-0d5a-4bd2-83d4-0b109148f9fb", "comment": "Malware payload (Amadey)", "value": "2c5576f16a87c232800a3ee5a1172bd6c29ddf33", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516932, "uuid": "44f4c099-f131-4cc8-b17f-45fbcf5925d5", "comment": "Malware payload (Amadey)", "value": "bd50d53f3ee3617edb5aafe7a06ca86738e3e66b2e3a3aa0ed39267b9219b2c3b80a3b42261f009be4eabb111ab5ea3d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516932, "uuid": "e2010b62-c5d9-4f45-8213-036ad3916af9", "value": "T1E3B4F1CA22004573DF63CEF1D4EFED920EBA71214B7247C7120D99F58E522E5AA1B53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516932, "uuid": "76276fb4-9a6a-46c1-91b8-81bce915f05a", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516932, "uuid": "da4b458f-4c69-4698-b327-6ec4733b0788", "value": "12288:rghIdTey5s5aJnPe77S9XnfKcnVodBJYg8cGQJQmZ:rghsTey5suM7Ynq3tH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516932, "uuid": "936dde9d-72b0-477a-a161-349e314fa07a", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516932, "uuid": "e6688893-969a-4d73-8e6f-fb6085752e30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516932, "uuid": "28f72e57-e093-4ff4-91a2-6ca45f7e046c", "value": "b2ee2e0dea99a96741b542159484ce0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504c6a23-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500054, "uuid": "4e8fafa2-5eba-4765-8487-f265fc047a21", "comment": "Malware payload (RedLineStealer)", "value": "63722ad253746723f88e8bdd89ed45a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500054, "uuid": "c0081f23-519f-4cbb-822d-7c5093ab32c9", "comment": "Malware payload (RedLineStealer)", "value": "b9986e65a5c5d136d4873a6c31c2e235ec8c36cd0507539d542cdff4983c5165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500054, "uuid": "fa5695c2-88a0-47c0-944d-e41933e8e26a", "comment": "Malware payload (RedLineStealer)", "value": "a655d56cd849326e9b0df29515b4f949fff5e8af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500054, "uuid": "b2b7211d-90fc-42bf-9363-13cb491f3c3f", "comment": "Malware payload (RedLineStealer)", "value": "1cb02935136d4d15a74b12d584f3106e15b32d5461eedcd7fe862eaf542f268036de09d6b0005cdc8b735a0da945592f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500054, "uuid": "8eead5be-2c96-4fd4-81f1-ef8ebe2a610c", "value": "T18FB401CA25404573CF63DAB2D8EFED974E7A602107B58BC7220D49F58F441E8A61B63E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500054, "uuid": "144f5126-ba63-447e-9e79-f340778d19fc", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500054, "uuid": "75ddec07-1328-47f3-babd-53c7aa06f671", "value": "12288:aEAZvdTey5sZwt6soZDtMho0cqOCyu5MDeUMmws6QJQmZ:aEADTey5sNxuAnuGCUMv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500054, "uuid": "e3c43b50-2e02-4388-ad30-e6292101d40a", "value": 540992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500054, "uuid": "279b4dd5-4771-473a-9088-010c8ddc434e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500054, "uuid": "7db61647-afbb-43a8-b5a4-b11e9e2b2f8d", "value": "63722ad253746723f88e8bdd89ed45a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc193d5-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500048, "uuid": "1d1920e6-99d6-4058-b6d8-6bd5ca43b2a3", "comment": "Malware payload (RedLineStealer)", "value": "5d47b7a90bc251a5d67a92fb058ef62d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500048, "uuid": "ca4dd40a-f1a9-4d96-9a6e-34b127351350", "comment": "Malware payload (RedLineStealer)", "value": "b9d4b1c1f360bff838047c58e0e4fcbf65b7d81f65e446932d6266c5cadb2b24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500048, "uuid": "15b3b516-abc9-447b-a627-c61f5c9a916e", "comment": "Malware payload (RedLineStealer)", "value": "3ea2a0d22a3fbec6cc05c6e98a38c0bed5824aa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500048, "uuid": "682c0fbd-ceda-46be-bca6-c9f02885c565", "comment": "Malware payload (RedLineStealer)", "value": "e2dbc3065b4e798f1c56de6e0b1dbba8201b500a80e3a755f558d7ab79a344749d2927563a1ba67355587c66c2cb01e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500048, "uuid": "e62b4701-e396-4e71-a063-1f8a8cbe7ab0", "value": "T133E402CA26404933CF77CDF2D4EBE9C68A7970210B728783030D55F68E566E4E61B93A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500048, "uuid": "cb807161-9000-4b58-8b0d-805fd83bd827", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500048, "uuid": "d59bf91c-c7c8-4451-9f98-9d817daf3253", "value": "12288:jEFVOTey5sw/qK2hSbRlpSp3cdTMHwMMmLMwAD50LbDCJMEeL58nKQJQmZ:jEFYTey5swSRsbTposTJDCfTv5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500048, "uuid": "771112d7-19fe-45af-97b9-236f4f7860cb", "value": 714048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500048, "uuid": "5d3187b1-f0c4-43d2-a08d-eb347b7f6fa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500048, "uuid": "9b6b9783-e91a-40eb-aa91-78464d6e0c0c", "value": "5d47b7a90bc251a5d67a92fb058ef62d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aeb59b3-118f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687501897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501897, "uuid": "68769686-3597-4df8-baf3-6c04b08ebf03", "comment": "Malware payload (Mirai)", "value": "33701e03dd91c9da91b51718a30e2d21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501897, "uuid": "a7842af9-355f-4c86-a3ef-44ac548b90e1", "comment": "Malware payload (Mirai)", "value": "b9e0bff3060e9d8bfe0447be204dda304bce6a796daffa77b62e41d9c8a0e1c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501897, "uuid": "4133859c-e8f9-4778-9e03-0fd7f7a4d721", "comment": "Malware payload (Mirai)", "value": "3994c56ec97569abe52789758c8096d2dd75959d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501897, "uuid": "6e7ab876-3de4-4b11-aea6-531e9503e851", "comment": "Malware payload (Mirai)", "value": "d417a2e32253fd00059380d5f45ef0c4bef73c982ce7fc406dc391401295c41a9d746b5018cc55707a4f0e43a11eaf6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501897, "uuid": "8c20c4b9-4e4d-4201-80e2-1b998424655e", "value": "T1AC538D75D12DEEA8C0424AB4A9598E704F13A0C046733EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501897, "uuid": "047420c2-aea1-4a7d-8369-6c59900fd300", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501897, "uuid": "5a64bed0-c658-4a95-8356-81c1d22a6127", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501897, "uuid": "1c44aca0-dc81-4ac4-a12e-af19b53108bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501897, "uuid": "42c83cd4-2e82-412a-9ca4-59c5e60a24ec", "value": "33701e03dd91c9da91b51718a30e2d21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aaca0e2-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516311, "uuid": "e792c8db-a0d8-43e1-9664-826765dcb573", "comment": "Malware payload (RedLineStealer)", "value": "18dfa14cd52e85aa11424ab8e704b1c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516311, "uuid": "e25524ff-d312-41ff-86c5-218fbb89d9af", "comment": "Malware payload (RedLineStealer)", "value": "badcc7d0cd88c2551db6062b283081590f7d72c77b794d4ff2487cc505a60ca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516311, "uuid": "a7f1e063-de93-4e6e-aa83-275c72e10623", "comment": "Malware payload (RedLineStealer)", "value": "69e0b2ec0c88d455910bde56e9ad2e0c4a661f2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516311, "uuid": "89dc965f-9e2a-465e-ad8b-d4846ef1a582", "comment": "Malware payload (RedLineStealer)", "value": "62cfac9d6b2e941f2f3e5acfd9b0fbc4360a7ad5fb289e1d4a6aa3faecc621877da58046902df23f969eb3d8fd0e3814", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516311, "uuid": "6650ee22-89f2-4f70-bb12-5503b18f429c", "value": "T10DB4F1CA21004873DF63CAF2C8EFA9D64E79712207764BC7230D56F68F052D5A61B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516311, "uuid": "9517fb92-91c8-4874-a3ef-f454633e9394", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516311, "uuid": "7bb35b3d-4089-49f9-8ea1-b98dc46dff7f", "value": "12288:dqeJudTey5sIlOEQ/sBrjJSMs7J4iF7pjll3FvgQJQmZ:dqeJaTey5sEXJgMaj7pJl1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516311, "uuid": "bb881e3a-9287-4ee7-a49f-e946923dedab", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516311, "uuid": "0a9f9a09-e5a9-4b85-b388-12e3f2df4cb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516311, "uuid": "e240f38d-ae36-4eaf-8ac8-943bc603d95a", "value": "18dfa14cd52e85aa11424ab8e704b1c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff141a56-1159-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687478872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478872, "uuid": "db97be98-4071-4f87-8905-ce745aedd7d0", "comment": "Malware payload (Quakbot)", "value": "f1a2f0018868c0a0bb1d30b9753fceaa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478872, "uuid": "7999a4e3-431f-42cc-9588-376086b3a523", "comment": "Malware payload (Quakbot)", "value": "bb9191b950766c6f0423bd15212ff42dd58d7cac0daab2e1f248c7cd58726b7a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478872, "uuid": "b282f980-ba61-42e8-8c11-ce32a8d7d666", "comment": "Malware payload (Quakbot)", "value": "fb733b0a018153874e6c083b8957770ea54eaf71", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478872, "uuid": "800eba2f-bec4-4449-a0a1-8c418f7e58c7", "comment": "Malware payload (Quakbot)", "value": "7d96544994ebdf97632bde1eb68f04283fae319748ae83ef0dbbd77dffa5a170b78364bdcfcc378de76475af196a8cb8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478872, "uuid": "73173dc2-889b-4feb-95e9-7557658c94eb", "value": "T17C558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478872, "uuid": "c654fe38-4820-44cd-abb8-64a166dc3ae9", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478872, "uuid": "53d9cdb7-236c-40ad-b12b-1765e5b7e18f", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4y1Q:QbkS7XB1EsOSNPSp0EAt2bUeM4y1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687478872, "uuid": "c966ff88-2982-4e94-b4ac-b90fbdd562b6", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687478872, "uuid": "1ebc04a5-cd50-49d8-931b-3415e739e9f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478872, "uuid": "d289825b-feed-4069-a329-b2c3e8ba7bea", "value": "03qbot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f179bc7e-11fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1687547998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687547998, "uuid": "8c118334-56fb-4a51-8ac6-8970649646a3", "comment": "Malware payload (Fabookie)", "value": "b8ac0b50599377d7f2630c657a55c61f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687547998, "uuid": "2121a619-61cd-4a4b-84d2-546e16848008", "comment": "Malware payload (Fabookie)", "value": "bcaff58e4efc3c80c7a401686a5e9acbd13d265ace38bef195e7ee6380ffbf23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687547998, "uuid": "4cbb988a-d544-4a2c-aece-1cea3ec2ac4c", "comment": "Malware payload (Fabookie)", "value": "4932d8ea0273d40cb6f0b0e15c685f914be01eb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687547998, "uuid": "8b455573-7adc-4468-acc9-e15c2aeb742b", "comment": "Malware payload (Fabookie)", "value": "802dd5fb2ca031e3d6556721e6d424fa586ed98c69cadab1a3af2ca3636cafe9b0a2653ed1f36a4cd2bbeaa2e6878e3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687547998, "uuid": "1b245c98-0e22-4445-a465-2ad6802020fb", "value": "T1B484492DBBA84476E163C57FD9B2D665D77238916F208BCB0212863F0D376D89938732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687547998, "uuid": "21d27d64-15db-4c32-b2af-6f98f572c7f7", "value": "99782e0cdc1c7b57cdc2cde5daff70c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687547998, "uuid": "e2ad24de-46d1-4cc3-aca5-8a0a3631b48f", "value": "6144:iquy9wUep3cisGiKzt8bFaggXWe0CvZEOHHrpm1XUZLxEZEOHHrpm1XUZLx:iR+wUep/v0ChtLpm1EwtLpm1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687547998, "uuid": "393e7917-1493-4f40-b34e-8679d71c8538", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687547998, "uuid": "ab6f7cd8-b0cc-4839-bff1-72ffda7ea513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687547998, "uuid": "8d591f7b-8639-48b6-9a57-002bbba23298", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfdfb99a-11b9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687520051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520051, "uuid": "39eeff37-7625-4547-8f51-033cae590cc3", "comment": "Malware payload (Formbook)", "value": "b1294663ccfccff93456aca039271d87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520051, "uuid": "c54dbc86-82c2-4bd8-8652-3bdfb91d869e", "comment": "Malware payload (Formbook)", "value": "bda1a08d1c632950d8a4980f501b78336a1f0602919365d40c62b3d2877041b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520051, "uuid": "cb25ab2d-a809-4c55-a8db-4ec0a4512cd0", "comment": "Malware payload (Formbook)", "value": "eec834db60bd75d4852c48ce53391ad29a5602ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520051, "uuid": "031adfbe-02b7-4ebc-99dc-2a42bb3fc6f7", "comment": "Malware payload (Formbook)", "value": "9b0f2bb7f10d4b419fcb4c175bdfc7b89e3dec50ece9f943eade34c2238f9fe0fb46857f4782a8cfa261107041c82eb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520051, "uuid": "af260161-ce83-4cba-b41c-9cc042956414", "value": "T1CBD4225D601C0E21E1250FF728A2A02487386659346FEE896FDF25C78EA37147D63BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520051, "uuid": "dd74a48a-9b9a-4323-a8d1-52170c9f1fdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520051, "uuid": "935214d3-fd7a-4890-8e78-33968e425916", "value": "12288:o8k54/mNUAiq0vTLhrXbG5G676kX0C3V+9EF7pfWO1nTgDIxhkCW:xk54/QUPNxTK5G0X0jgpzTICW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520051, "uuid": "d9e5053d-df54-4ca5-a104-e22ce08cb029", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520051, "uuid": "0bd07cb9-3dd0-448f-bdfa-f40d97d381ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520051, "uuid": "ce0fe5e4-a2d6-4635-a845-c0a77c833f88", "value": "SecuriteInfo.com.Win32.MalwareX-gen.26806.16126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060e8941-11fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687548892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548892, "uuid": "bea43429-8bc5-4091-9253-b333f1b12346", "comment": "Malware payload (Quakbot)", "value": "a20208f7ca6438cd7e93731ed89a6e05", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548892, "uuid": "7bdaa7ce-6d54-4c10-bbcb-104579eaafeb", "comment": "Malware payload (Quakbot)", "value": "be26c5d7a70cc3ea46138c2ef3b589a381d61a9aaabd50ad9b8095d80f8260d9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548892, "uuid": "c8175548-f578-4a9a-ae2c-3657a846ee66", "comment": "Malware payload (Quakbot)", "value": "6d6a5306fa167df4564c884eb63ac32a22bb1ff2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548892, "uuid": "ab4d366d-e15d-48ef-a3a8-97d6a0dd5272", "comment": "Malware payload (Quakbot)", "value": "e9fb5d687d363ea8e23d5ca1d661c70f7fa394bec31fe953f9a1eeb9df95da5869d641c4bb5639d105c2c3dc5b2f2aad", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548892, "uuid": "432e8195-61f9-4e34-b4c1-b65c063a6786", "value": "T1A174496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548892, "uuid": "96391162-89dd-4faf-ad3a-0102c61b4e80", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593C:fIS1xbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687548892, "uuid": "5b01db90-2b55-4e0a-ba3d-75d9767a6c4e", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687548892, "uuid": "7ae0328f-f15c-409d-afd0-d80208ed0f5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548892, "uuid": "623b5ca7-2828-49ca-9b09-707aa254eb32", "value": "BSN-178358175.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651d97c9-11b5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687518127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518127, "uuid": "7cca4bc1-c4d8-4888-b289-79343f52ec43", "comment": "Malware payload (Amadey)", "value": "4079424237394514383c4abd2679536b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518127, "uuid": "f450a647-df9c-4632-bada-f75e2f361add", "comment": "Malware payload (Amadey)", "value": "be3922372f018b21fa27cd375798b616f1de59cb413ea7efd4cac451830176e3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518127, "uuid": "b5ba06a8-860b-4f99-ac98-303fa2c2169e", "comment": "Malware payload (Amadey)", "value": "c2c564a6b4bca10de5b27f4e59a30a5811ac7b4f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518127, "uuid": "10d7a201-9a28-4519-9430-7087e9bcb7f2", "comment": "Malware payload (Amadey)", "value": "b9fbf50da7a5415f3c15ccb1e1bbf43c28abbbf3d085e3d6614ee0b4526e9cdd28c83412d295a5f92351b2b7ef1075eb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687518127, "uuid": "5dea110d-3f7d-4092-be52-30c219585230", "value": "T184E402CA26404533CF37D5F1D4ABE9E28F79B1210BB54BC7020D99F68E156D0E22B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687518127, "uuid": "abc04f60-7158-4a11-a5d1-e1e326004c54", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687518127, "uuid": "71bd0c2a-7bdd-4cce-aa38-d11ff434b24e", "value": "12288:HUdQWTey5sRSY2FA8S33wgpWgZQkgwRX02kqQf0kMykc3B+fRFQJQmZ:HUdvTey5sRSrFIxp1ZZQ/MM3BKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687518127, "uuid": "faf0a2c5-4878-42bd-a707-b54b91d6c0db", "value": 715072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687518127, "uuid": "2f342c78-c5f7-47ed-93c1-ba2026e51dc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687518127, "uuid": "be695dbd-9c99-454a-bc7d-bbf666e198c7", "value": "4079424237394514383c4abd2679536b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7a27e1-11ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687520312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520312, "uuid": "39f9ced6-60c1-425a-af0c-21ed74b58e72", "comment": "Malware payload (AgentTesla)", "value": "e80148980b15aa596a0b67df5876cfc2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520312, "uuid": "156d19d3-cd80-41b7-8911-ab3a4de4bca0", "comment": "Malware payload (AgentTesla)", "value": "be91f662c6129ebed98724e3bcc3b1756f34ae703ecd0c2d1b7b24680a911b02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520312, "uuid": "f6e5423b-aa3a-4dd9-8a2b-1d3cb5c50081", "comment": "Malware payload (AgentTesla)", "value": "f0bf584dc0a48ac3fb086b6c5cfbf6fbfdb068b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520312, "uuid": "c62c1896-d7a4-4f90-9c93-58ecc3721c8c", "comment": "Malware payload (AgentTesla)", "value": "f52b6ac7aa3824f57f6933d8837371cb9913d7741da6d214849cf2cc727e47a00ca9af5bfec722d8b77f1c155424ac74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520312, "uuid": "6d3ffa1d-59f7-4c4f-9859-a679a63dfb9e", "value": "T105D4022612B00A1AF43B6FB9B9B4805493B6FA415B12F73D9FF510E20AA2F155F03B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520312, "uuid": "5cdd1955-5f96-419d-ac6f-a257562fb253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520312, "uuid": "61592a83-d068-428d-acd6-63458094cfa2", "value": "12288:a2iNG4/mNUAj9OVcLQ09I568ahS10CXl6H8zHQRLqIpf1yYbUWJZF:a1M4/QUwsVc1DhW0ChHQRuIpf1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520312, "uuid": "6f2ca54a-af7c-40d3-ab21-bf79404d95a0", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520312, "uuid": "8dc47fd0-337a-4fd3-a1f1-375b900f2f0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520312, "uuid": "f9b47377-69ed-4e71-b8b4-aa5223daaa65", "value": "S\ufffdTA? GRUBU TEKN?K MALZEME SATINALMA UZMANI'DAN SATIN ALMA S?PAR???_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6bc77ef-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687516627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516627, "uuid": "d29dd07b-7328-4f85-879b-d232c3d96d26", "comment": "Malware payload (Amadey)", "value": "93f01fef81d80361666bd621cf4d43dd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516627, "uuid": "2931e4cc-7ac7-460f-9142-136d6269d9a4", "comment": "Malware payload (Amadey)", "value": "beeeaefe17f4c4b88e602d2a7360f76f4b36cc99bdf8a7075b001b7275eb93de", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516627, "uuid": "4af396b4-6669-483f-afc5-9cdf04f5770d", "comment": "Malware payload (Amadey)", "value": "189595738c9cb2bc462b18f3b1a0bc0015b24464", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516627, "uuid": "984f6ff3-58fb-4d44-9286-51f103baea6e", "comment": "Malware payload (Amadey)", "value": "5521a08962260487adba94ecd2b8bc73c62f3784b5e274d16a57d4f5cc9e2b3011d2da9ebba3bbdd55f0b9a2d4c40640", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516627, "uuid": "75cf97a7-2254-4b46-afea-3618f60a6e16", "value": "T176B4F1CA61408973DF63DDB1C4DFEDD64FB9B12207718AC7130C99F18A425E4A60BA7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516627, "uuid": "cafc9ee7-b463-4da9-b788-2e8009e49721", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516627, "uuid": "c7c82a89-3de7-4983-82cc-2216295f5a71", "value": "12288:yEGR99yTey5s6KUAmvOnJ6eJx0B6Rkr45fQJQmZ:yEGR94Tey5s6K04EehRkr4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516627, "uuid": "72bf622e-bc56-415b-abdb-e204f2dbf210", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516627, "uuid": "4a961807-aa88-4d66-98bd-37c6cd22b730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516627, "uuid": "84b084e0-743d-46e2-959f-7d4d0521ace1", "value": "93f01fef81d80361666bd621cf4d43dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c2e176-1193-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687503705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503705, "uuid": "0e795e26-6349-41e5-8ab6-f35f93f52047", "comment": "Malware payload (AgentTesla)", "value": "dc284664c7d7561f8e31e6aa057cc40e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503705, "uuid": "4a995079-219a-4f71-bbc0-3a9685fc226e", "comment": "Malware payload (AgentTesla)", "value": "bfdba2515b2d767ebe541557f5461d5c6f9878eeaf9e5f6cc503ccf032143bfa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503705, "uuid": "dfb5c428-0d26-4d92-8d1c-fec67bfc500b", "comment": "Malware payload (AgentTesla)", "value": "03c95a300519323b9d3f544ce8a1ce8636051f1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503705, "uuid": "7847b8ad-6647-4fb4-9d10-d97d0232c78a", "comment": "Malware payload (AgentTesla)", "value": "69505e190c03944dcd6f234695b7e07848b25c3924d8b00e855bfbbcfd148f7150d010bb7b2d46716bcab187e62609dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503705, "uuid": "cfe83fcf-eafe-4edc-9fe2-45a35223415c", "value": "T13254136CFEE09C33D6E206B12D355317BEB9D42B5B9A5E4B33115E88FE816469B0C381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503705, "uuid": "559f804b-f7f4-4145-b2cc-8deca4238321", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503705, "uuid": "b6fb96b1-d282-40ef-b66d-fb80ea52a1ca", "value": "6144:/Ya6NuuZaR9Z/7rh2ydsJ6dBpOnbOg0tX//KULE6oh/f:/Y/uNXB7dvdseBQnEt6Dh/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687503705, "uuid": "464c541e-a3a4-4a84-b265-b6e30089df58", "value": 290761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687503705, "uuid": "671ce44f-03a1-4dc8-8690-082bf5e8d494", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503705, "uuid": "6a41857c-6e6d-4db1-b0af-c910ac21aff1", "value": "94762156001348.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcc9c7f-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499757, "uuid": "898fa886-cffd-49f8-9689-dfcee9044051", "comment": "Malware payload (RedLineStealer)", "value": "4e15022b31365685f341ce54a4f05ed5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499757, "uuid": "f5c59581-3af6-4f53-a2fe-26901d5ac80f", "comment": "Malware payload (RedLineStealer)", "value": "bfed45bf3ae36281d4d01c5ad1d4e1e65ca26937df0903b80af635d192fa7367", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499757, "uuid": "2479eb91-da48-48f8-a80f-e2a6186cd0e2", "comment": "Malware payload (RedLineStealer)", "value": "10fa9fb76dc948c83395b6471de6c64df41f96c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499757, "uuid": "77b4ecca-d9b2-4818-8033-8606b9a66209", "comment": "Malware payload (RedLineStealer)", "value": "2255841c35d559f86f2c1a8ce4362a2f2ffd87e6815ad018b49fe025b3293bfcbfea3e49d84ce4b0ea7045de40f5eb41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499757, "uuid": "e22d3aac-8633-4381-9135-f01575ce45ed", "value": "T1BD444BFB52D1D460DD0FA8B02C6EE1BDDE31B461DEA284CA19BA0952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499757, "uuid": "388b0f65-be3a-4d64-8566-0d898d3135df", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499757, "uuid": "05dffb9c-565d-4b01-a69e-19f95b455a4d", "value": "6144:OmMHIDWpigt0poiRG/XvLNUgYhuE22tQJQmb:OmMHIDZgtAoiRG/fSvlQJQmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499757, "uuid": "4fd363e6-ec71-497e-800c-4497441bd656", "value": 276289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499757, "uuid": "c1218674-d0a0-4fd8-8b2e-e883f087f0b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499757, "uuid": "aaf93b1a-5357-4bb0-b6f6-3cbedfcc6157", "value": "4e15022b31365685f341ce54a4f05ed5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36184a43-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501298, "uuid": "f394a014-87f4-4e13-8d4f-b3c2169ea42c", "comment": "Malware payload (RedLineStealer)", "value": "e4b4790408afc71386eb9e5ef62ad60d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501298, "uuid": "3f963f6a-9d36-49ad-a481-4f92c339c774", "comment": "Malware payload (RedLineStealer)", "value": "c0d377bbbaba33ef6add43008d044d78e26b158fae07fb47da8839cd39566dae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501298, "uuid": "e8fca77c-6087-4cd8-9425-3e3fca3f8909", "comment": "Malware payload (RedLineStealer)", "value": "efa7e436ca1ca00c70be54d21dbfd6ca9227b170", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501298, "uuid": "239e44fd-5671-4a3c-90a6-e091ca6f7027", "comment": "Malware payload (RedLineStealer)", "value": "56d24611a44e1af2c935dd49bc64bcfa40dc380c139464b5b3b8c8903abdd9cb61060e1db553749c4766cb2a97f88a62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501298, "uuid": "d200b66c-91aa-4c81-80bb-a9c778c6daf9", "value": "T168E412D6258004B3DF67DEF2D0EFE9EA4E7A31240B7547C7120D45FA4B066E0A507A7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501298, "uuid": "f5e29c3d-1486-4bc1-b7c1-953728bf369b", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501298, "uuid": "d5e01fe6-2b26-44d1-9ba0-149133ace86e", "value": "12288:Z4mO1Zei2eTey5sW/ISroPnjzZJEnhegdnwMZdLXsqEKfhXJ3p8P4QJQmZ:Z4mO1Zei5Tey5s2IfvYQgd3d/Hp8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501298, "uuid": "3c244f83-a2d6-4529-af88-f7a5ea6d3ad9", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501298, "uuid": "1eabbdc8-6870-4580-a344-d5b8c1d4eb87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501298, "uuid": "c71ee444-daf4-4175-a2f5-df9ee64011e4", "value": "e4b4790408afc71386eb9e5ef62ad60d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daeab08a-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499427, "uuid": "732434e0-067c-4dc3-98ac-8aee9227f613", "comment": "Malware payload (RedLineStealer)", "value": "1124bf24f37416103784f35875413dd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499427, "uuid": "e4cf2149-88ef-485b-bcd4-d3f2f4a34238", "comment": "Malware payload (RedLineStealer)", "value": "c11776537e6e0284b3952cca72efe0edd51318f0162d4f35b28a00537299d072", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499427, "uuid": "2b799da4-89d7-4f8c-abed-474388e3a9c5", "comment": "Malware payload (RedLineStealer)", "value": "0503c1e66b6ba112f7e5ab5befba2326cb7121a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499427, "uuid": "a7ec150f-c55e-4b45-94b1-43b420317ad9", "comment": "Malware payload (RedLineStealer)", "value": "e62740537555f3e9cac2b3d40bf50c0fc576f86a6052ce2cfe299a8526c7e83a959214ae1b8cd7e2f543c3d34e984192", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499427, "uuid": "c282294b-0318-4526-a8bb-2ca5d61f58df", "value": "T1A6B4F0CA61408473DF23C9F1E8EFE9D64EB970310B354BC7120D8AF98E466D4A61B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499427, "uuid": "6ae747c1-7ade-460e-be08-e7d559c50138", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499427, "uuid": "2342fb06-edb6-4c9a-af4e-5bcf5282cf28", "value": "12288:beJiBTey5seKiHNedusmLU4uK9lpQ1El+5lFzQJQmZ:beJeTey5sjisdZfK9lS1El02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499427, "uuid": "518464fa-d3de-4219-80ac-34123bad9aa0", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499427, "uuid": "5e0ece46-2721-4930-9dd3-10b24e712143", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499427, "uuid": "5e510792-c719-42ff-baf2-b91a0b8d6cbd", "value": "1124bf24f37416103784f35875413dd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85991ee-11d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687530749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530749, "uuid": "18161bda-6dab-423f-ac82-57b0d96eb117", "comment": "Malware payload (Formbook)", "value": "60b7c382b13d3f69eb22b375c8fd0e06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530749, "uuid": "ebf05bf6-3e4a-4719-8848-d212dc6e39e2", "comment": "Malware payload (Formbook)", "value": "c155fef955e84c3105693dd142f5e385ee89fa251fd071f366dc6caa94a34502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530749, "uuid": "424e7a18-67f8-4ddb-a006-fcbb14008b58", "comment": "Malware payload (Formbook)", "value": "2c01ffaa3448b4c4dbfba0bd614c0b7b6ac318ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687530749, "uuid": "ea2ab76c-e328-4fcc-a567-63fd33541dd3", "comment": "Malware payload (Formbook)", "value": "ef960f5b1d9fb9a512bf3de0a5d5aa462852df0c3e53479392a3c1496a14a9541c3ea372d7d57290ecb9cb3aa1c22fd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530749, "uuid": "fd04c653-7883-453b-b84b-6e574080c19d", "value": "T144E4121656F14921E8391EFA64B25521CBFDFA12F623F38F2E9531F20563B915E032A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530749, "uuid": "968e55f0-297b-4201-bc0a-908f06ca8438", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530749, "uuid": "2822273b-60c9-475a-8306-407585fffa1e", "value": "12288:kwokM2iNh4/mNUAEzS22PD77Xuc7O7cpTlrUpphGslpA:13M1D4/QU7e2sH7OAT9OhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687530749, "uuid": "c431fdaf-b9f8-4a9d-8151-47bd9691140d", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687530749, "uuid": "c0864e0b-05fc-4da4-b960-cfb69d76c0db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687530749, "uuid": "42a78ef1-69f9-4c05-a047-e1d659a0ff87", "value": "DC62-Q5667_SCAN004.COFEE-INQ_88.95.326.1.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a9a5fc-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501289, "uuid": "58ab6a5f-9325-4427-87c5-5b2ce0334414", "comment": "Malware payload (RedLineStealer)", "value": "d7d1f7ac83da33a7cc58f5a4b2ab9cff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501289, "uuid": "5cd8383e-6085-4aed-a8fb-fe6eafd018dc", "comment": "Malware payload (RedLineStealer)", "value": "c19002e2671bd59307f3ca0b8d9530f31dcb2e7bada0e71cb0b2cc3cdf34f4f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501289, "uuid": "99330f60-1fbe-44d6-9da4-8fdf60e5f084", "comment": "Malware payload (RedLineStealer)", "value": "036eb8c08d8c034f7aa01ebbe8033631b8d373bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501289, "uuid": "1fed17bf-47fd-4a97-b4a1-a600773ace86", "comment": "Malware payload (RedLineStealer)", "value": "76508a48a23090c85f79023a68f9f3b50c49b2fe5884c2d1e1283cc7205d9480d79c60785016fc46c99fcbaa31cbaef1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501289, "uuid": "8b8f3d36-f882-4912-a4a3-9a3e4faf51b2", "value": "T138B4F1CA254008B3CF27DDF2D4EFE9E34EB5A1210B6147CB120D59F98E462D5A61B93E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501289, "uuid": "7e0eea52-399b-4a58-8776-6874cbbffb1a", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501289, "uuid": "85d07101-1b70-4be8-94af-49dc9c306f9a", "value": "12288:CgErdsTey5sDBOZF9LmAX3H0K1+W2G/ihzFQQJQmZ:RErOTey5slOZC23yW2YKzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501289, "uuid": "005c196d-7b34-468e-b5e7-29831c93556c", "value": 530752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501289, "uuid": "810ba1cc-7c50-42fd-9c89-ae1beb11d2b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501289, "uuid": "4eebb9ce-d406-4537-beb6-c3e4ff700e28", "value": "d7d1f7ac83da33a7cc58f5a4b2ab9cff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3947027c-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501303, "uuid": "2872c3c4-bcad-461b-aa94-cdbc4564b333", "comment": "Malware payload (RedLineStealer)", "value": "e35a8d81d867b18408c7e9d3176f808f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501303, "uuid": "f411d804-6a1d-4f95-9dfd-6b36f8e81435", "comment": "Malware payload (RedLineStealer)", "value": "c246c03c89cd6de0dd9afdf9d9c821d18443fa556baddb5d92cf6e6206ad7bac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501303, "uuid": "2efb6560-0854-4a00-8722-0ad65c35f307", "comment": "Malware payload (RedLineStealer)", "value": "a19bc565615773bf24aa492dc67602c87c917cfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501303, "uuid": "c2e90c8d-5f9f-4e55-a974-93f390330c4e", "comment": "Malware payload (RedLineStealer)", "value": "13b9087b2003b2d921f252ba01277af7226d54038a8ab81fb41c16e7edc61debd603f916071a62aa4146ba33fda66bff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501303, "uuid": "d30a9dc0-b493-4f6d-a4c2-ceccde1a3e0d", "value": "T1F0B4F1C626404973CF73C9B1E8AFECD78E7971210B650BC3230D4AF94A512E9A61B57B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501303, "uuid": "7fbc7d92-c70c-4ad5-a38e-7b3fdde10715", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501303, "uuid": "33d6243f-5a39-457c-aac5-16520047ac15", "value": "12288:/Ae+EXTey5sfv+hM7ZrEEhm8t8p3p0M5ZEwFQJQmZ:/Ae++Tey5sfvqqmq8p3lg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501303, "uuid": "2a0d8a7b-9a36-4d0c-a299-b9c49c267ee8", "value": 540992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501303, "uuid": "085e24ca-cab7-4771-98f1-26aa7a039bd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501303, "uuid": "2a1b31f4-a687-4ae2-8625-4413a4ddd210", "value": "e35a8d81d867b18408c7e9d3176f808f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7673be94-11b7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687519015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519015, "uuid": "e468b4b6-c645-4cca-b3c4-ffbf0e2a612c", "comment": "Malware payload (Formbook)", "value": "f14a6c2f0c53470577f1e3a66e34fe64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519015, "uuid": "9763dbda-c7d1-4eed-a14f-5b61685c1b6a", "comment": "Malware payload (Formbook)", "value": "c299e76637951c9dbe6d4e5eed327228c70a186c9c37958b3bb756add59419f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519015, "uuid": "f41612d7-2049-4cc5-a987-7ee63876cd06", "comment": "Malware payload (Formbook)", "value": "4b8e64691a81de44804bf9190c325b8f9e5aa868", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519015, "uuid": "f24fdf52-c5d6-4200-a37a-3853f14494c0", "comment": "Malware payload (Formbook)", "value": "ecce410d421db711d789e81b103e74cd7397a3a1c4ee363c7d8220b283db00a4669231434233ab10720dd24fb808be59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519015, "uuid": "bd66efc8-753b-45d5-bc78-13674b3de206", "value": "T146741202B1F9D8A7DAF30B71247A16669EB0D63448B4F60F83803B5D3965791C62E7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519015, "uuid": "31b85393-82ad-4073-b7ec-ce09236ba6c9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519015, "uuid": "63ca2c0e-97dc-4d08-a118-33182f63243e", "value": "6144:PYa65rGSvu7AzoMHAyjMa+4MS5l/Lr18/azj3MQhoLUUPMG1sBC+0SaXE:PYTnu8zo0Aywa+m5lbj8QiL2G1a/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687519015, "uuid": "fa07b596-4321-403f-92e9-16b52c31a098", "value": 343971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687519015, "uuid": "4fe8ee1e-5037-4fcc-9b93-5f6118bca1b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519015, "uuid": "30224afe-7fd1-48cd-98a7-694f165701e2", "value": "f14a6c2f0c53470577f1e3a66e34fe64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93edf25-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499773, "uuid": "4fe97a5d-32f2-449f-ab86-edf3dd679884", "comment": "Malware payload (RedLineStealer)", "value": "4527c07004b6ae73afe560d3f4886f92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499773, "uuid": "51f12aac-4389-444c-8bb7-5d63144d2beb", "comment": "Malware payload (RedLineStealer)", "value": "c3b8c6a1b517196f18482c3c9450161fd62e7a359972a8570f3f589f25f7fd87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499773, "uuid": "a73b3083-1d89-4b59-924c-8ddf70453d5f", "comment": "Malware payload (RedLineStealer)", "value": "870e6a4c4769e2dc690909bfff754ad01c03f02f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499773, "uuid": "c1ab2000-6f74-4cff-a20f-40e5b0f525bc", "comment": "Malware payload (RedLineStealer)", "value": "bd02832c66730028b69e89fe7a7718c4e38a603a7d34567f140754cae80a358096ca4bc6416296b9935a73b0238b2b6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499773, "uuid": "a5ff6cf9-bbf3-4949-9a6b-c9b3fed20bfb", "value": "T16CB4F0CA21404973CF23DDF298EFE9D74E79B1310B614BC7120C45FA8E416E9A61B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499773, "uuid": "8a019645-c121-42cc-bc37-6197491df4d3", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499773, "uuid": "eedd7212-b3b8-475c-a2bc-2ca9120cdbe3", "value": "12288:D/EF2NTey5slZyuZCVrFicVO2KX1a3wVFlbQJQmZ:D/EFGTey5s6WeFwa3GFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499773, "uuid": "157d44d1-90ab-4a51-9966-363bb885d748", "value": 530752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499773, "uuid": "0c64e5c3-a0a4-4a1d-abfb-520244cf6d82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499773, "uuid": "1a4f1f2c-5ffa-4c3b-9814-4d02061e2cda", "value": "4527c07004b6ae73afe560d3f4886f92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08da5faa-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500363, "uuid": "0e8fb425-dd1a-44ab-b349-79920022b140", "comment": "Malware payload (RedLineStealer)", "value": "9034caaa5e704ca0f831e5aa5dfeeb3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500363, "uuid": "5258422a-01ab-409e-9bb0-498725794801", "comment": "Malware payload (RedLineStealer)", "value": "c449b6d60457cc2e3fe1159f6b8cd13682bbb889e56dae46252f53ccf9f5e3e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500363, "uuid": "3e061a97-980c-43b0-bc2d-5daf90896f80", "comment": "Malware payload (RedLineStealer)", "value": "cfc2cf7b210d555f1abc5324f5054cfc8380e4ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500363, "uuid": "a832e6aa-84c5-4642-949a-4c2de699274b", "comment": "Malware payload (RedLineStealer)", "value": "bf8f31781f8e592e9b0af4f9a2740dfee7ab3f29207d3cfbb78683b758fcfa028282a9831f83c148cb8b44e4cd492999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500363, "uuid": "9b0415ea-af86-461a-8460-e7584dd8de58", "value": "T103B4F1CA25404673CF63DDB2D4EFE9C68EB9612107A14BC7130D46FA4E416E8B61B93E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500363, "uuid": "0056a8fd-29bf-44a1-bc79-d26f4f50bb94", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500363, "uuid": "9f5bfba1-ba48-4ef2-ace6-585ae312a3e6", "value": "12288:9q0O2xTey5st/XmIQB6R5qzc0ck//RZLzaCQJQmZ:00O2Tey5stIw5qBtJZLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500363, "uuid": "755eb662-b78f-40cf-8e61-bf5204453d8b", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500363, "uuid": "cbba24b5-fa30-49e7-a695-0358aaa18a39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500363, "uuid": "5c79f5de-e144-4ca5-872d-1ab94c977480", "value": "9034caaa5e704ca0f831e5aa5dfeeb3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7213bf-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687501307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501307, "uuid": "4e780ddd-a24b-4f8b-b403-3f920ae8ca36", "comment": "Malware payload (Amadey)", "value": "f199f2d255b256e6424203f8decdf9a8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501307, "uuid": "2723dfef-42d6-4611-8a23-ec68755adde2", "comment": "Malware payload (Amadey)", "value": "c460adbbd3011ee07916bd8c14312b7445c26e2cac3f62ab16960d08a1fe74ee", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501307, "uuid": "e6b5640d-1cfa-4ffd-a85d-1bcd4c4a3db7", "comment": "Malware payload (Amadey)", "value": "a1d762021f799033c154b90f8c22c87a8a5bb230", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501307, "uuid": "6ea709c0-6109-47c9-a246-2aafd1c1a6b9", "comment": "Malware payload (Amadey)", "value": "2c502b2d391e74ad0c54be79708df54605f2678d9f40bb73c323ab3d538bedf0e5e68df938318e20a758cf1ad35b3dbc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501307, "uuid": "15ac1083-398a-4a3a-b29b-363681a38c76", "value": "T19CB4F1CA31408977CF23DCB2D0EFE9D64F7A602107B14B8B120D56F68E555E8E61B63A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501307, "uuid": "055dfcc0-0ecb-4f2a-95e3-cd72c2067ce1", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501307, "uuid": "253d81d4-d8bb-4658-8f11-5981a4737148", "value": "12288:SozgFTey5symUF/dnm8glt/xtV0To16l5WBQJQmZ:Soz8Tey5sgVmFlt/f2TZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501307, "uuid": "9682d802-556c-4a58-9a8b-657829e3526a", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501307, "uuid": "470af6cc-5004-44f5-9f98-ce2bba395b88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501307, "uuid": "d6322bb2-9805-48fd-836a-9e668648f136", "value": "f199f2d255b256e6424203f8decdf9a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13410ed2-11e0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687536458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536458, "uuid": "7bc52a21-4a9a-48a8-b20f-647a9437c2f7", "comment": "Malware payload (RedLineStealer)", "value": "ceaeee211937f3906b05e29ea198fc39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536458, "uuid": "1e20af3a-37f2-4a3a-a53e-4ebdc551af5f", "comment": "Malware payload (RedLineStealer)", "value": "c63fdabb3d07f85ed2935d32d9d41fc58db9fd457a75f4404361172d64927c5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536458, "uuid": "c177365c-c567-43d5-b9cb-a66ca89437b5", "comment": "Malware payload (RedLineStealer)", "value": "06f72b690aef4b8efe3601fd88884e7aea28bc07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536458, "uuid": "d2dfa439-4edf-4b6c-9900-545bcb7da437", "comment": "Malware payload (RedLineStealer)", "value": "c1c5a122a5ad3632fbc096ef9130415dba53f63700004172538aad10d09d675fc574733bd27a957536e3761dbbbca0df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536458, "uuid": "b8631a2e-5cca-4f66-a3f1-4d2549d38ffe", "value": "T18006227A2A00E673DBE73035C467529F486866B25A5FB84ABFA70C3B5A631DCC4747C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536458, "uuid": "a2ea3472-d6ae-411d-93be-ad6fe0502a3b", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536458, "uuid": "70f038f1-b845-4e76-bbc3-9291a70f33f1", "value": "98304:P9Emmed7ho0DyQl9ocaa852neAHwIOmfQQ6ZSWa75ywCu+fItEjOqH35jlxJ:P9Emo0DyQN852nvHwI48Wa75yLuCqXGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687536458, "uuid": "81e553f0-fc6d-4510-a95f-cab39891d120", "value": 3782144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687536458, "uuid": "15ceed59-d1c3-4a2e-b4f7-aa3e45280d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536458, "uuid": "fdfa7a6f-8307-4da3-9f3e-56270dfb088c", "value": "ceaeee211937f3906b05e29ea198fc39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5c7071-11fc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687548845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548845, "uuid": "01d6aa92-bc07-487d-b82a-a935c4a7343b", "comment": "Malware payload (Quakbot)", "value": "9cb548edb551361e1563d3aa431ab62a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548845, "uuid": "5062d223-b919-4e84-9f52-ac058ba0703a", "comment": "Malware payload (Quakbot)", "value": "c68f65405594431595c84bc345c28a7d73b797ae8b007352ccb48ddaecf03fee", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548845, "uuid": "6c263476-6508-45a6-84bf-0f067406e897", "comment": "Malware payload (Quakbot)", "value": "7ffb5dbbdd69354ecae42367d4b80c10efb4bfdd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548845, "uuid": "34ecb11c-8f27-403d-bf0a-4ac37340b061", "comment": "Malware payload (Quakbot)", "value": "1fa7fce7430a7a30c3fbb5175bc37f3f00e79b8a688e06fc83e67b68109585770157ffd25b4c71ccb818879e9dafb5aa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548845, "uuid": "7e2f0e0d-9b8d-46de-a50e-afc7d237edc5", "value": "T1AC74496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548845, "uuid": "e524ad06-45c7-4685-a847-80b7b478c14b", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593e:fIS1xb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687548845, "uuid": "0415cfb1-6be2-4368-a554-9a107c940c5b", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687548845, "uuid": "7201b7b2-1ac9-4205-afb3-aabb42893972", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548845, "uuid": "f93551d0-a665-4101-a9fb-27ff0fb39b79", "value": "BSN-149556221.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7452306-1190-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687502427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502427, "uuid": "a486f96e-52a7-4427-b778-2e6641a303d7", "comment": "Malware payload (Formbook)", "value": "7747a48635cb9f24aebd42ad05fcde93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502427, "uuid": "bb83d804-b11d-4cd5-b07e-01f1fbf72a26", "comment": "Malware payload (Formbook)", "value": "c751b1369af3d6c58b101c6605dee97559f910f23c009cc41ddff70c0ab06a0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502427, "uuid": "79e7f897-dfba-4da8-9e2b-dce6a82ed64b", "comment": "Malware payload (Formbook)", "value": "165a095cdb3c9b0591d04efb2ab8caecebbc667a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502427, "uuid": "3a797f80-61fc-4deb-83a8-8805c0a0dd2d", "comment": "Malware payload (Formbook)", "value": "fcf30377797b011477af3c42af820d6d6d2595bbe4ce4dc7b496aa4590ec56feb4047f107a50771df2fbfd8096b06708", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502427, "uuid": "7f5f1353-9598-4889-a107-de7fd2f6a40c", "value": "T1DB64F04855B080EAE0617EF05D709619BBAAAD102582975EC3327DE87533B83EC1FB7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502427, "uuid": "c15ac83d-6516-475e-9854-681d0d2f507f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502427, "uuid": "80516c27-022f-415a-8094-fb5d52f2a884", "value": "6144:BYa6xMRpovPU7YD0MPQGndKuRFXro+r9LLR8uKB5Wgp2:BY7wKt0MBdlrt5nRHKB5R2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687502427, "uuid": "320c1274-c5fb-4759-8e52-c0c77c3dc1d6", "value": 326298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687502427, "uuid": "544a27c0-99df-4082-b50c-2434da3c00af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502427, "uuid": "13e7903e-3662-426b-a0ac-a02d80088672", "value": "ORDER#KG23AG007_JUNE2023_SHYAM_GRSOUP_IND.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f518a0-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687499127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499127, "uuid": "09eae2c2-87b2-4850-988a-e333febb34dc", "comment": "Malware payload (Amadey)", "value": "1c6dd41bf1f7979ddbcad59026278ff6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499127, "uuid": "1f99d466-db19-4845-8f0b-b484cca1aba2", "comment": "Malware payload (Amadey)", "value": "c784910c1197c5d154eaf814f0cef352f5692c7090f6a0e88846bfaed3c59244", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499127, "uuid": "ea9138f2-e0c2-4127-878b-e53f7c1ab197", "comment": "Malware payload (Amadey)", "value": "099cf5477424298e0bd5eb8d94c75f2f340d2e1b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499127, "uuid": "255f958d-1d80-443d-88f6-18bd74330b4a", "comment": "Malware payload (Amadey)", "value": "da23b410a28587db618c5547a52f2e6444fca0570c49f375e86f07341b4a7af8d857d347d02f24675e32ec45c8e12849", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499127, "uuid": "eb7c3c86-06ac-41d5-9f41-27d799694694", "value": "T107E401CA66804963DF23CEB1D4EBEDE64EB570310B714ACB130D95F64E062D4A21F97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499127, "uuid": "61cd5f5c-5e4b-4eb1-9552-319be90d9b75", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499127, "uuid": "bea51df8-df53-4643-b616-3e9311fbaff3", "value": "12288:oeOE2Tey5shUEV47dYg6vG3J6Mi6HB48pwTywnpJ4fxYZFcM5p/LeQJQmZ:oeOPTey5shUD7WgyG3Jdi6HKqGEx8dnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499127, "uuid": "c104fe7b-43d8-4bc0-9cb0-6ae965c37225", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499127, "uuid": "b40f4dde-cae8-4771-a16c-c177783b1a4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499127, "uuid": "df189185-8ee9-4845-9fa6-efbf452372e2", "value": "1c6dd41bf1f7979ddbcad59026278ff6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92869f8a-11ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687520351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520351, "uuid": "4da894b1-c6c1-4d5b-9a25-1ea4b4e3b887", "comment": "Malware payload (AgentTesla)", "value": "4cc2c40c9b2de72b921a0aea9c1bf81d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520351, "uuid": "a33b9fc0-d12f-4953-8aea-f2c19d2d7e3b", "comment": "Malware payload (AgentTesla)", "value": "c80ff12cdbd7537e9440b4337acb944b16eed326bc3552b87224da47f826fbb6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520351, "uuid": "4efc1dc1-15db-4747-b1f0-2507df32415e", "comment": "Malware payload (AgentTesla)", "value": "603ff520906be97e70ff7f4eb05666f809902d0c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520351, "uuid": "14a4a8ca-651e-458b-958b-befa820501f3", "comment": "Malware payload (AgentTesla)", "value": "fe060e03b251fdaec161c6d378b3718d323ec0267434e4e2619988ed3ab02de03d33707ee5db0f0ab052fafbb526a290", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520351, "uuid": "f9f3de3a-5765-42db-87ec-c1cc54101d2f", "value": "T1A5D4231535508B31F8958BBA699364A043786341FA22DA4F9FDF3DC82DD6F0813C2B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520351, "uuid": "acf2eb4f-6c7b-4bcf-9f59-b7144bb43f65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520351, "uuid": "241fcda0-15c9-423f-bfb7-d922294da905", "value": "12288:Ak54/mNUACZVH4Lgnp3UF0m+2a1NodjmwJDvFcyFiran:Ak54/QUf3H4Lk/pI5JDd/FiWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520351, "uuid": "58ce3617-7803-4885-ba18-30f4bb767e90", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520351, "uuid": "058ca9b1-2e0b-4999-9aae-c2cc85a5e331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520351, "uuid": "1440f440-9aae-496f-864f-0854b5845e37", "value": "DHL EXPRESS- AWB#8457108962.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d0da75-1192-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687503098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503098, "uuid": "e429257d-9ab1-4f8d-9d43-32e61892479d", "comment": "Malware payload (Amadey)", "value": "4a7b7e23f203be1e70c0b91648e6ef52", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503098, "uuid": "91f26608-69c6-4479-86e2-15f26f91e11d", "comment": "Malware payload (Amadey)", "value": "c8481d70b8b111a2f02ee9dd24c72db3398ff73d4d5842b62d959a4da968d270", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503098, "uuid": "1fdcfe84-1021-48e9-a491-faf9ae4276b5", "comment": "Malware payload (Amadey)", "value": "83a63681bd8d969bf1ebf9fe3c710077d2ae2ce6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503098, "uuid": "1f70acb3-1bfa-4da1-af42-2dcbcc696598", "comment": "Malware payload (Amadey)", "value": "86ca43da99f73abf8d5e3b273e62b4a652c0a16c7ffff65fc3bc8bb616c0ccd9b2431659c142e8df944afe74fe17a221", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503098, "uuid": "68e04bd0-5d03-455c-8f06-7151a8b31acb", "value": "T16DB4F0CA25808973CF33C9B1D4EFE9D24EBA703107618BC7121D89F58E552D4A62B97E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503098, "uuid": "9a4c8032-d3a9-487b-8600-f39ba95f5499", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503098, "uuid": "63166b43-c147-40de-bee2-71c20e49687d", "value": "12288:q6UdD5Tey5sD8B2mRX7Hd3B5dXjUT3JzFlpWoQ4qQJQmZ:q6Ud1Tey5sD45HZtYjJzFbmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687503098, "uuid": "3ad53e80-8b45-4d28-919f-45d525beb5f1", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687503098, "uuid": "38006bf7-fbca-4051-a52e-46c58a804364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503098, "uuid": "19dacac8-6a80-4b58-9d9f-1f7362150859", "value": "4a7b7e23f203be1e70c0b91648e6ef52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528a8da9-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500057, "uuid": "78e2e981-5a52-4b8b-bb76-5ea3c16afc2f", "comment": "Malware payload (Amadey)", "value": "6930612c8c8721b20cdb31b3147e120c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500057, "uuid": "c98b4a36-fee9-476c-b767-a5ad581a120e", "comment": "Malware payload (Amadey)", "value": "c8505155327592298ce6ffe5bf98c5fe2e5747e0911100caf7e8ce524da9a756", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500057, "uuid": "d2166a5a-0f3e-45b6-b0db-ba3e02883fe6", "comment": "Malware payload (Amadey)", "value": "61c8f94517bade6fa7a2cbde30f44cd6d92dab49", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500057, "uuid": "c828cd72-d9d8-4d62-b356-e01543d80635", "comment": "Malware payload (Amadey)", "value": "a685d14df1736dabab1d8ff69038b1b2ff9ffe6d860294e5f6febecfc7af6ea3868fbb8571fd6e2cd248c7a4dedd6e60", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500057, "uuid": "a38c28fb-916c-4ca5-9e46-49b6a2429c12", "value": "T112B4F1DA21804073CF23CDB1D4EFE8CB5E7961210B764BCB131D4AF94E852E9A61B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500057, "uuid": "615bae35-c52d-4186-bca4-68a978a20fdd", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500057, "uuid": "56ae008b-61f9-434e-aafc-5c8ec6539bcb", "value": "12288:6eJ4xTey5swtSoOi7Tsx+z1lH9ln6L8no9ZjQJQmZ:6eJQTey5swUoOi8+z1lH9po9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500057, "uuid": "f3421f83-e51f-4497-ac4c-e0b12e7dae47", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500057, "uuid": "fa51f170-a1fc-4f86-a5ca-6017027baf6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500057, "uuid": "2b889c8e-3f4f-4bc8-8225-6592bf4e6e5a", "value": "6930612c8c8721b20cdb31b3147e120c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6bdb705-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687510614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510614, "uuid": "796e6aec-427f-4e50-b889-e5057d7246f1", "comment": "Malware payload (RedLineStealer)", "value": "2af11ac798abcfc4602e0384f8e51776", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510614, "uuid": "26aa1716-d024-480f-8101-05c0e9877029", "comment": "Malware payload (RedLineStealer)", "value": "c8850912068a46bfb44c40b7037bd07037fb065cd5d266a95cafff9af55ef062", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510614, "uuid": "80ff4d9e-1353-44fc-8202-bb95569529e8", "comment": "Malware payload (RedLineStealer)", "value": "6b3e8b39fcf14f68e227b99010cff17125fbdf95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510614, "uuid": "c0a484c9-ea42-4047-b546-f18ceee01d68", "comment": "Malware payload (RedLineStealer)", "value": "05bb4aea9900f5f3bde4cd18636bfde9b3af7fbb34598372e3a1fe69355e74c25a389effc33da13480416af2e6a02717", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510614, "uuid": "4919d32e-48e9-494f-b3f7-7aa5a1702aa6", "value": "T1EBB4F1CA26408973CF27DDF1D0EFEDE60EB960210B624AC3124D5AF58E466D4B91B53E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510614, "uuid": "2be68334-b3bf-4d4a-a202-d5d0b1e1c17a", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510614, "uuid": "0bc5c71a-e464-4777-bcd2-bc79f891f45a", "value": "12288:9Geg7MTey5sC/rMqrZ+m4LBOIlUL9VCGuj2MQJQmZ:0egATey5sC/4Y+m4F7qAGujO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510614, "uuid": "da72ca87-70ee-4be3-a6a2-69d5cf646ad7", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510614, "uuid": "de990be7-d34b-4723-ad86-270185e9b904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510614, "uuid": "047a9515-dede-4fc6-bfd8-304aadcf1922", "value": "2af11ac798abcfc4602e0384f8e51776.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0966d1-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687501233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501233, "uuid": "d8ccfebe-b64c-4e47-9046-925004cf04df", "comment": "Malware payload (AgentTesla)", "value": "c52cee1908e548bb4f0db9ae4fe281c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501233, "uuid": "d56e3a15-ff07-4d53-8701-161685ec84e1", "comment": "Malware payload (AgentTesla)", "value": "c9bbb774a7aaf0944b7ba420f0f316cbe9e144312b501881674c6cc35a6b6d19", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501233, "uuid": "d5fe79eb-ebad-4b5d-b04c-3259c9f69597", "comment": "Malware payload (AgentTesla)", "value": "abf556a3137fd07937fc6dccb9c3462f5fd42e12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501233, "uuid": "857a4ced-9f4b-461e-82b0-4083f9adf35b", "comment": "Malware payload (AgentTesla)", "value": "6bf107875a5f55ef9e33569c75785d24602f24b0e7809442202da97e3dfd870fa67ccbab0084d6e87f614b5e33911fa3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501233, "uuid": "3a38737c-c999-4b4b-a8d8-06697545dad7", "value": "T16D327D365DC7386EF30754F590AA31CAF6A830937239F91A7A30F964C5B21CDAA106DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501233, "uuid": "1f997d4b-24b5-4bb1-9225-ffc3cf7533cb", "value": "192:zya0NWZzxWlARgZVPCK44AG9xXSJ+Ej71JYbKwEKW5FWY7cWeiV:zyXWZzxWlANK4499xXSJf71JYbKWY7jV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501233, "uuid": "332df0b6-8402-4188-bb32-b13d7a5cf856", "value": 11083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501233, "uuid": "8ef5bb08-5259-47e1-b470-92c446a4308b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501233, "uuid": "4a7ab5c3-eb94-41e2-a5fb-5a455db7038e", "value": "Shipment and BL Instructions Docs.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41be54f8-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687510337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510337, "uuid": "de8d28db-bc1f-498f-9c96-5fdb27470d1d", "comment": "Malware payload (RedLineStealer)", "value": "dd0788fbe3a8a9f297e8d836d8017e66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510337, "uuid": "ce7bdf50-33ed-4d3e-b7e9-f917fd5a0003", "comment": "Malware payload (RedLineStealer)", "value": "ca0b6c73b0af017c63bb77f6623285daaee7e5a0ce18e3c3235ede15555a241d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510337, "uuid": "d215f621-756d-4377-87f7-b060d9e36dce", "comment": "Malware payload (RedLineStealer)", "value": "95fa8d689c68b9fa135d8178b8762dc83c25d51e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510337, "uuid": "121b8006-12d6-4153-8f7d-5f1d19a26c9e", "comment": "Malware payload (RedLineStealer)", "value": "3d3ddfd51bd4dac38f0288292d49d91c329051b9b089152c0f54f3591a4d5c1252ea0e3cc000f16ac776ddaad23371c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510337, "uuid": "52f3460f-62ff-4bbd-b992-b543b9d2344f", "value": "T128B4F1CA61804573DF77CAF2D4EFED974F7A60210B614BC7120C8AFA4A452D4A61B93B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510337, "uuid": "70ca5cee-f1ff-4b52-b2a8-3dadf159f0df", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510337, "uuid": "f0684732-fcdb-49ae-a344-f9190c3a1418", "value": "12288:WKeOV7Tey5scB4TSzPS6/MJKZGzriDaJPa1eQJQmZ:DeOBTey5scuTYS6efN8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510337, "uuid": "49e5d9d9-08bb-4b1b-a0f0-4e3487ce79fa", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510337, "uuid": "f07025e8-aa93-4f42-a099-2c8f8777e3d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510337, "uuid": "2b358a89-37af-4221-a26a-af696703001f", "value": "dd0788fbe3a8a9f297e8d836d8017e66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adaf1e1d-1159-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687478735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478735, "uuid": "7258419d-9336-43a6-9b84-297ac509bafa", "comment": "Malware payload (RedLineStealer)", "value": "542c4cad7416bb29cb0f41cfd9495142", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478735, "uuid": "42f42678-8bbc-44ce-9800-96ac042a6cfd", "comment": "Malware payload (RedLineStealer)", "value": "ca1506c0c90f44dea6541f166b1b839db97acc0a33600527a97df34fb433853e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478735, "uuid": "3180e40b-397f-4d9a-a8b3-b49fcd7af357", "comment": "Malware payload (RedLineStealer)", "value": "b98cf46f085faa220f5c81eb2196d444cdf58b1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687478735, "uuid": "bdde2af7-603a-4f84-a10b-068da489aab6", "comment": "Malware payload (RedLineStealer)", "value": "7d28cc22429925a04e77c145229eb87558a6d7a2af7f1eb6c0f6307444b1d8d3d77ac4575df94522755102a5d00d9128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478735, "uuid": "3445054e-cd7c-49a7-906b-2b99ab6880b0", "value": "T160B4F0CA618045B3CF73CDB2D4EFEAD78E7AB0220B714B87120C55F58A126D1A62753E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478735, "uuid": "61939bb9-a374-4879-a7ab-a30823fab7fa", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478735, "uuid": "d7651085-e2c7-44c9-ae6e-264b443439f4", "value": "12288:DWeO3VTey5sJPLu95bhlXSubINytaXT0w54IAQJQmZ:yeOlTey5sJPa952u8QEZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687478735, "uuid": "4fe9c927-6e0b-4fd6-8fe4-0a0fc98316f4", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687478735, "uuid": "d24b3795-50ac-44b7-83ae-c0f812c5dc67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687478735, "uuid": "1f6ec197-4417-4be5-82e0-bd692a06fb63", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bc9efa-11df-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687536162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536162, "uuid": "709ed923-b1cf-41f5-8517-54c395eb6233", "comment": "Malware payload (RedLineStealer)", "value": "01b6219a2713c7ed9a037b57c11cb633", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536162, "uuid": "ee9768b2-143c-49ea-ba9f-15ab5c83ed7c", "comment": "Malware payload (RedLineStealer)", "value": "cbcbcf230ab49902866ebb16670e89af1bafbc885916ae7d34ec0ad62e8865da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536162, "uuid": "785d0985-9089-4ab8-bce7-51471ee65468", "comment": "Malware payload (RedLineStealer)", "value": "5f0d04ceff3cde756de4764ca5d7d6a31913a63d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687536162, "uuid": "78b14f87-27ba-4ba0-a652-3643734b5ffc", "comment": "Malware payload (RedLineStealer)", "value": "b0069374c665a086864be38246db5e25466d3978a091c86b5d21563b21a981d4c5ca39949f7e5f9c77160df3fd45648d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536162, "uuid": "855b6f84-bc0a-4bfc-b6be-b2ca378ac85e", "value": "T1DD55AD83EF4959B3EA412473E92F77932842A4F1139FB0BAB35F0A96D25383D0574B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536162, "uuid": "9031b265-0c8e-4ef4-a6e6-c52194f46717", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536162, "uuid": "bc05e3c9-5cdc-4169-9091-43b96677ce14", "value": "24576:zCO0vr2pO7LlkgaV424NzsmSHxuMj+rW5f5T5DURi3rTZJm6/jXL3L50ClDQ7U3x:zCDr28gNlMS5RT5QobTZJmkjrSiQ7EaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687536162, "uuid": "2184f0a9-47dd-4b9e-b7d8-b18a1a409029", "value": 1358338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687536162, "uuid": "3fee8011-8734-4952-ad52-907f2b9a82b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687536162, "uuid": "2ea72970-23e7-4079-a56d-16054147f1b1", "value": "01b6219a2713c7ed9a037b57c11cb633.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d62280-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500997, "uuid": "729fee11-455e-4908-87da-5c33b9f9117e", "comment": "Malware payload (RedLineStealer)", "value": "cec050aa7a41913e47736e597b2bc42e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500997, "uuid": "79b87370-09ec-4fbd-896e-71ce33a70e71", "comment": "Malware payload (RedLineStealer)", "value": "cc1da56ef77abcbf06fc830f12fd07e2ea96a6a213753f19bda0124fa1ae214f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500997, "uuid": "0dfa691c-2084-4864-bc85-35bd9156eb06", "comment": "Malware payload (RedLineStealer)", "value": "727074ddf4dd29f50942232c21c790f92c64b888", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500997, "uuid": "086b3e20-0db4-48a0-a1a5-9b0598c4c06f", "comment": "Malware payload (RedLineStealer)", "value": "7c854784f5662192beb3225d8d132463495608343997a6ead6eeb4060c3bffaf74f262793a03d07d9bb404011a4951a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500997, "uuid": "7c7e713c-af69-4fab-aa01-e95ad27943ec", "value": "T16FB4F1CA25804573DF33CCF2C8EFE9965E7A70210B724AC3120D56F68F456E4A61B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500997, "uuid": "339e0b80-ae69-4918-95b6-f7e8875c0545", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500997, "uuid": "b4a6a810-023e-40c1-9403-326090bca7d6", "value": "12288:ueiyDTey5sy+9y8h6vWru53Pq+D17rnu5Q6QJQmZ:ueiQTey5syG6erQ3Pz1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500997, "uuid": "a1787650-eb7f-4a0c-8851-19a5d46171bc", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500997, "uuid": "9b953476-cd5b-47d7-b5e7-cd40a5fbfa5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500997, "uuid": "2cd3457b-b842-4593-aefb-dc3837b895e7", "value": "cec050aa7a41913e47736e597b2bc42e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a38151c-11b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516928, "uuid": "f1e0edd6-aecc-4a1d-8a03-559de566b731", "comment": "Malware payload (RedLineStealer)", "value": "a4aea17fff1180277e93b4b3d4820800", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516928, "uuid": "07fc3040-9e4f-47d2-b409-5cf60d8043ce", "comment": "Malware payload (RedLineStealer)", "value": "cc3ff94cbcb7042619b80c9af32bd3d49ceea76e58737ac53ec21e318ad10d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516928, "uuid": "69a951a4-4842-4af9-9534-89077a20df68", "comment": "Malware payload (RedLineStealer)", "value": "e115b98d925439e85c0fc39f2bb382407984c654", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516928, "uuid": "7d50354d-0374-4e16-aa6a-7bffc92fae4c", "comment": "Malware payload (RedLineStealer)", "value": "d1ca6999a244877acf58fc71522467c8a6bd8371a4d40789fed9471d24d59d9287b9351795cb442e9f2b4bfd186f0d16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516928, "uuid": "92622ea8-3a3c-48ca-aa53-d907a65e93d8", "value": "T1FF444BFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA284CA19BA0952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516928, "uuid": "1ec3096e-4937-42c9-9455-a1da6faab9f8", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516928, "uuid": "3a6b6b99-7f8f-426a-9a24-da6078ce1d6c", "value": "6144:ye+upigt0poiRG/XvLNUgYhuE22UQJQmT:ye+xgtAoiRG/fSvcQJQmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516928, "uuid": "99f29acf-f840-4095-8c3b-89eb63ceed1a", "value": 276291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516928, "uuid": "73951074-8a89-405c-abe0-1b6349daeb1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516928, "uuid": "5adde8b1-ea8f-41ae-b6d3-2a75f5d39411", "value": "a4aea17fff1180277e93b4b3d4820800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90a74d6-117d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687494270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494270, "uuid": "9f11c030-f03e-41e7-ad0f-b76b60321857", "comment": "Malware payload", "value": "adede7c8550cefdd4d1f91c22f63e84b", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "sconengr-com", "colour": "#A461B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494270, "uuid": "dc9faf7a-6a72-4f65-9131-f578cdff6173", "comment": "Malware payload", "value": "cca64e88fbe928a92bfc3291f2ea257b20c0709123b4652bb9008926b544582e", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "sconengr-com", "colour": "#A461B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494270, "uuid": "941123d9-49be-4b59-8376-ffad1ef2db8b", "comment": "Malware payload", "value": "27aaef12ca5029ae72f0445b9318f3e894f82981", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "sconengr-com", "colour": "#A461B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494270, "uuid": "542271e8-ff3d-4a9b-b767-a9bc2a048e0e", "comment": "Malware payload", "value": "300d1e1099cc6b58d308f03762f5f6354c679f29024adb3cf8394fe80791acfce517024be99496eb93179778f3c239c6", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "sconengr-com", "colour": "#A461B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687494270, "uuid": "004e05c7-114a-4916-a07f-17ccb41016ee", "value": "T101B4237D2D373B5780D3AC74F655C8924BBECD06E8B542BAA241C585ABC31AC5134BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687494270, "uuid": "8e10b1ae-8ffe-444b-b43d-02e37ab5192f", "value": "12288:tm3vTV+xXu05mQEGLC2gtWnnAISxg/NtWau+paHzo:WvsR5mQEGJnAvaNtWt+wHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687494270, "uuid": "035e5d34-2548-49d6-ac7a-d9d4e9ff9fd6", "value": 542545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687494270, "uuid": "bd722a6f-aa25-43b1-9a38-ac423ec7e678", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687494270, "uuid": "2c380dc4-1b16-4e50-b2fa-29a23ca09f17", "value": "Amended_LOA and AirSea Proforma InvoiceEPDA_Docs .r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df299cf-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687516317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516317, "uuid": "e4513c76-dedd-49f4-8553-9afdd324f7e9", "comment": "Malware payload (Amadey)", "value": "10abddb026c7c1b47f03932d8789387b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516317, "uuid": "31566054-fc1c-4e43-b811-3890d0edd12e", "comment": "Malware payload (Amadey)", "value": "cd8b4ff54ce46e742b0ce07d53bfdb18f5856296e56872a508f58c705345dca7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516317, "uuid": "9268e1f7-72b6-4b3f-8cf3-a974f373874c", "comment": "Malware payload (Amadey)", "value": "afef2a47d38deb75561b5e6a77070715c9c1c776", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516317, "uuid": "65965488-cf26-49e9-8dd1-24212b4ca8a1", "comment": "Malware payload (Amadey)", "value": "0185cf43c972080e9b07ea73e533a9bdd2f003b64a0c21d44b6ddb00527609225f0d0a9217b34a1ea19c5f8f8ede8d8d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516317, "uuid": "da883c92-c757-4db8-a20b-7ed4770e3b45", "value": "T1F7B4F1DA25404833CF37C9B2D4DFF9964E7A71204B714BC3130D5AFA8E856E8A60B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516317, "uuid": "4eb114cf-b92a-4e86-b1df-55ebab4c734c", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516317, "uuid": "418a89d9-a00d-475f-b4b4-2bd7e6e0e575", "value": "12288:wkt4GTey5snlIB2G8DODCYVjjM3R40I7AfQJQmZ:wkt/Tey5sn82uDfmR40Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516317, "uuid": "cfeb4bb1-99dd-4ed4-8ffe-2c4d2b1874f6", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516317, "uuid": "426925ec-7b86-4d5c-8289-e83f64dcb4ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516317, "uuid": "32124c96-994e-4069-881f-51e154573a10", "value": "10abddb026c7c1b47f03932d8789387b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8df3e41-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516630, "uuid": "3f2f77ad-32e5-42e7-802a-b58eebfbb09c", "comment": "Malware payload (RedLineStealer)", "value": "4896b4340e46f8af45c989406726e4c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516630, "uuid": "b32df02d-3fe0-4345-b144-9b47c939ae81", "comment": "Malware payload (RedLineStealer)", "value": "cdced77db448a467f8b933bc58c95c82f0766f0c4f5bbe8da222f61cd4118673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516630, "uuid": "7b52f97e-470b-410c-88a0-240d27b0d450", "comment": "Malware payload (RedLineStealer)", "value": "28b8f3a68bdb2bb361a9eb23ee7bd3ef7d284e66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516630, "uuid": "510b58f3-e43b-4208-a083-e8d509475923", "comment": "Malware payload (RedLineStealer)", "value": "20573db14515a6ba974868dd333d0d7e3aeec1783d54a106b6b257565da594f1d5f9d3f9d02aa311b392c87c31a13281", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516630, "uuid": "c9d17677-9cbb-4742-9f1f-acead113c3c7", "value": "T126445CFB52D1D460DD0FA4B02C6EE1BDEE35B461DEA284CA19BA0952D3430E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516630, "uuid": "cfe52525-0dce-4087-9fca-af6226ed2ed1", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516630, "uuid": "b32b87f7-d939-452a-9523-8b323067db9e", "value": "6144:/BVRaigt0poiRG/XvLNUgYhuE22EQJQmp:/BVPgtAoiRG/fSvcQJQmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516630, "uuid": "407177c6-48a4-40d5-bd4a-6da0adc24257", "value": 275780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516630, "uuid": "de47dd34-8cee-4bee-a7c2-c7cd566fbf41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516630, "uuid": "77e87106-b11e-4c1b-a37f-a9f596a8c954", "value": "4896b4340e46f8af45c989406726e4c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f49946e-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500374, "uuid": "5e501c6d-68ce-4b32-851f-85eb538b5c30", "comment": "Malware payload (Amadey)", "value": "780e9afe07721f077d4c8f8d8d113242", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500374, "uuid": "72e8145e-f9ab-40ec-88cc-43491df39fd2", "comment": "Malware payload (Amadey)", "value": "ce572c5394ecd0c6e00dc2536be9b40911b12446577fcf745b969a45c1f03b62", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500374, "uuid": "7100bbc3-4f1b-438e-8992-d05e65e2859b", "comment": "Malware payload (Amadey)", "value": "1f109a1b5ff9870b4fb48dace636ffce4a1e773e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500374, "uuid": "88c88829-d411-4f55-80dd-559c2cbcedbb", "comment": "Malware payload (Amadey)", "value": "0bff8d71693c0af1d144d7633dc6da66a65d05f6f31be3569eb052975b9f239849241564b6d9a84bca69030cf43494ab", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500374, "uuid": "c063200a-0c9d-456c-b488-ded5780d36b6", "value": "T14EB4F1DA25404A73CF63C9B2D4EFADD64E76702207B24BC3130C9AF58D416D5A61BA3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500374, "uuid": "1bc90536-9cfa-4f7c-be8f-e6485ad11c78", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500374, "uuid": "17e84281-7aca-4c6a-a585-2d10aeb7013d", "value": "12288:yodUbTey5sZqskgPXtAJ7Ef88TnhMEI43aEUQJQmZ:yodaTey5sZ1kg6J7EftLiEjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500374, "uuid": "f2732342-2cdf-4848-baf3-542a4d377944", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500374, "uuid": "24595708-d1a8-4716-a7ae-70885f39ba64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500374, "uuid": "b5a6a40e-21f6-42f7-9e2e-cd40286e3c59", "value": "780e9afe07721f077d4c8f8d8d113242.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779e4930-11d9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687533620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533620, "uuid": "74503f29-aae4-4ed3-a5d4-5a2f67760f70", "comment": "Malware payload", "value": "f5cdff3a30c737644c91862d21b4e861", "object_relation": "md5", "Tag": [ { "name": "Discovery", "colour": "#B07610", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533620, "uuid": "dd64d76e-14f9-4b7b-a5b1-d2c25640cbe9", "comment": "Malware payload", "value": "cf34174392d422249a3b1c2a488709b3606143bf51acfa14ca53928051697331", "object_relation": "sha256", "Tag": [ { "name": "Discovery", "colour": "#B07610", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533620, "uuid": "08c3e98b-7a81-4245-960e-69402a3b258e", "comment": "Malware payload", "value": "872ab686a64a93bc020d29790fc05902026725c3", "object_relation": "sha1", "Tag": [ { "name": "Discovery", "colour": "#B07610", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687533620, "uuid": "9be7f580-1e29-4361-80e3-374629ddf7f7", "comment": "Malware payload", "value": "b36195ebdaf7e154a68ebbf3cbecf811429ce4245519ce1d4c1d6ad284dae9ae9f979156cbfe7473ec6ede0eb563c3b3", "object_relation": "sha3-384", "Tag": [ { "name": "Discovery", "colour": "#B07610", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533620, "uuid": "03c98b6f-a0de-4282-941d-26513a4a75d4", "value": "T1C6A62361F2567824E062BA355F11E07CC35A6D70BD23C19F12FE3D1F7BB4AA28E52462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533620, "uuid": "84ee61d0-a852-44f4-a058-a84a484cfcf2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533620, "uuid": "1e529e77-1047-4f84-b2b1-d48bc039b7c9", "value": "196608:7lHTXru20W7YB3I7YzJC72X25iDiHWeF4PdLM46OKFe:7lHPr0Wc3JcD5Qop4StO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687533620, "uuid": "40baa159-dd56-49ac-b122-2b06f30d4f03", "value": 9910544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687533620, "uuid": "38808d1c-e339-469c-a609-fd3c00abce02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687533620, "uuid": "42f368b9-9b51-4cfa-a4b4-a22b2821b82d", "value": "setup_SHXc5sNNw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5fa2d3-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501305, "uuid": "c25d7941-e6d1-490b-945d-7ceea8d396be", "comment": "Malware payload (RedLineStealer)", "value": "e859797b49b9adf9702432ad3d8b28cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501305, "uuid": "f9a6a040-e313-4915-9429-a192a93d98a0", "comment": "Malware payload (RedLineStealer)", "value": "cf4c6819cb838028383cb1778c8d53eb956d5017d6396f81a0929f66f78fc997", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501305, "uuid": "3106be4b-4df4-4641-8330-bfc5cc4bee5b", "comment": "Malware payload (RedLineStealer)", "value": "001577273e08d3820e2e44d93203a0c034aa2e32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501305, "uuid": "ab80af0d-9d06-48d5-af73-ed1831490c14", "comment": "Malware payload (RedLineStealer)", "value": "b2502c37ce9d4232fe3c0521728ef9373f1a2f6d090c0a5898770cd4a1fb01fe25bfbe726d7162152245123b1bcc12f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501305, "uuid": "156cdf08-fe75-48f5-9a66-669530dbaf66", "value": "T182B4F1CA22404573CF33C9B2D4EBE99B9E7A70210B7287C7130D49FA8E465D4E61B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501305, "uuid": "2f3ede50-a158-4822-9464-909f5d3abc0e", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501305, "uuid": "da294913-ad6f-4797-b97c-cc573e209487", "value": "12288:Y90ueorTey5sP50YtMxnm8ksIGzQIcCFsk3zfQJQmZ:u0uNTey5s2YtYYG7cCR3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501305, "uuid": "63eb1314-95e5-4a73-978a-21c2b03bb0ef", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501305, "uuid": "fd14a646-1296-4933-b7a5-19c5edbcd4b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501305, "uuid": "b3926b5f-d65e-42c8-962e-1c53bc85297f", "value": "e859797b49b9adf9702432ad3d8b28cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9857c9a-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500660, "uuid": "fc01b7d9-5789-4b75-8b8f-16f552787004", "comment": "Malware payload (RedLineStealer)", "value": "9f3b2811056cf7d47e33ffbaa05cf91f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500660, "uuid": "ff25a105-01c8-48a5-be1a-7ce5b688985a", "comment": "Malware payload (RedLineStealer)", "value": "cf547e19d5d496c3dcba6425d9768cb800c1cc3bf9768d24851387a7ca3ac3f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500660, "uuid": "ab74ec8b-e2d6-4085-a69a-3b6460de81b6", "comment": "Malware payload (RedLineStealer)", "value": "e556c4a38442aee02e8648974a298458e09993aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500660, "uuid": "4f53d2b7-af69-4976-8a4d-6c32496202ba", "comment": "Malware payload (RedLineStealer)", "value": "484e5a51c1ec932781c9c3da50c9442dbea4dcd3364de5fe1f7d985fc4634a8de0690f3314b1b489800d5d27726dbc7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500660, "uuid": "d067d611-be3b-4464-bf25-27f4bfc52aaa", "value": "T1EAB4F1CA26404573CF63CEF1D4EFE9D64EBAB12107B18BC7020D99F58E451E4A61B93A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500660, "uuid": "94ccb61d-d58e-4f52-921b-619c8e3521af", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500660, "uuid": "7d677644-cbb5-4547-8ed0-ac9a41d1ec0f", "value": "12288:u6oAvDTey5sZ0Wjnn99Q6NbDGF6bHYzqSeBa4OncQJQmZ:u6oAbTey5spnn99QyHD8D/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500660, "uuid": "2c8329a1-3e0e-4192-bc3e-8450021f3110", "value": 532800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500660, "uuid": "c5985898-d38d-4e47-a3c9-e88b56bd67d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500660, "uuid": "4869c046-e58f-409a-a714-bf35eda0fd2e", "value": "9f3b2811056cf7d47e33ffbaa05cf91f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6229e0-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500986, "uuid": "1c5901e3-e8fb-4218-88c6-d70c107a5081", "comment": "Malware payload (RedLineStealer)", "value": "cc2e9d9d915285aaa96fe162b58e0798", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500986, "uuid": "729d3ed0-4a5d-4e76-b39d-82d92d013daf", "comment": "Malware payload (RedLineStealer)", "value": "cfff8468bc868a0134f0f5dfaaec0579f9c9d7443afa014e633d2a2f6b266608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500986, "uuid": "02219fac-b85d-4838-841b-f1816a6ba4f6", "comment": "Malware payload (RedLineStealer)", "value": "e3b556506b3ff9329986f37c7180f82a664371cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500986, "uuid": "2363ce21-b4a6-4592-a345-259c7559c536", "comment": "Malware payload (RedLineStealer)", "value": "dcc76d633b09d313af53f3f13a4d0558b37a29456e239ec0b185cf8e9bdbaa1329b08bb650e57d3a57c6b585d631f3de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500986, "uuid": "cb361c28-9b78-41bc-9934-6065e578b907", "value": "T1F2B4F1CA21804673DF63DAF2D4EFE8DB4E7560210B658BC7131D8AF54F015D4A61BA3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500986, "uuid": "80823aae-181f-4956-8d7a-f1d1cd981685", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500986, "uuid": "fd393ac7-e80c-4df6-9f9e-c05414585230", "value": "12288:seJxJTey5s0bzSO5z7a0Lsucm+Q36O7oaOoEz30k9QJQmZ:seJPTey5s0SO5CGslm+yzoaOo+0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500986, "uuid": "c591d398-a550-4c94-b1ec-535a865496e4", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500986, "uuid": "a5d74c09-e671-454e-9b92-0b26c4338952", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500986, "uuid": "d710a6ab-0ef0-40a6-a87d-56d93bf866bd", "value": "cc2e9d9d915285aaa96fe162b58e0798.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c28ac4-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501291, "uuid": "95f41b35-88e6-4a12-8964-5d409bfc076f", "comment": "Malware payload (RedLineStealer)", "value": "dd0b999274460ef36e91f469afcd8aee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501291, "uuid": "6a26e829-0892-42bb-a161-74670bb00fb5", "comment": "Malware payload (RedLineStealer)", "value": "d24efa3772bb4dbc831de743ab83aa0dbc9288bee371ef9d12655d85750accf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501291, "uuid": "c080c7a1-4a4d-4fd3-87ce-3a720d355969", "comment": "Malware payload (RedLineStealer)", "value": "2bbfd2896584d5b477a64626ce337bbe91079017", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501291, "uuid": "9e02c10c-1ddc-48e0-bcf2-f6b3e97f5937", "comment": "Malware payload (RedLineStealer)", "value": "62b24931eef1d8739e98ebcac3d61abc2681eeb3eb535428b7e9c90d502f263054a8f8e529a89befaecd408b9ce78541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501291, "uuid": "5a21d3f5-156b-4686-9274-e22568ed68bb", "value": "T12EB4F1CA25404973DF23CEB1D4EFF9D60A7A70324BA587C7220C89FA8E152D4A51B57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501291, "uuid": "09c59089-0a46-4d16-8aca-982380419ade", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501291, "uuid": "650c92ae-f77c-4b96-8ae2-8b7becdd0de2", "value": "12288:EzkvJXTey5s6dZnR8FsH0EF6xNe8CZN/qQJQmZ:EzkvxTey5s6rnR8KH0E0xKNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501291, "uuid": "e23ce44d-3463-48e3-904f-1fc254d51dc3", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501291, "uuid": "77562717-f5e8-415e-a6eb-47ad97bae24d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501291, "uuid": "75c1ec94-4790-49f9-aa85-e3eee762168b", "value": "dd0b999274460ef36e91f469afcd8aee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f4d458-11b7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687519020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519020, "uuid": "d99f72f1-2afe-4377-953c-a38335349ca8", "comment": "Malware payload (Formbook)", "value": "77aa11300e110d3934f871a3820dbd12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519020, "uuid": "70e73f3c-20b5-4a40-bc3e-a21496bc2099", "comment": "Malware payload (Formbook)", "value": "d2f81e234482c1627b7e92601ef74dbc7f3726c64d963dc4655cf90ee54d63ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519020, "uuid": "cfa25eeb-59d5-4f13-80cd-d16a47a1a1f7", "comment": "Malware payload (Formbook)", "value": "889147e82d3e15e329cec7b841d249a69f11b4d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519020, "uuid": "eab20dc3-0500-4596-89e4-764cf4ae07df", "comment": "Malware payload (Formbook)", "value": "6814dd3dbc06eb7295a82224a47fd4cb426f66e3dd752ab44d712ed6fb914dc83681837e077c885bf8a7b324bb413260", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519020, "uuid": "7a693335-7386-4b07-a836-c8c295322455", "value": "T10554021473A4D567D99104306E79C7FEAABABE159CA85A8F33C07F5FB831122900D72B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519020, "uuid": "9403b97c-a0cd-4865-9a17-3989c83682da", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519020, "uuid": "a8deb217-0468-49c7-b8ff-4411700556ba", "value": "6144:AYa62toxg3z8y3kFyVacBNDyEqqzw7IBHObDXXf:AY0uxg3QNF8NuNaw7gwXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687519020, "uuid": "1dd3c9b4-5c15-4f24-8d54-45036c0ddced", "value": 285702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687519020, "uuid": "8e04c6b9-cd52-43b1-bb61-48644800a1a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519020, "uuid": "5b2c9a13-bd5e-4531-b3a2-84b71d9be74e", "value": "77aa11300e110d3934f871a3820dbd12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379820ce-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687510320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510320, "uuid": "cd5657c5-1a7a-4237-8786-2afa375e0e3e", "comment": "Malware payload (RedLineStealer)", "value": "69289890714c6077f7970cb162fab847", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510320, "uuid": "e177c0ab-8334-413c-9d36-8ce0e2531f10", "comment": "Malware payload (RedLineStealer)", "value": "d37bc60df4e5be305a8e4188b8776c9d2c71e42a87a0766e4ec4e442aaa1fd75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510320, "uuid": "47f47233-cfb2-4e70-82b7-3ce43c31a48a", "comment": "Malware payload (RedLineStealer)", "value": "795714bb010f613765a9e8148fa9f657da27670f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510320, "uuid": "8f58687c-bc23-460d-b4d7-e310df1de25c", "comment": "Malware payload (RedLineStealer)", "value": "79c1333ebc693d23eb4e04ed15e0fee5c8ba8c17699a854968aafbc1d9123736f53977cf865f6123902fd7efbf927f8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510320, "uuid": "67e90d2c-cdf0-4a79-a27f-608030f3813d", "value": "T1E4B4F1CA31400973CB63DDB2D4AFF9D64EBA70710BA24BC7120C59FA9E415E4A21B57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510320, "uuid": "f584c4c3-ea29-40bb-bb39-3bc069c85197", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510320, "uuid": "0bf2fd8c-4c7e-472a-b1c2-112b4e9173bc", "value": "12288:heMeJMnTey5sjfewcnlAHE5qTPIkLc4QJQmZ:heMeJqTey5sPe6Hq/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510320, "uuid": "b0fa600c-1348-4bb5-8dd1-5f81d98f7586", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510320, "uuid": "8e708aae-fdb8-4729-b4d2-1aa3be643fea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510320, "uuid": "0208aab0-f527-4f99-8d7b-25f3b8591745", "value": "69289890714c6077f7970cb162fab847.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d0bc41-11b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687518724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518724, "uuid": "5bdd2d5b-68c9-46ef-bc08-fe3e9b58a89c", "comment": "Malware payload (Amadey)", "value": "2ec6729af27fe11025c8d3733a3a3dac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518724, "uuid": "fd1f70b5-5bce-4e89-8a60-b97f3dec4da1", "comment": "Malware payload (Amadey)", "value": "d3f4b278827fd820686f490a7e2cc786a03ab04fabaa82cb6aab68e8ce949c1d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518724, "uuid": "70bb449a-80a4-42ee-9d79-77c1cdd50d2b", "comment": "Malware payload (Amadey)", "value": "7a9b43292640e4446cc2b2f0133e32ba8f21f25d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518724, "uuid": "3dd60bfa-1ad0-4c9b-95a7-1786dcd9bbf6", "comment": "Malware payload (Amadey)", "value": "8614fe551e86b5c79a821aba8112c90e105314151aaac259e2575289613b6af3ac4af4d0586b3087745d610527d36d0b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687518724, "uuid": "976fecfa-d514-4f0f-9ce5-35e22919e664", "value": "T12BE401C526804563CF73DDB2D8EFE8960EBA71210B714BC7230C4AFA4E512E4E55B93A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687518724, "uuid": "ab46be8f-5faa-43c3-b956-74f736f9a61a", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687518724, "uuid": "db8b6399-e7de-442c-99b5-753d9afb1ab2", "value": "12288:Rh+gQTey5sijexDkrBun2IMiRZRN/wutgLIDRNvCQQJQmZ:Rh+5Tey5sQGdMq7gLihy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687518724, "uuid": "00abac22-8108-4580-95ac-24290ae31ecc", "value": 713024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687518724, "uuid": "b7c0515d-ed52-4496-a382-b5318bcf7ece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687518724, "uuid": "b6086c36-6145-4a33-9d02-24fff842875a", "value": "2ec6729af27fe11025c8d3733a3a3dac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c085a99-1181-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687495832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687495832, "uuid": "4e3c4e0f-27b4-4649-b001-b6787a394a1b", "comment": "Malware payload (Quakbot)", "value": "12653b6dfffe0d2a79bd400886cb253a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687495832, "uuid": "02c8edb7-e302-4ceb-b118-2e7b79b177eb", "comment": "Malware payload (Quakbot)", "value": "d48706619b248bc9c1dc70357bb5e3f2ed906c255f63d7638a87fb27c5d5f017", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687495832, "uuid": "284f48fc-08fb-48c3-bc12-0d178b218421", "comment": "Malware payload (Quakbot)", "value": "e07de039dbbc3f7748b6b643ae6215b0eda9a72e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687495832, "uuid": "c521605c-4476-43c2-85df-43d8803447f5", "comment": "Malware payload (Quakbot)", "value": "73b50817c9913d5e472e4064c3d1f4fee76f34ff3eda3f5c23a5ea6a5724dd8c2c2d09a86a2f8f914af52b68a4623720", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687495832, "uuid": "4dafb374-d4e0-4d13-8f13-198cee177938", "value": "T1AD558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687495832, "uuid": "ff3d53a1-8c7e-4caf-b26e-e8155e661aa9", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687495832, "uuid": "444cda76-0e03-4e88-a325-4c71ec2b0705", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4yzQ:QbkS7XB1EsOSNPSp0EAt2bUeM4yzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687495832, "uuid": "db35ffaa-b482-421b-af49-915fa14ed539", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687495832, "uuid": "49452807-af18-4e9f-8443-388d553b8d6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687495832, "uuid": "0e771698-195d-409c-92d4-c980be31773b", "value": "2_qbot.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979a4251-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687499744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499744, "uuid": "03134549-430c-4f8a-8acc-5656c32c5e9f", "comment": "Malware payload (Amadey)", "value": "3c72bb86c4acb8fe39d2b88fa7d1af09", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499744, "uuid": "f8f4bf47-40d9-4c4e-a152-2217af80ccaa", "comment": "Malware payload (Amadey)", "value": "d51235931609c7daf9c245c03108920050e0943bf29cda17911d007a883b87f1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499744, "uuid": "e0997d4e-3346-44b5-aec0-d0a9f765e713", "comment": "Malware payload (Amadey)", "value": "b0569ad06c95dd53f3488d15138ae9f9fc036f81", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499744, "uuid": "52c59270-7d6c-40e5-9717-9eca9a23be1b", "comment": "Malware payload (Amadey)", "value": "1664babec2c2d69b3d1ad0f01bdac0c80bd7d3bf0f88290e0a2909477accb48bf20105e3e417e159262de9bb17e02c95", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499744, "uuid": "9388cc2b-0b8a-4021-aa29-0ead8e97970c", "value": "T106E401CA22404A73DF67C9F2C4EFE8D64B7970610B624787130C8AF58B115E9E61F97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499744, "uuid": "38e9fe73-022c-4dbf-b8a3-cb9cefd04830", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499744, "uuid": "72c65e1b-d6ca-4d27-8735-1dbb8f2908bc", "value": "12288:4ktZ8Tey5sR7xaB0jr2OUQqQuwubdEwKvsgR/dmRPfYq6FEooFE+QJQmZ:4ktuTey5sRz6QuwQ0s21mPfYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499744, "uuid": "c16b0803-327d-4e10-9022-47475f19397f", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499744, "uuid": "58785255-ebf2-4220-acd1-299943d95ebd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499744, "uuid": "e0b50fe5-34ed-418b-8241-f2a2b0e55395", "value": "3c72bb86c4acb8fe39d2b88fa7d1af09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c5e41f-1196-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687505029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687505029, "uuid": "7c020583-0153-4f5e-9009-1d1ae43dcfd4", "comment": "Malware payload (AgentTesla)", "value": "1cca456fe3abe95c447b86e3a86eefd9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687505029, "uuid": "68a5b9b3-bbd2-4a9f-ab82-5d12abeb3256", "comment": "Malware payload (AgentTesla)", "value": "d53118397cd7dbd982acbf2b19245c70d8b1b5c1331acefc540d38c347865c55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687505029, "uuid": "821d5eb1-3a53-4109-ac5c-62a3f4fe16fc", "comment": "Malware payload (AgentTesla)", "value": "21a62de14a6b835bddd61aa52dd25be1972781db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687505029, "uuid": "2bda6f25-64fc-4f18-8942-f9a963b664ce", "comment": "Malware payload (AgentTesla)", "value": "ec543b4b170f467ba5b7dc8cf64c42d01d7545853b3ae23e50d06d8fc70525143b9062cd7fcdbcdc45fa6598db5430c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687505029, "uuid": "fd10fc8b-762e-4751-a556-51db05c1a9ad", "value": "T14D15236622901A4DF57F2AF971B4C110C3F56A84A312E73E5EFA31E91972F029E47B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687505029, "uuid": "cd17320c-42df-42bd-9fed-7bedbc3b3faa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687505029, "uuid": "34ad7c02-41b1-4c0d-860b-33c94aaa08c6", "value": "12288:f2iNG4/mNUA8mFENW1G51pKFtrbmxcD5DqGDoA94ZkMUNFe2ADsai9qVlrYu3dcb:f1M4/QUDIApw2eDrDiv2Wh5xTWKFuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687505029, "uuid": "aa745971-e326-44ae-a9ea-71f27e769ec5", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687505029, "uuid": "2e84bca8-fa90-42c2-8335-dabd28ddc9f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687505029, "uuid": "ccbf1e13-372b-4533-b709-ff060f883f65", "value": "UPDATED STATEMENT OF ACCOUNT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65aa52e5-1192-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687503096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503096, "uuid": "c502d508-b6e8-4aad-b5d4-1c9d617c587e", "comment": "Malware payload (RedLineStealer)", "value": "b720d3150f676c36e60b759052f20760", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503096, "uuid": "cd82b6f8-6590-47af-ae93-c3ec41d7b396", "comment": "Malware payload (RedLineStealer)", "value": "d54f3bdadb94c4674cd01037f860825cdb26a1e4fe062a7bf5182b732f9e0994", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503096, "uuid": "8cfd5c4b-488e-4985-88f6-5f04dbaf5ba9", "comment": "Malware payload (RedLineStealer)", "value": "89627a9c13b741f3cdd8e48b0284c54d4df5fd2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503096, "uuid": "6ec3d76a-8633-49bd-84d0-0618a9ae0039", "comment": "Malware payload (RedLineStealer)", "value": "b3f7a98fb1dfb36fa7cf5960413d9fe76b57a25c47a350e6d919dc1e8364558b4b4c903b931aaa54f3b917befca10dea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503096, "uuid": "983fdd22-e341-450b-b728-fe7cb72b45f1", "value": "T1E4B4F1CA25408A73CF33CEB1D8EFEDD64EB9713107614BC7120D95F98A151E4A21BA7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503096, "uuid": "fa02fdb2-8ab3-4efc-bc3b-918708d681fb", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503096, "uuid": "e87cae46-b04e-442c-ba7f-bebcae1a5b62", "value": "12288:fk71LTey5sSm5NkTi2MdTpd9WD6O5UO/gQJQmZ:fk7JTey5sSm5kMdTpqX5UOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687503096, "uuid": "a52a29ad-5cf9-48f4-add6-fb5cfddf3672", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687503096, "uuid": "c2171736-f139-43df-aa26-2242a613ec44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503096, "uuid": "a25b3bff-1f18-472f-a226-66c4494658a4", "value": "b720d3150f676c36e60b759052f20760.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99cf43a7-11a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687510914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510914, "uuid": "8468d503-54a6-4f26-9fff-85c2b6d8c255", "comment": "Malware payload (RedLineStealer)", "value": "57c18d2ead6ef3abb93347e54dfbfdf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510914, "uuid": "505ce771-7f75-42fd-97a2-213f43129799", "comment": "Malware payload (RedLineStealer)", "value": "d72a1d909fba4ec2aa3cb2f7246968958c0c0b9eafcd47fab109e13aa5747be0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510914, "uuid": "9a36591f-60ac-4d8d-8b96-5e3e6e4a6464", "comment": "Malware payload (RedLineStealer)", "value": "249158174ec91026e5955740389c86d88004a3d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510914, "uuid": "838e2316-5d84-417a-9b20-71263354de86", "comment": "Malware payload (RedLineStealer)", "value": "d99c8cdde73b49793fc4c369ed345141117b1da07480a49215f68b84b484ea1fbc08eee7c8551176dfdeb6f318307572", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510914, "uuid": "20452227-99dc-4f7b-9772-8e81bc79134b", "value": "T197E402CA72400873CF27CEB298EFADD65E78B1210B754BCB130D65F54E126D4A60B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510914, "uuid": "c7b19cbc-0f03-40d8-9847-583d5df15a9e", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510914, "uuid": "12eed0b2-46ab-4c1a-bdba-013948c2e6d6", "value": "12288:ieeDcTey5sYsLHtr/Tttxtkc7qweQIrmwlJ+TrXoxln1z327hLZwQJQmZ:ieeITey5s1LHZ/Tttx2c1eQIEXoln1bA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510914, "uuid": "0953ebb2-859e-4e21-a3dd-3c441cb0b716", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510914, "uuid": "413b1476-2b17-4ce8-868f-b42c7f04eeb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510914, "uuid": "f2ac0bb8-d3ed-45e2-b686-a11cfa236306", "value": "57c18d2ead6ef3abb93347e54dfbfdf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4a1d37-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687510331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510331, "uuid": "c3ff2e38-4665-485e-8689-c6546ef90b0d", "comment": "Malware payload (Amadey)", "value": "f374f352664a8485e75c6d6194988ca6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510331, "uuid": "88319203-64c1-4034-9cfc-17643d294d27", "comment": "Malware payload (Amadey)", "value": "d73942f809904f969e250ff6d7ce60739d751bf88f0e7114f44bc8acf4198422", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510331, "uuid": "4bfc6d75-45e9-43b2-94dd-ad2f0ae99f86", "comment": "Malware payload (Amadey)", "value": "14f50bbe5f0df60aa043792627a7e764ead890ab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510331, "uuid": "35dfa721-8498-4b0a-9e2a-87dc9efa9a62", "comment": "Malware payload (Amadey)", "value": "5158def3a723b4c1287589d3d38c5ce7196277b293a33af5c3b84d5f4349d2ccece8d6c2ec60c184905abc6621a441f9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510331, "uuid": "95964204-79e0-4175-a578-496ebec2c2d2", "value": "T186B4F1CA21404973CF67DDF2D4EBE9C68FB671210B718A87130D86F54E091E4A61B67E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510331, "uuid": "80a9a9d8-ccb1-46c8-9826-bc8dd829e3aa", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510331, "uuid": "b538a244-96e7-4a9c-bd15-ab7c149eef50", "value": "12288:tCas9VTey5s46U4PXb1EXxXaDFz5b5QJQmZ:tCasvTey5sy4PXb+BKZz5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510331, "uuid": "19b90c51-4d10-4b30-b841-a624cbde584d", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510331, "uuid": "1d44b9c2-cd88-4cb6-9085-72939c63cd7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510331, "uuid": "648a9e1d-fcf2-4eaf-b358-d9125eb8f0fe", "value": "f374f352664a8485e75c6d6194988ca6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f20c59-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687510324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510324, "uuid": "192afd30-c674-4ad7-8462-0e3eef1c1ae4", "comment": "Malware payload (Amadey)", "value": "e603831dc6aea1d276a23844517e85aa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510324, "uuid": "201ee412-8b64-4a55-9b5f-98c805409282", "comment": "Malware payload (Amadey)", "value": "d7bff57cb0668411b55ead6b614d4360a9d5ca6bc396ddbe6098616b963f528f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510324, "uuid": "cf9eb825-a767-4684-85d6-d1b1c0465b28", "comment": "Malware payload (Amadey)", "value": "cfa782f68ad5a5ea2be8e6518bec50d1c67a4512", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510324, "uuid": "ac20c60a-20eb-4469-9a48-78ba5c5558b4", "comment": "Malware payload (Amadey)", "value": "ed10d5f9ba22aa233f98b6ca45cda9e2cadc125492a56fa8c6c4c25b438a6997926bfa6765dc5c217c1713f78a572e7b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510324, "uuid": "8912e281-5d5b-4763-bf05-6b20d9d23eea", "value": "T12BB4F1CA21404977CF33D9B2D4DFECD74A7A71200B758BC7230C9AF98A455E4A21B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510324, "uuid": "2ead6dab-a480-4128-a477-9da1d397a12d", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510324, "uuid": "fb67d790-7e08-400f-ad54-72e9535277da", "value": "12288:KEAZ+HTey5s0jFrFwe0B4w2I2IEqwGjdJrhfC6q9/yQJQmZ:KEAuTey5ss/ZWRjHk6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510324, "uuid": "8e95d7f0-e2f2-4032-a409-bbbbbd100d46", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510324, "uuid": "f9b4b709-5849-4cb0-b228-92a24e5559ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510324, "uuid": "bb44c274-3ce1-48e4-b37c-3f8d05bed200", "value": "e603831dc6aea1d276a23844517e85aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5fc898-11bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687522408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522408, "uuid": "1f2ae5e6-c447-4f00-975f-7898d6fa5619", "comment": "Malware payload (AgentTesla)", "value": "162e82db2fef25d2260f56ffaff75aff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522408, "uuid": "17335386-22e3-44cd-8af2-4c959fd265e0", "comment": "Malware payload (AgentTesla)", "value": "d7e0b7858aa72468917565c8661068670da4707a87b10387ca9c31604f908003", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522408, "uuid": "acadfa4f-bd8a-4eb4-8977-0bb946ed9677", "comment": "Malware payload (AgentTesla)", "value": "9ba487b6937194ed1a4d4b678aec0b584d5f9375", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522408, "uuid": "7bd97eed-35e6-46f9-93e5-91e23d3e9f74", "comment": "Malware payload (AgentTesla)", "value": "1b906f89628df1c38da7431fcad66b12d350d5b86849946f419fefa7d906078883cbc21492ea116ea1958ccab0045cf5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522408, "uuid": "acd02f0b-2009-45e4-b364-4b24d24b0b40", "value": "T13FD423186604BD2BE5B65C7A28969214B3B6A2613366C3CE7DC7307A1FD3FC425139CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522408, "uuid": "754fce8a-17b8-47f3-b774-d4eaeb65b2a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522408, "uuid": "fce8dbba-81ca-4d78-b66e-5573403320e5", "value": "12288:OwK54/mNUAZdM5sLd3iGjF5e3/GdVlsMRPV544chvzAJV:rK54/QUodMG5iGjF5Q/Gdne4clzAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687522408, "uuid": "45c36b62-ad1c-4228-9b91-651145a53b62", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687522408, "uuid": "e1a0ba77-3fae-4072-89da-22edb943c32c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522408, "uuid": "496e7937-8bc6-4ec7-ba91-5900d34d7249", "value": "z1RC_DEVUELTO.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48b74ba-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501591, "uuid": "a21bae03-b059-4014-abcf-679151401812", "comment": "Malware payload (RedLineStealer)", "value": "fdeddbfd44cafc4d469327ba56ab981d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501591, "uuid": "2d3877a4-30ba-438b-9d72-9f58a15815db", "comment": "Malware payload (RedLineStealer)", "value": "d82266802bb2a1760f8399f2447f790fbf3f2b88ffc54f10d980d9f46c836d4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501591, "uuid": "f4dac1d0-1cf0-423f-9d5b-cf85bda55046", "comment": "Malware payload (RedLineStealer)", "value": "5c7286f311716e1eeba109448d1f972ad8a16566", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501591, "uuid": "989c44f7-a27b-4806-b7ff-6be17dc8a369", "comment": "Malware payload (RedLineStealer)", "value": "e519f23f33b18795bb8aa049b24a89ee6adea476ff5cebef056583b862ac7ab65eded487be4c9061bc91c98d64e35b09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501591, "uuid": "8c4dd3d3-982c-4bc2-a12c-b21f16163811", "value": "T1F1B4F1CA65404573CF33CEF1D4AFE8C60E7971214B624787230D8AF69E092D5A61BA7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501591, "uuid": "7cfdbaec-2c41-44b3-a4c4-7b3ba7ab9a22", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501591, "uuid": "0fc73dca-0d10-4691-9608-8573d8c59155", "value": "12288:jO0ueDXTey5srDVgPKu314a1sFohikQJQmZ:jO0uMTey5srDV5u317syQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501591, "uuid": "c2ccdbb1-0f96-4587-a25b-1a9651b7d188", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501591, "uuid": "73d67b79-5326-424f-ba9d-3a321ed4955f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501591, "uuid": "39a0c82c-3075-4b75-9e7a-654329d93a60", "value": "fdeddbfd44cafc4d469327ba56ab981d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7d4ee9-1195-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687504320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504320, "uuid": "d8721932-0e36-4e2b-9866-78ab8ce26823", "comment": "Malware payload (AgentTesla)", "value": "7971a58112c57216493a09a73aa7ab33", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504320, "uuid": "cc4aebdc-97a4-4e9d-b3bd-f0c6f5495e20", "comment": "Malware payload (AgentTesla)", "value": "d980e63aca1d5bca1c99005983515493948ced946e6d6f5068c58a255b966d8e", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504320, "uuid": "c15b7dc9-909c-45ae-9c30-1b088b367b00", "comment": "Malware payload (AgentTesla)", "value": "3d6b1d813d9655e9e6e7cba5f66474f3e2d0490e", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504320, "uuid": "9d55068e-9611-4b70-ab4d-2a30c8936de0", "comment": "Malware payload (AgentTesla)", "value": "7ec5a90f0cc737ce0884c28b2231149c8f0d55332b37a078051c6e7806f6196be783deaa9d80ebcd722eb88b1c847479", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504320, "uuid": "5b1b36f1-5731-4b36-a065-21760fd10c77", "value": "T1EFC42366D7A25DCCD845182E43EB74A204CC575B4FF6BB1162AF27EDA90018AD4FC83E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504320, "uuid": "f1575c5c-350c-4a97-84b8-844e9ed8abb4", "value": "12288:AFyQAHw9n9vVqwAcqIKXzfRyhKNSwpeQOL66vrRIj8pd6m:MyQkY9dqwaD4kB3O1v1sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687504320, "uuid": "b6ecab47-561b-4ec4-820a-40fd9af4b27f", "value": 591727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687504320, "uuid": "bc44e052-011e-4824-a28c-9ebc9da52a51", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504320, "uuid": "2a4d3e50-e655-4379-9fdd-5dc021ed7559", "value": "SOA 6009832115.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54810f62-11ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687520247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520247, "uuid": "d35602b7-ed40-4b65-b8a7-9025c65dd73b", "comment": "Malware payload (SnakeKeylogger)", "value": "a80b9647159ee7728cb9679a47239394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520247, "uuid": "49114b10-21e8-40cf-b7b2-76b017aca040", "comment": "Malware payload (SnakeKeylogger)", "value": "daf433d661a76fcc59f07b197f43ae9ff2f26f85c3b18b8feb4c6460432ff693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520247, "uuid": "29166afb-5495-47ac-a82f-78f28eaf831b", "comment": "Malware payload (SnakeKeylogger)", "value": "ddd63c8bfd3a2b2a23468450aacf44de0af7d156", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520247, "uuid": "a00bbcdc-7c1d-47cc-af64-b841f6d66ef9", "comment": "Malware payload (SnakeKeylogger)", "value": "d39baf16078d4fe7ba609f52844aeeac6b269bb268a38c613cf215a708c1dcdfe75793e69d05affccddda792c0e48a1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520247, "uuid": "22cf8462-6c53-47c9-bfb5-ba18567ec5e0", "value": "T1C205E0243ABD0F56E47D97F84051B63417BA6A6A783ED3194ED3F0CB1A92F410A91F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520247, "uuid": "e73798b7-6529-4339-ac13-9d54a99c394b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520247, "uuid": "94e16146-5bc7-4d0b-b987-09dfc7606803", "value": "12288:ANcXTYtYq7J3At5iHOq+ZQuMmdrniCBn35YJepao+MBu1lAT7AAYXaOpY5nF:tQYqtm8OqK/zi45NgBM/QBpyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520247, "uuid": "83fc9a9a-8ddf-4290-958a-02516e693054", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520247, "uuid": "a1828d58-df94-4c43-a04a-dc4267071424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520247, "uuid": "af42a1c9-6f43-4282-86f6-fc151a61f1fb", "value": "a80b9647159ee7728cb9679a47239394.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f4aab7-11bf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687522335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522335, "uuid": "fb1b7e7a-0b34-490f-be7c-af0a08d32e06", "comment": "Malware payload (RedLineStealer)", "value": "51e17eff946d6c8e030ea9efb5fdd82d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522335, "uuid": "039ad7d9-3e7f-4bc4-a7fe-c5b56955bf81", "comment": "Malware payload (RedLineStealer)", "value": "dba2f671a33be28c6ec1096001df28c4be4ba70d413c7d293bdc511701a8997a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522335, "uuid": "9b253ba1-d35e-4093-a385-6d49e838de7f", "comment": "Malware payload (RedLineStealer)", "value": "8a460cec99fb31eb3c78e69294f207dfc1025dce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687522335, "uuid": "57e53470-5b7e-4d90-aa31-e69bb10e3d48", "comment": "Malware payload (RedLineStealer)", "value": "4659e8e88b38209489e67129b7ce00131460e321fdb28bbcaed61f7977a02a85d0a36c4b603e5d0d52ce4dc5c49c2270", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522335, "uuid": "0f694e3b-cd88-4968-bca4-57ec8ac0cd1a", "value": "T113B4F1C9248049B3DF63D8F2D4EFE9D78E7A71200B7247C7120D5AF68E412E5A61B53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522335, "uuid": "a36ca6ff-b971-4876-afbe-4d43da8f0af2", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522335, "uuid": "dc4e1b8f-223e-40f2-8bd3-4e4039604d7b", "value": "12288:uxEGdTey5sZCupa0/XKbuDdYTMxMnHGLNfGgQEFLQJQmZ:uxESTey5sZCULfdniHcUgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687522335, "uuid": "36335377-8d85-4492-8e1c-28b62c0be032", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687522335, "uuid": "460eecd4-d05f-469f-9a21-da383f5037d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687522335, "uuid": "5379402e-fc79-43db-8cb6-20ca2067955b", "value": "51e17eff946d6c8e030ea9efb5fdd82d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b74edd-11fc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687548871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548871, "uuid": "02057203-01d7-4914-a0fe-a45a34516339", "comment": "Malware payload", "value": "fc61fff7a1e428ee6300734a8b39b2e0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548871, "uuid": "a32ff21c-5b59-4ad8-9da0-687a7d031ec3", "comment": "Malware payload", "value": "dbc198139b9f4ecbe0170b51d2e802873ac2e98db5d0f8fef6913c2f01e82e41", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548871, "uuid": "b445c632-74e5-4a29-bfff-d422106ee113", "comment": "Malware payload", "value": "0d4d1240ec4770e219bc3bdc75d08598c859f69c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548871, "uuid": "2e1df631-f8f8-4b64-8873-4b22725ce51e", "comment": "Malware payload", "value": "d17710a6a4319b6eeb07fe92c680f3cb536db13e713db29cacac6d203f837a982b735609eff5f97e1b5303055f81c6cb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548871, "uuid": "7f215966-04d8-4dc4-b9cb-473792c16ba7", "value": "T18774496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548871, "uuid": "2a13bae1-65e3-4456-b77a-c1a0c88d67fb", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593u:fIS1xba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687548871, "uuid": "27de1bbe-e7fc-4e39-a179-169e6e73569e", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687548871, "uuid": "72841ec5-0f42-46f7-a00d-d3429a4fb7f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548871, "uuid": "d8e51c79-4a5b-4755-97e5-9278c22cfbed", "value": "BSN-156827915.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49496105-11cf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687529248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687529248, "uuid": "66fa6814-bd18-493f-bbbe-2004e2a3fdd3", "comment": "Malware payload (RedLineStealer)", "value": "761576b1d4db73ff58386448026c2196", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687529248, "uuid": "85bc094d-f712-4c19-ac7b-b2578e65c767", "comment": "Malware payload (RedLineStealer)", "value": "dbf6e7e60a6cee6e45fc9a604fce7b2827bf81ea3ac5b29922b35a584ded5fa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687529248, "uuid": "842e9a7e-b646-4654-b493-4c2206efb238", "comment": "Malware payload (RedLineStealer)", "value": "93cd0176a9f8d159808da0004ec78907761f1d8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687529248, "uuid": "a1d8f51d-d295-42ec-8397-0381881d1132", "comment": "Malware payload (RedLineStealer)", "value": "aa4a6e35414a5716995941a3d2c23da1926762ed11d3504e0f04bf1e495a49799ee5e07fc469f1b43bee20f2603cba39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687529248, "uuid": "515f5731-a105-4a74-be37-b33453f533cf", "value": "T1A93611392280DC33DBDB3371D4A3816F89082A31A6EFB48D573B4DEE25AB8BDC565544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687529248, "uuid": "a2f7bbc7-c029-43b6-9cf4-1ca1a95859e1", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687529248, "uuid": "2f544388-5c4c-443f-a2c9-66abcfe4fdd3", "value": "98304:1ogzLbi+pg5PJpgWtRa1wg49ItLAQXi2mpAtj3j9lXGrKLiNFCa3HISYaZSWBJgf:17ePJRy1wg4n7mjzQb73JYIpBJgQYU9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687529248, "uuid": "074fee9e-0d73-40a1-983e-75e48c53a1fe", "value": 5196800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687529248, "uuid": "cfdeb620-a79a-45c4-8a4c-fa277e9281aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687529248, "uuid": "06951b49-ee48-4295-8919-11f38758e38d", "value": "761576b1d4db73ff58386448026c2196.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e318b0e0-11c6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687525640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525640, "uuid": "1bae04e1-4a3e-481a-acf8-116ca9b897fe", "comment": "Malware payload (RedLineStealer)", "value": "317fb67ffb2e25972a33133a6b1baf41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525640, "uuid": "bfcab382-d7a2-4c5a-a74d-39f1ebfc37b2", "comment": "Malware payload (RedLineStealer)", "value": "dcfd356a600928a1421b8cecf48cdb1b9dab2adc29a92600cb6e1651ee83bcdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525640, "uuid": "0d65aeff-8ac9-4c79-9f8b-0886f0bfcbb0", "comment": "Malware payload (RedLineStealer)", "value": "87206fe09815a6b8dbdc4e6eba9dc2c0cb80bdb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525640, "uuid": "c4e25a88-ea36-466b-8256-8c160e4dd317", "comment": "Malware payload (RedLineStealer)", "value": "e46f09e25192ae7238ffcc08669320c68430fa5c6caf74a858a665be352fc84b9dfca2f8d983e0410a01c9dd379892fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525640, "uuid": "6db39b5e-29c5-47b3-8c93-9d13b286aad8", "value": "T149B401CA61404573CF63CCB1D8EFED968F7A70210BB14BC7220D89F64A456E8A51B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525640, "uuid": "45b9cd5a-4d75-4c76-aefe-cbf833b0ecf1", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525640, "uuid": "3a09048b-1619-4506-a8bc-b3cf31b1b77c", "value": "12288:Akv9ETey5sxiggaEgpCwfHGgS5nV/qyCe86QJQmZ:AkvOTey5sIg3oAGZ3/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687525640, "uuid": "a4df051d-44ca-4c70-949e-a4a2f2944a13", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687525640, "uuid": "f70f3a01-091e-4d94-8488-59d663e251d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525640, "uuid": "f2c14ad4-414a-4de8-a4e3-1ee0009cff85", "value": "317fb67ffb2e25972a33133a6b1baf41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473c62da-11d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687532251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532251, "uuid": "15f4d046-1c83-45a7-a501-68c4a9a4d630", "comment": "Malware payload (RedLineStealer)", "value": "9f885f80746d4c0ec409c9450dc9bcf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532251, "uuid": "b5d91916-f7ab-4f0c-beeb-b480bb9e7917", "comment": "Malware payload (RedLineStealer)", "value": "df91d65bcb4ff7ad70cc2364d1e384d64bc1bf7da0c081e754f8c5fc6805ee54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532251, "uuid": "6a9eee11-24f2-4d95-9337-7cb64d26dc4f", "comment": "Malware payload (RedLineStealer)", "value": "ee32a0cc3c4758167dc0c32e664b148ac62ced5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532251, "uuid": "ca96ab3f-9019-4756-9cba-f31c8444e9e5", "comment": "Malware payload (RedLineStealer)", "value": "7fa0a5354d32ca0fcba649f29fd7ce6dd16742cd379d869e74e8e6f0cbf1c1b45ffe0f958ae81b79bf898b0ed977f109", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532251, "uuid": "6bc8e32b-514c-4d24-8288-0c248ffc9586", "value": "T1521612792240D57BD3D364B1E483905F1C2969B1AACFB5897387CDE61AA36BCC4B4BC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532251, "uuid": "158b1baa-1ed4-4740-addb-8f3a7cb2a0ff", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532251, "uuid": "57602f44-c627-4452-b251-5dd596fc69e8", "value": "98304:/GYBK/YlNfvgYZz5w5dkR/Zcw4PhaVYw162jsKsuVMjPEuhG+MCjaOp+o0GgGQA8:/ns/YlJZze5dqyaVt6RPiwWM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687532251, "uuid": "290195c9-3066-433c-a3d1-18047f79e6ed", "value": 4121088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687532251, "uuid": "85cc38f0-1b15-4870-84da-df64e3294d68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532251, "uuid": "e1401d40-4418-4129-9512-804aefb5c51c", "value": "9f885f80746d4c0ec409c9450dc9bcf1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1df4c52-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499761, "uuid": "d09da0a3-1903-4774-84d4-f6107f788e2e", "comment": "Malware payload (RedLineStealer)", "value": "4ade533d4870631cd5baf78cf86b7159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499761, "uuid": "a3cd3465-6b54-45ca-8050-31d601fa4bec", "comment": "Malware payload (RedLineStealer)", "value": "e0b2cafdd386e15867c61250e113b1775aa57a93ef32ff2c852f011fdb3aaf1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499761, "uuid": "86f2fea7-5c83-47fc-a98b-a0d2d824be12", "comment": "Malware payload (RedLineStealer)", "value": "62f4a1660d39565b0c11b0cc90797077580bfaf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499761, "uuid": "1db5229f-2638-4a9e-80bc-dfa1f4c54a3a", "comment": "Malware payload (RedLineStealer)", "value": "205f45e8f1e2f633912e64c40b984a68cdd338c8b42f5bdc9bf4cbf5e3a32604b87e9fa69687f1a01a8f969271eb7012", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499761, "uuid": "777eef0c-c136-4203-b181-40453129423a", "value": "T148B4F1CA65904973DF33CDB1C8EFE9D74EBAB0310BA14787120C99F54E452E4A61B93A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499761, "uuid": "f79162f4-a5b4-4532-bfb0-07dd91fc3022", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499761, "uuid": "d45bce70-9b83-4218-88a6-ef1ab4a42fb1", "value": "12288:Q5UdljTey5swwNw7lPu+qAbCbUS8bHBjRzCTxrAj8zRoQJQmZ:yUd5Tey5swyGlj+br8bhjRzClEjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499761, "uuid": "521a37a4-65de-47d3-8e72-3b40944e537d", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499761, "uuid": "de39a2d4-b98f-4a28-99d9-8e6bd38ea2eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499761, "uuid": "cef6bd8a-a5ab-42e5-bd36-98735be0790a", "value": "4ade533d4870631cd5baf78cf86b7159.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ef7027-11c6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687525460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525460, "uuid": "10f66fc2-5849-4e1b-985b-7b0092f8e804", "comment": "Malware payload (AgentTesla)", "value": "0d9df577e2142feb1487c604a28fbcac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525460, "uuid": "77930ad5-b846-4200-83d5-58bf7149272a", "comment": "Malware payload (AgentTesla)", "value": "e296cfcf5cf08aaf033f3f8d30073bce7d8e7d895527df2e5110325e69dcde66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525460, "uuid": "e2b0b6ce-d310-45fb-a5ba-202b69d43428", "comment": "Malware payload (AgentTesla)", "value": "53122d31fdf6db76fc85b535172d1ac46dcff7cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687525460, "uuid": "fa8b37f4-1992-45b9-98ab-25ef12b09968", "comment": "Malware payload (AgentTesla)", "value": "6b9afb3ef29e862830bedb93a4d49fec7ad9a7e27258c8c59ced4e7c5edfa71ce7477154f607b6e7bb1b3a7837f4143b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525460, "uuid": "8ba08d26-1cb6-4818-85c0-4a3014b25e30", "value": "T14EC41211B2AC8A63D57D8DF7941266090F7A32579568F7DD9CC234DA0AFCF8202D1E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525460, "uuid": "3112eeb2-5c5d-4a5e-8e52-67567fbb921e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525460, "uuid": "a7727a50-469f-4097-abc9-276eaab4a504", "value": "12288:+w/oep1bt6OWpi3ddfuQjYJ5ICmtnxOzsk+g3:+WoU8OtjO5IlJQzsk+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687525460, "uuid": "47c3a8f3-b7bb-4265-8dab-5fbfaa9d40a6", "value": 590336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687525460, "uuid": "2ca60bf0-af3e-4b28-964f-28a33b67ba20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687525460, "uuid": "d9d3ec64-1f2f-474a-937c-33549afca4ef", "value": "rScanned_CORREC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e37f2c-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687501274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501274, "uuid": "f51426c0-2384-4249-8ec9-0f22b273084a", "comment": "Malware payload (Amadey)", "value": "dc2e15baff99d563f45ccc183c750309", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501274, "uuid": "fefcb28e-293f-41fe-b7aa-8d1c1c3d7d3f", "comment": "Malware payload (Amadey)", "value": "e2a4a0ff2c8d7579f71a83e9cabc38dc91f9c8936c8c78f64310390d7c8d2d68", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501274, "uuid": "95217bee-1bde-454f-8dea-839f1c3e5d30", "comment": "Malware payload (Amadey)", "value": "ed8f41b3cd17f677250cee38715635649e4a28a9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501274, "uuid": "59cf1135-99d3-4634-a971-e6ec86130bc7", "comment": "Malware payload (Amadey)", "value": "2068ed37bb70dfbc859544fc1bc2fbf7243e01ba4308bd83161e9c99522d3f7a229c804420f804955dd95792e7bc8d28", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501274, "uuid": "7581e19e-450a-490c-bc42-3997a13146e1", "value": "T192B4F1CA76408533CF73CDF1D4EFEDDA8EBA70210765478B120C9AF68A051E4A51B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501274, "uuid": "1c578fc8-1792-4641-adc1-ac069a26f492", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501274, "uuid": "b55898af-71bd-4358-abe3-d3ea98fdc0f9", "value": "12288:YBV6DTey5sRPJv+Gc3afXl35S9ZAX4OvTY5QJQmZ:YBVwTey5sPLcUSMRvTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501274, "uuid": "faf5e6b8-fe2a-4742-b116-608b7c7edbb4", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501274, "uuid": "0ba25f50-ce93-4ab3-a083-936ea49c9f02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501274, "uuid": "087160e2-4aa9-4c8f-80f5-802e24007d57", "value": "dc2e15baff99d563f45ccc183c750309.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7173e2-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687516641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516641, "uuid": "3e34f00d-61fb-42d3-8955-dbc61d2e1da3", "comment": "Malware payload (Amadey)", "value": "ee6014f6187843b0c30ac538a5ec52fa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516641, "uuid": "635b665f-83a4-4c94-8e88-31f66982c2f4", "comment": "Malware payload (Amadey)", "value": "e312cc6b47e46ab2e4ed6612d03b4da743744892ff3e4da1908022903cd2c757", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516641, "uuid": "67ec3905-3bf8-4c10-8c8c-4c48beb905b8", "comment": "Malware payload (Amadey)", "value": "fb6fb0d6f42adad488b0217105ea3c5a14f506d6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516641, "uuid": "d4efd102-aa2b-4ad0-b035-4fa37d4f7084", "comment": "Malware payload (Amadey)", "value": "c3b87092febc4622dabf98e27b872497e712aff0cc76ff274f61537af461e5eccfbc01e9e17ec109594984014da90ef9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516641, "uuid": "5a2d4e9d-0ea5-475b-aec4-89deba7ab9ff", "value": "T1A8B4F1CA21408673CF77DDB2C4EFED971F7A702107610BC3120D8AFA4A552D4A61BA7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516641, "uuid": "2ddf4390-15fb-438f-8a68-c39c0fb5d2e1", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516641, "uuid": "dd996713-ac1c-4cf8-9d0d-25b31a21e224", "value": "12288:Qh+9HTey5sTx0SfwPxxMvuJqdS6auW+arjQJQmZ:Qh+NTey5sT5fwZxMvubN+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516641, "uuid": "62d1a867-0b11-4d15-a6f0-28f7739009a8", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516641, "uuid": "0ff15369-f7fe-45ed-a423-b9d0fe818931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516641, "uuid": "dc75a682-1883-4cae-a322-1a267c38d60c", "value": "ee6014f6187843b0c30ac538a5ec52fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99080c1e-1190-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687502323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502323, "uuid": "4752be84-200a-49d3-86fc-b68b1fe361a2", "comment": "Malware payload (Formbook)", "value": "09c420f56a3ff4f73e58e5ad904ff5ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502323, "uuid": "faf5c684-7a00-47e9-970d-31603712f7a4", "comment": "Malware payload (Formbook)", "value": "e3af13188ac01d30208f2acbd4ba129ad815086f70485c349b3e97de786f7d73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502323, "uuid": "6591730a-aa12-46cf-8a97-f12799aed9d4", "comment": "Malware payload (Formbook)", "value": "c9efbd249a6a2a347731e416f28bbf2551402a41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502323, "uuid": "6e3cb8e6-6ddf-491d-95ad-2970ca8f693b", "comment": "Malware payload (Formbook)", "value": "81758209a9abca55e7293cb552f836c6128b8218a4e1d68ff3f63678ac79323276c0953f4061576d6863d7e8bb54fc79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502323, "uuid": "2167929f-1746-4338-a369-3f7d2d62d1c3", "value": "T1B68401216D16D8FEE4BF03F1483D7A659E43FD20E817180F26D7BA4967782A0E526362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502323, "uuid": "65370afa-d3af-4dfa-9a08-d846c33e362e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502323, "uuid": "4815973c-8b26-46c0-a861-2be91ac906ec", "value": "6144:GYa6m2DqJ0NwHfmSDpOc2eUITKOcuPXMcQMd6kCtXCNUOXz0OSiYJ:GYI6NS+QpfKO+cYk0yOOXIjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687502323, "uuid": "acd91794-1243-4835-aaef-3feb459f58b1", "value": 401909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687502323, "uuid": "bcd68e8e-a58e-486e-a545-ecc809a055e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502323, "uuid": "38d5309d-4879-4161-9586-1c06b9f7efba", "value": "MT103_SWITF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b6af71-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500059, "uuid": "803983b7-2490-4c1f-8c71-6934381e268b", "comment": "Malware payload (RedLineStealer)", "value": "647c1817da03ed65f14c000c9e0dbc59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500059, "uuid": "6fbe7712-8e08-4471-9642-522cb315a009", "comment": "Malware payload (RedLineStealer)", "value": "e5204436656d088233d852a50e3d7fa9ab07de80b42dacac3b0057e6b7a9b1bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500059, "uuid": "c1ef766c-6f4b-4338-9731-064924a8705a", "comment": "Malware payload (RedLineStealer)", "value": "84f6772487df70daa3fa1147f90870fa90f9407f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500059, "uuid": "02036e62-8654-43e4-bbcc-1c7a00d0b99b", "comment": "Malware payload (RedLineStealer)", "value": "f52901f0e8dcb04e2262f118a09b4802d6eb687dbf36731aad57a3eb346cfc38728679778895907b96ecd8c8aec8b741", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500059, "uuid": "06564b1e-2b04-443c-b145-a39f10980767", "value": "T139E401CA31404573CB67CDF1C4ABE9964FBAB0314B398BC7524C5DF68E012E4A61B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500059, "uuid": "c726eaed-1b41-4039-bf96-49cae812bd31", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500059, "uuid": "785648c8-e321-4bc9-a6e6-45e597970ca3", "value": "12288:ah+iuTey5suT3ponkBROf1t3mghXgDN2wiLBvR65+EucAt1XvbQJQmZ:ah+ZTey5sC6kBIf1RhXf5EfW1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500059, "uuid": "95c83bc5-7fae-4f72-b89d-04bc0f2a3f93", "value": 713536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500059, "uuid": "7603d0b1-5078-49a6-b088-07ff7b509958", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500059, "uuid": "f92be311-e2a0-450e-ac69-078a9423c06a", "value": "647c1817da03ed65f14c000c9e0dbc59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ef6c81-11b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687518726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518726, "uuid": "e0310f08-e3df-495d-9996-a747186063f1", "comment": "Malware payload (Amadey)", "value": "c0fff7717dfc58642345a9759ac350eb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518726, "uuid": "5a89ef00-5a9e-419e-8254-eb6b94c52497", "comment": "Malware payload (Amadey)", "value": "e58185aa39bb04cda40a256ef44a9c2d976b51d9ded19aeb566aa5da418d095c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518726, "uuid": "f538a6e5-9b7c-4846-bd8a-02d59b8bafe9", "comment": "Malware payload (Amadey)", "value": "aa763c0bce4b4d6f929ffd11f0e939bfa7c2c167", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687518726, "uuid": "c55b0c52-4994-4cc5-9ff3-1ff7f8d003a1", "comment": "Malware payload (Amadey)", "value": "8d7d6a96ed16656382ec94cfeb25bc89048ad115eee380708301dcf74b248803defd46007297a9d9dfe9a289657971f1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687518726, "uuid": "30dc3e69-13d3-45ae-a42b-7ff2a64b914d", "value": "T1E5B4F1CA21804973DF33D9F1E4EFE9D64E7A71210B714ACB130D49FA8E815E4A60B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687518726, "uuid": "a7c70ec3-d52c-4482-bad1-dc5255878764", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687518726, "uuid": "71abda48-6f67-48ac-922c-0ac29d8e9a63", "value": "12288:ZtSMBTey5sWjZAId7dmWaKmSnVuo9LQJQmZ:ZtS8Tey5sgeId75ukVLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687518726, "uuid": "e4d868d1-cc49-458b-b52c-5b015b220a63", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687518726, "uuid": "550b60a1-de96-4e79-900e-6db42102ec1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687518726, "uuid": "1d4a1a7c-5918-4c5c-b50b-e839836bba3e", "value": "c0fff7717dfc58642345a9759ac350eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f9517d-11ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687540817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540817, "uuid": "f01de3d3-2c13-4fd2-81fb-05847404a455", "comment": "Malware payload (Quakbot)", "value": "826bef7cc89f65b8c9422d3bc8b88980", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540817, "uuid": "e2064de0-75cf-4a81-b16f-92a284bb1e8f", "comment": "Malware payload (Quakbot)", "value": "e5a4d28b196efa6e4c971985f28f9468ffe167a963358a46498992fbf529e5a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540817, "uuid": "7c408a17-1cf9-4bce-81e7-1a88df8dd827", "comment": "Malware payload (Quakbot)", "value": "34f366649a2daa6dee83dc972890f03dfec8b9b6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687540817, "uuid": "61d014ca-d0be-4741-b720-d6ccd319444d", "comment": "Malware payload (Quakbot)", "value": "e2042d63ce1bbc242dcee1cf40b8cdfce10eb8e374d2cc9a815f1b127e59742dfcaca13232f8197657374e0ba8cf7c3c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687540817, "uuid": "aa574354-3ff3-4dad-963b-f406f1ce7554", "value": "T12874496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687540817, "uuid": "5dd0d7d3-2bc2-44ff-baf7-8a55ea62e98f", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ593e:fIS1xb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687540817, "uuid": "58b86fd9-f09c-418c-91c6-58f3c0b03583", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687540817, "uuid": "d1a108ae-d267-465c-bba9-36b47e59cca7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687540817, "uuid": "97ecbfc4-4821-4884-854e-dadb332826bc", "value": "BSN-40367275.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf301c7c-1196-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687504991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504991, "uuid": "c269b423-485b-4519-a335-fb410b7bb4f7", "comment": "Malware payload (Mirai)", "value": "74035f475e94e0607e3b57b961c8ea53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504991, "uuid": "6e587980-20ed-4943-ba94-edd1a6b187aa", "comment": "Malware payload (Mirai)", "value": "e630f3eeef4d6e839d8681178485a07298b2cb0b3f068e90ff32a743ef533f22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504991, "uuid": "cab5b948-3b10-4f12-8610-57230da977cc", "comment": "Malware payload (Mirai)", "value": "e273a9192e3879c50a9ec2831325fe717e18cec5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687504991, "uuid": "66451c50-a88e-4c04-9779-57b6307abf8d", "comment": "Malware payload (Mirai)", "value": "529ce881c9ef25e5356acee3f477fcb6526295602d8a62674bce1653376a9028e9387fc8d8235309083fb69a013ac64c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504991, "uuid": "f70c1ab9-9b34-45de-9bfc-43e243537339", "value": "T159C2F0745228C472E1B4543AFDBF0503AB36CEF8CAEF322662104735A087D26D6B5B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504991, "uuid": "45e8cde6-eb95-431a-8553-f16bbdab217f", "value": "384:KBH2HEdV7UQDoYQHXxcjllK5+AWaFmK0MF9lz7X6AGexXVzonBY6plNzijrhymd5:byNUQUfhQllxlaH0MFjlOnGsB0s3Uozg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687504991, "uuid": "33f2dbbf-8580-441f-bf38-6cd2cc7e7d3c", "value": 27344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687504991, "uuid": "5e8bb553-31ce-402a-b306-63e424d27b9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687504991, "uuid": "3a5a3619-3fc9-4d0b-b32a-bfbc38c661a0", "value": "74035f475e94e0607e3b57b961c8ea53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a48b86-11bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687521084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521084, "uuid": "8ce910f2-959b-4a89-8f7c-17540e667fe7", "comment": "Malware payload", "value": "36f58526f30790d1f1be3b1fbdde6ecc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521084, "uuid": "b4c112bf-9f27-47ac-9330-a1052f5573dd", "comment": "Malware payload", "value": "e6b794c4bd139fee82a4261633cd3846f697d096ff809605364eb31d0a49192f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521084, "uuid": "1fed4ff8-26e1-422c-bf80-4597aaa58d0d", "comment": "Malware payload", "value": "b326c2925de20d0989d9fd6ef17d7969af18f649", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521084, "uuid": "8f622eb3-530b-4e78-b628-3bdfec870fc5", "comment": "Malware payload", "value": "511682b138f157fb15db9da67b4f8aa3e0b70dcaaaf97e225a5d5a3768f5dd957b55b0b270456d0a45476ae2d699c2ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521084, "uuid": "2dc60276-bfa7-4fc5-a1b7-9803de292446", "value": "T11104E0223590C432C0A765309C71C7A26E7EB91167749ACB379C0B7E2FA06C16F7636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521084, "uuid": "050cd451-3c3b-43e1-a221-825d25ce0179", "value": "a95bc52610e75fe13f55b9917d4a8bc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521084, "uuid": "117d2b79-e9a8-44f8-bf39-4bb0d543248e", "value": "3072:Ada3MpjHf7ZYtx04wyuLp6pJcACxnPge1uvE+ZCXhMdOfsePD4V:13Mpr7ZY/I90nCVtlMCxMPI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687521084, "uuid": "5182eaeb-cd21-46ee-a9f4-45cffe14310a", "value": 182192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687521084, "uuid": "26c24cb9-a1e6-47c5-8ff6-c92ebd1bd6dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521084, "uuid": "07127430-1429-4f09-9fd5-107eacbad62c", "value": "36f58526f30790d1f1be3b1fbdde6ecc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe56c01-11ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687520239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520239, "uuid": "3cf33332-0854-422c-92aa-0dd82fa46043", "comment": "Malware payload (SnakeKeylogger)", "value": "abccb524e20baae7e5d80ea1f699246c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520239, "uuid": "2d8de24c-de63-40af-a4b5-ddf577fd7215", "comment": "Malware payload (SnakeKeylogger)", "value": "e6b808d7ad7453c973d155e69f250ab3de7f1559f6db3b25b1bbf4a55fd8770c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520239, "uuid": "6db80be2-9916-4678-8b5b-d914e591c177", "comment": "Malware payload (SnakeKeylogger)", "value": "a72f29910659465c00a59919210974c2d9d766dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520239, "uuid": "ead9c61e-e843-4f1b-b11c-3f837a353e1f", "comment": "Malware payload (SnakeKeylogger)", "value": "d9f594a59df861c5c28f0288468b9de346017a43311722bd7f4472dc80f709c842a8dfbcf25903b4a16d9169e9b64044", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520239, "uuid": "17d8e758-4f8f-479f-900b-55d1180c3267", "value": "T102F4D0907BED0B58E9BA67FA883452350772BE1E246ED79D1CC270DF1971B800A52F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520239, "uuid": "b1355f17-cf7b-4ae7-be03-b7d15ea1195b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520239, "uuid": "547e534a-e055-43ac-9f80-42a62ae914f0", "value": "24576:Ng7UBdvDcAwVpGG6wm49t1HgS42805fYMxgvBi3:e7UBdvQRVv6ytZ5+Zi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520239, "uuid": "d196d5c3-6c3d-49b4-ae6e-222f91b184d7", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520239, "uuid": "599f4932-9e6a-4731-8383-d63ebce3e7c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520239, "uuid": "ea00ca39-97a7-46cc-8e74-e5e2c93e361d", "value": "abccb524e20baae7e5d80ea1f699246c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101e7ddb-11c8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687526145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687526145, "uuid": "d863f5d2-cfcd-4d8d-9c1a-8c4f96b57d77", "comment": "Malware payload (AgentTesla)", "value": "1c07e67f5cb4130bb63e83172bc4ebe7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687526145, "uuid": "2b298f3a-50f3-4fe0-b1be-7d9d43e9c8d5", "comment": "Malware payload (AgentTesla)", "value": "e6e9ea9348a2a4cbe9117c2a8674ae0ebd8f1cf4a0bae89ddb272c868741f0a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687526145, "uuid": "2718d29d-2180-4dab-8743-d3d66caaa04a", "comment": "Malware payload (AgentTesla)", "value": "b820ef182837c935e989f8e5f0170092b48e4fbf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687526145, "uuid": "a65e811f-3d24-45aa-916d-e1f0084377a0", "comment": "Malware payload (AgentTesla)", "value": "11f8b9e73c256972ccd1c385f898eb7396973667738049d689a85412ddb7a8a1e8c8a4ce3b9e82eaf7c1eee9e9901d46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687526145, "uuid": "ff9a6c97-610e-49fb-bc6a-5d436d20dd7e", "value": "T18ED4022612A00E05F57B5EF66530815093FABE009756F67DAFF160F607B3B928E12B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687526145, "uuid": "d2ed9f4c-0d2c-4a94-aa0d-903b38a5456f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687526145, "uuid": "35af349c-a60c-4208-819b-ee82ec7239be", "value": "12288:h2iNG4/mNUAN/twoVP9fq0Cjz5dS+45YsB5yrsF+kS:h1M4/QU9mArjz6+45Ys2Yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687526145, "uuid": "745d87f4-69fa-4356-91a0-dc5234308f72", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687526145, "uuid": "fe294561-a406-400b-a44a-c93a168128fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687526145, "uuid": "a3ff1211-d8bb-4d92-b2cb-afd3627bd5aa", "value": "yxZU6Cnjb59Epyk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6a0ac0-11b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516930, "uuid": "96d501a8-0210-43f6-95de-174307a3a935", "comment": "Malware payload (RedLineStealer)", "value": "fd9a761fa1f7d01c9085217f1acaddbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516930, "uuid": "59c7e9ec-15b2-44c6-9e21-50ba7df34755", "comment": "Malware payload (RedLineStealer)", "value": "e7c48579765305ac140034dc1534d81541176d340d6763c59fa688722a032092", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516930, "uuid": "e9dda3be-0911-4fee-9321-c10d0e6f188b", "comment": "Malware payload (RedLineStealer)", "value": "ef3b35ff3ae4a2761edce90e0534cd9862bcd64f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516930, "uuid": "9fed1a91-2bec-4802-8997-439aa4e11ab6", "comment": "Malware payload (RedLineStealer)", "value": "d1b0ee14067dee499d18792a5bd35d3436b925a7b9912b8a5ab7be80156ba2fb313d10949a2869d13c9cb98da2de5c7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516930, "uuid": "813c1022-75a9-48c4-a124-8b98698214be", "value": "T1B8B4F1CA26408473CF73CEF2D4EFA9964EB971210BB54BC3221D89F58E465E0E51B53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516930, "uuid": "60b5ec39-9587-4ada-8e30-e6522a3d11b8", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516930, "uuid": "10b9277b-9df4-4d79-a0cb-d28677017d3a", "value": "12288:k+1DgLTey5sm7xe1+mjjPIwJ3S0GGuLAQuROsG6QyaQJQmZ:k+1DqTey5sm7hm37UjGR9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516930, "uuid": "54fcfa21-ad96-4152-a49d-7f75f6eb0e74", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516930, "uuid": "fd115a0c-97ac-4dcc-aeb2-b55e73fa1b37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516930, "uuid": "35f74f39-6e8e-41b2-b11b-71c0d62fef98", "value": "fd9a761fa1f7d01c9085217f1acaddbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1481c94-11d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1687532912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532912, "uuid": "070b01ca-5903-4ca3-80d8-c5826a9fad5b", "comment": "Malware payload (Smoke Loader)", "value": "cc9698484bb8e365a61f41a7ccdbcb40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532912, "uuid": "4bc7990a-1686-4585-a0cf-b9d6bafda1c4", "comment": "Malware payload (Smoke Loader)", "value": "e82edb85f46bde98da82a2c3df1178e85774cd0415e9e998325a59b8a28b8ba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532912, "uuid": "49dd733c-74a2-470b-a98a-0028c38cc12c", "comment": "Malware payload (Smoke Loader)", "value": "449bab5b8e8770867d39f0ea8549d4044fb94b0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532912, "uuid": "f7eca016-abaa-4512-9720-97028f8893bf", "comment": "Malware payload (Smoke Loader)", "value": "06f10cb06dc7988e09477b0173bcf870f48fd260819a17f0d712116acccbcd976a9a1b1b069854c44cb89f2c5ad0fc16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532912, "uuid": "87ed7abd-0f4b-400a-9b24-8dca3a87af80", "value": "T1C4342B0362E0BC65E9255F339E1EC6FC766DF9918E193BEA2218AE1F04B11B2C173715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532912, "uuid": "a3ffabab-7537-4005-b154-a2380d5b2682", "value": "92acb9e2b931263dcc3907daa41f63e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532912, "uuid": "55f159d4-c755-4a29-b9b3-02ac64c372d2", "value": "3072:kAqKlgjnKsekwClIZzzTlOu4XTPGxV2H70t:sKlgmseksllnW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687532912, "uuid": "a7de5a3a-a990-4676-ba60-a19099286d65", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687532912, "uuid": "2204966b-5a51-4941-8580-7692e22b6fa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532912, "uuid": "d0af6907-3e42-4da8-a85c-676645f59191", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d84658-1193-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687503678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503678, "uuid": "974f0bf5-1e72-4f5c-9e64-576768883130", "comment": "Malware payload (AgentTesla)", "value": "153765568f726504f6301e66735ebfd1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503678, "uuid": "2fd235b1-d331-4704-889a-1906b4ca470b", "comment": "Malware payload (AgentTesla)", "value": "e854def99f1dbff3d4ec38c57fed3f212b3baca665645801ee34764fbfded0e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503678, "uuid": "e985add2-793c-4b7d-ac5a-1c3fc2669610", "comment": "Malware payload (AgentTesla)", "value": "f60886803691f42a8b5fd47cf5edc661a45ea39c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503678, "uuid": "e6dd1647-2f2e-49f4-a7af-f57b0cd5d7d2", "comment": "Malware payload (AgentTesla)", "value": "f3c80cba26f39c7659ae95b775887b2b1e5d2b2b7563821cb7ab84a87d425d567b387ce7cc042c0ec3c20f9be7e45a17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503678, "uuid": "45a1af08-1b3b-4642-9377-0c52533e3ff7", "value": "T1E34423E0E4EADB59CD4EEEA517672F44A31C2E4BF8E0540D1B0674ABA871FE070E5960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503678, "uuid": "b57094b5-4d5d-4046-99a2-0f2e3575ead3", "value": "6144:GpU8PLUcmtFgUMQXRYXaFyzAO5F81z3+Y1Z7myHqDoexed2Fw:wPLUcYFgxQhCaoAO5e3+W7myPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687503678, "uuid": "1f96942b-f843-4dc0-8ce1-9e8269b94b9a", "value": 274385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687503678, "uuid": "2f4f1a25-7e2f-412d-be43-e39530d7d0a2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503678, "uuid": "9de4a9ba-9fb3-4b02-9c6c-1cbb529477b1", "value": "SALE ORDER_23062023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc97ac60-11c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687523535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687523535, "uuid": "4cf638d2-a121-4c71-9cc2-81b069431a2c", "comment": "Malware payload (Amadey)", "value": "fb1ea955d07e805620f7798bb2b22b13", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687523535, "uuid": "d51e1dc2-83c3-4857-b9dd-42a9d799df05", "comment": "Malware payload (Amadey)", "value": "e889650f29c33c8e7591b0c28f7b6c90467d85551adcd35ade3cc67d7c56cf52", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687523535, "uuid": "a77d161a-9fd9-4a96-8e71-34cfe344e96f", "comment": "Malware payload (Amadey)", "value": "133713818418e9822c23188e58d1679e01f4ec16", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687523535, "uuid": "b804ae2d-582f-4a06-baaa-24e9cce7db0a", "comment": "Malware payload (Amadey)", "value": "e412c66060ca3b9e75c6db2903f0cb1e94dc020809b68a5af4b9ea8032bf21bd55d33c9090b85a16d134fbee60ab44a4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687523535, "uuid": "4fee2fa5-fde8-454c-8206-7ee181bd9d16", "value": "T199E402CA21008973CF23DEF2C4DFEA964E3A71210B654BCB130D99F54E456E5E24B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687523535, "uuid": "a0b5abc1-301a-4c42-aeaa-5eabaca4eb1a", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687523535, "uuid": "64a8c028-6d4e-4578-882f-4bb35ce84269", "value": "12288:W+cv+Tey5s8Htx4FNZZFhQkyUEy4m+IH45BuwIOwUG9SFza8U3B+UFrA3cL+oQJh:W+cGTey5s8zuZ3hQpy5H4awIGa8yB+4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687523535, "uuid": "85be2ba7-e4d7-4ca0-94e2-e7adffa2feb3", "value": 715072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687523535, "uuid": "42250389-49b8-4f1c-9f66-3705d29549ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687523535, "uuid": "03523b30-44ca-4e7e-a5f0-7812bed98fe9", "value": "fb1ea955d07e805620f7798bb2b22b13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74454aaa-1194-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687503979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503979, "uuid": "b0990e10-ab85-4d8b-bc2a-abaaecaad61f", "comment": "Malware payload (AgentTesla)", "value": "abd61dd321bf185eb0dfa3cfe8144114", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "sarahfoils-com", "colour": "#A5BFA1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503979, "uuid": "a22cd314-7550-46a4-b4a7-13da75df354a", "comment": "Malware payload (AgentTesla)", "value": "e94d9b20bf628e061f3978c75623639a5ccf8594428511170925df045815867e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "sarahfoils-com", "colour": "#A5BFA1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503979, "uuid": "b05abdf2-b29b-4314-8ca4-955df9829904", "comment": "Malware payload (AgentTesla)", "value": "fa35170b137ce725b972fabfdbca9b4914ca87eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "sarahfoils-com", "colour": "#A5BFA1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687503979, "uuid": "20fd5068-60c0-4950-8f29-f21a8132649b", "comment": "Malware payload (AgentTesla)", "value": "974c743529a8814d943d03b248197390c976bfd3cadbbe15d98f5077dc465c7f79aa422bb2c56f9dccd3572f752db487", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "sarahfoils-com", "colour": "#A5BFA1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503979, "uuid": "80d70118-cc08-4dea-8604-835dafbd3a6b", "value": "T1D9C423702B3F07A4DFD4F4650D7652183472171AB0B2DBDB05F24D786BA42E664BAF22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503979, "uuid": "6fe25bbd-6983-40c4-b008-b698c46de478", "value": "12288:hti4C3NgzDeCwJqGeJJmDv3BBDvOrhB0nT6JzeSxThwyhv:/iPqzDeCwMGYJmbPOliwNbhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687503979, "uuid": "d6c07eca-3110-470e-b867-486b2b718ae6", "value": 571515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687503979, "uuid": "157ada92-8036-48aa-8836-e308a335038b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687503979, "uuid": "c934d751-0fb5-4b7b-a8ed-8ea51cba062f", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54cf5ad3-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500061, "uuid": "5fff6db4-9b2a-4767-bc71-f9d7b065e651", "comment": "Malware payload (RedLineStealer)", "value": "6493b3dfdbc50dfe4f7269c259501a50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500061, "uuid": "3da37c4c-fd22-419e-a3e1-ee321df9dd78", "comment": "Malware payload (RedLineStealer)", "value": "e9908c41ae906ed08e50975082db94b7863bb72ebf56099b124a33733b1be34c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500061, "uuid": "4119804e-923c-42a9-9786-366d314c86e2", "comment": "Malware payload (RedLineStealer)", "value": "deb4563ddf50a05bcc3bc1f914985891fcca9ca5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500061, "uuid": "32fb8f9d-016a-42b1-832a-476573dc547c", "comment": "Malware payload (RedLineStealer)", "value": "4ba61abebb4791d04b8e3a3d2d7938670d76d7a8acb46460658b57aff874ff774a91d52cf093a5372a981dca942bdba6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500061, "uuid": "b340506b-b780-48bb-81f5-bbd71ec795ef", "value": "T136B4F1CB21500973CF23DEF2D4EFEADA4A79712107354BC7120D89F64E411E8A92B97A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500061, "uuid": "574cc44c-f096-4bf8-827e-e4d59796a818", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500061, "uuid": "4d1106f2-731e-4ba8-ac19-404f26a9ca75", "value": "12288:5+Oe7ZTey5sYswvQwACyl6UsvWJrjBeyyyQJQmZ:5+O2Tey5sYH4BCylnsvcBBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500061, "uuid": "386cef4f-befe-4af0-bfc7-afbecbb855fb", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500061, "uuid": "1175f7a0-3d4b-4a10-ae78-d311dc3d938a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500061, "uuid": "4ef39b14-4612-43b4-be3b-bb00d35374b8", "value": "6493b3dfdbc50dfe4f7269c259501a50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60304367-11ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687520267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520267, "uuid": "2ec9c6ee-6692-4c57-9795-d773ebf95c06", "comment": "Malware payload (AgentTesla)", "value": "a27108028e83aea3675a1fae0bae2f85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520267, "uuid": "3b4b9a3b-d980-4dc6-8a65-427ff9c80dd6", "comment": "Malware payload (AgentTesla)", "value": "ea0f7d003836a43bc159650365e571b9664aa74ecde158fed5234b09fd2ef7b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520267, "uuid": "b95728a1-ffea-41b2-905c-1915b5586875", "comment": "Malware payload (AgentTesla)", "value": "99df71fd39ce2a77941aed48e5601b4a78424653", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520267, "uuid": "e367ceec-2fa4-4692-a109-1fbbc81aad37", "comment": "Malware payload (AgentTesla)", "value": "f70d3aba3e81d38a665ab24b6d0594ddfdd3a69ca01df479b60ca492c5c5ded38243aa51795eca69aacd4cbdf2d9572d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520267, "uuid": "51af2751-7189-43bc-b112-d09111f425a1", "value": "T10613A05AE78F12648F911277171B0E89AABDB23EB35054B1386C833433EDC7E46665BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520267, "uuid": "5f8787c5-f8b0-4179-8469-5858a89746d0", "value": "768:8Fx0XaIsnPRIa4fwJMA97Kh4EdeqLWcwubIPUjjv1FYEB1g0f:8f0Xvx3EMI7jEdVLWAI8/v1KEBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520267, "uuid": "4384cc2a-669b-4fdd-99c9-231b83ef7c76", "value": 42456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520267, "uuid": "32c9c933-f9ab-41e5-ac1f-807be53d6fc4", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520267, "uuid": "0d1e6bbe-5886-4bec-bc78-fb5ad19d636d", "value": "a27108028e83aea3675a1fae0bae2f85.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0592ddce-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500358, "uuid": "20e39eb0-de83-440e-afbe-7e99fb5b4b65", "comment": "Malware payload (Amadey)", "value": "9cbe6951e08765f9907b42076cdbb8d1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500358, "uuid": "e5c52068-e627-44b3-a3c3-383088edf5eb", "comment": "Malware payload (Amadey)", "value": "ea60a3d262926978be8f524a957e110614476c04e64dbe12247edce933ffd65c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500358, "uuid": "502ff256-aca3-4712-8207-d0b1236e1c7e", "comment": "Malware payload (Amadey)", "value": "e8d04ad2988e73366b42a859541fc15df7588347", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500358, "uuid": "9e60b475-ef05-4ee1-89d2-ac651583bbb7", "comment": "Malware payload (Amadey)", "value": "1351e812e9e434371213cf38ce3067b067f4fa7ceb36d5e59ae3e974237488339109bd298daf41b9745221c479c288bf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500358, "uuid": "35ca4805-9333-46f1-b378-99fa8ffc67b0", "value": "T1BEB402CA65804973DF63C9B2D4EBE89B4F76B0210B7147C7130D8AF58F421E4A62797A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500358, "uuid": "1864f12b-108d-4270-b0b5-a195cbf07500", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500358, "uuid": "078d05d5-eb09-4e58-b307-d6a7705ba819", "value": "12288:yghesTey5sHe51kkzI5fnmi+izk+1QbIoMQJQmZ:yghbTey5sH0jKh+iz9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500358, "uuid": "6b6919f7-b33a-4327-8b72-4f0db74044a1", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500358, "uuid": "e9c6dd35-774b-477e-a70e-44fd019a0602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500358, "uuid": "14a6dfa5-2ea2-479e-a213-8bcbfd9289b3", "value": "9cbe6951e08765f9907b42076cdbb8d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919c66b0-11dd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687535382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687535382, "uuid": "72dc64f6-1f22-4b66-8698-8c22fccbee99", "comment": "Malware payload (RemcosRAT)", "value": "c28a3cc10469f09cfd6738b0399e1039", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687535382, "uuid": "800834d0-24f4-4d9c-bf31-5cf8a9d0aabd", "comment": "Malware payload (RemcosRAT)", "value": "ea903fc267537ec6bcb77791b967bf3b217202084e2ad9583f311f100a4de459", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687535382, "uuid": "a3d97089-387b-4c8f-acfd-662aac005760", "comment": "Malware payload (RemcosRAT)", "value": "a0da20a086da1dc291b76bf4a025756034dfe751", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687535382, "uuid": "dd92a501-f672-4090-a946-223effd9f326", "comment": "Malware payload (RemcosRAT)", "value": "62e26fed34ec8e734f5de322a694eefb4c88cb5ce864f2bf46f432101f723012405c094027a16c8bb517f7b3a1a867c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687535382, "uuid": "1b81661b-7a69-4356-949d-13b61c14c7a7", "value": "T191A4AF02BAC1C072D57651300D2AF775DAF9BD20183A457BB3DA1D9BFD70190B63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687535382, "uuid": "63590f52-3a13-4256-9948-556b97909d9d", "value": "04d77d421b8e5297898a3fce39d74267", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687535382, "uuid": "76ad9f2d-a2bb-4455-8a04-1efbf20cc5d2", "value": "12288:RRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/Zf23DU:Rx7cyF2eSsewS8W47eZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687535382, "uuid": "b1b03934-9d18-4ff9-8360-b44ab60d0fe9", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687535382, "uuid": "3421b3ae-487b-4167-afe5-7cd81cff8029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687535382, "uuid": "b1dc83ed-f711-48bb-a254-5dacec29cb6e", "value": "xnmWtY13L4fC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa0ddbf-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500661, "uuid": "5f8d6ad5-a30d-40ad-a351-4f38d1cc4e71", "comment": "Malware payload (RedLineStealer)", "value": "86db11e2d1837ef1962b932abd7bff2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500661, "uuid": "991853f5-6d54-4cc6-9db8-ac417a01381a", "comment": "Malware payload (RedLineStealer)", "value": "eb557bdda61f5379a5197e313d79bbeec8b832871701d013e4cb9d8c4c63a44a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500661, "uuid": "aea5d284-d508-445c-84ae-7e6fa64384e2", "comment": "Malware payload (RedLineStealer)", "value": "981a8a88c1ee18c0459f5340dd6793c07367d191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500661, "uuid": "98fa3614-59d7-4ddd-a350-fc266c2d245f", "comment": "Malware payload (RedLineStealer)", "value": "73027c8ef92c06347254e1384b162fe5fffe59de923d64f1723ce72983ca82b7aa6440993fa00bb533a0cbb09e04a348", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500661, "uuid": "e4c2e2a2-a757-4341-8caf-2ca9011a4f14", "value": "T159E402CA31404873CF67DDF2989FE99B4E7970214BB50B8B270C19F94E451E0B61BA7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500661, "uuid": "0d178ba2-b7ed-4b90-9829-054a833a9b35", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500661, "uuid": "1534e206-c6ae-4fbf-94a7-78658c8160b5", "value": "12288:04mO1WI1iTTey5s+WoQiTTLMlVEeXbRnTIwJmy+HnFpn2TSIkZAXqqNMOOQJQmZ:04mO1WI18Tey5s+WMI35+H/keRq+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500661, "uuid": "fe5063f9-aecf-47fc-b650-b61b170ad9b4", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500661, "uuid": "d869b5e1-eed8-4135-84f6-76982dfdeef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500661, "uuid": "b848fba1-da9d-48de-ba19-d2a167f40741", "value": "86db11e2d1837ef1962b932abd7bff2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf6e688-117e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687494463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494463, "uuid": "2f613a74-6ee6-45be-aeda-de89c980dc57", "comment": "Malware payload", "value": "84aceacba5515fa3f641caabae483f8c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494463, "uuid": "741e7fee-9a81-43d5-a784-e42c40b09a14", "comment": "Malware payload", "value": "eb5aa286edb06710e8beeac26354ad897866e3f5c26e16ef4579d8b573eb337f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494463, "uuid": "65ec3ee0-59bf-4755-a3af-a66a2ff2552b", "comment": "Malware payload", "value": "fce2e7435f630eef9d34cd10d88caae8d291a588", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687494463, "uuid": "8109d2fe-259d-418a-bd56-be9c8a8ddf56", "comment": "Malware payload", "value": "a5236fd7805f400556b9337038791aab959b50aba62de3b4f31c6fd8984e78074e5b053cf9af2d26942536253e5099e6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687494463, "uuid": "88bb4955-217b-4489-8b4e-7c6d0538deb9", "value": "T1DB135D007982C073E3972A350A76C6758AEFB85127F1506E2FAA197D5FB07C3D62D722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687494463, "uuid": "6952615d-3e2e-43ed-916f-5bb956e778e3", "value": "36b71916bbb43709a65f37cb1c5d668f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687494463, "uuid": "8e88a9a9-1154-4b9d-a050-5bf5ebef3241", "value": "768:QteUwTqk03F5hDkC4s5gIYsEDgcnPUFEesNHn:Q5VFnIBT5PbBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687494463, "uuid": "072aad84-defa-409b-97f0-912c2a47d6dc", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687494463, "uuid": "84a51f73-9b35-4e7b-9de7-5682528c9a57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687494463, "uuid": "130f5c33-3550-4542-81ec-2cb2981d8bc2", "value": "SecuriteInfo.com.Variant.Zusy.473747.23165.27528", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a51c29-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499123, "uuid": "42c1e804-0876-4c3a-9578-7a20ed4b22fc", "comment": "Malware payload (RedLineStealer)", "value": "28e7717de31e6729e2c933786eb4f524", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499123, "uuid": "854d027d-7830-4d1d-aa3a-8b82a2de1507", "comment": "Malware payload (RedLineStealer)", "value": "eb7b77d13c06a3eed92968483c41c3a77c60b5c30db1ff0bb644e382e460198f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499123, "uuid": "9eea5683-b0a1-4831-981f-2f0f664f18b1", "comment": "Malware payload (RedLineStealer)", "value": "e5f1f435d54f6d35d275b84532bd1c3c2b5100c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499123, "uuid": "80e019bf-861d-474e-962e-d1ddba12931b", "comment": "Malware payload (RedLineStealer)", "value": "824cdf66c696e54cdc1a56d6b49f420b250d0f03d38c8e8651456c829be8e609f10d2d6057a44c6528a304c02b5fc037", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499123, "uuid": "08056d9e-f4bd-4313-84a6-6f857905cb48", "value": "T1D6B4F1CA26404873DF33CDB2D4EFA9968F7A71200BB54B87130C4AF55E452E5E61B93A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499123, "uuid": "746c02eb-88a1-4c44-9c9a-30ebc46e6e97", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499123, "uuid": "dd601ed1-15ac-472c-8ef0-d6e0ea7c9391", "value": "12288:WErwKTey5seqpedOnGY6ngJHuOxOJK1QJQmZ:WErDTey5seqpe46ngJHOAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499123, "uuid": "d47b2f41-4aec-4484-aebc-fcfdbaaee455", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499123, "uuid": "52f59ab9-854e-411a-b18d-06c127707c2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499123, "uuid": "c27d676c-4f47-47de-84fe-f404b118e709", "value": "28e7717de31e6729e2c933786eb4f524.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c0e3eb-1188-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687498825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498825, "uuid": "f1476dde-b763-4ba8-ba5c-c694da98147c", "comment": "Malware payload (RedLineStealer)", "value": "225c56ccd78391b99212c7ad291e3ecb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498825, "uuid": "24f57049-d2b0-4021-91e1-7fef1c4c7197", "comment": "Malware payload (RedLineStealer)", "value": "ebbb333bfdeb6b2dda784e0f70a043634251b2681ff4c6c5b41d0d8d83a30d94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498825, "uuid": "dd8279f9-6f6e-4fb2-af11-f196d5c751ff", "comment": "Malware payload (RedLineStealer)", "value": "8a564070d2500399ec19ad815a73c58d97bcbc36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687498825, "uuid": "1edb42c2-f95f-4488-a6a9-5bc040a866c0", "comment": "Malware payload (RedLineStealer)", "value": "0a83b8acbea61cbf26bdf15409bbeb529dcc94f7a79b6400682577003576790e936432ebda3852d6e163f19cd9c2bc03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498825, "uuid": "cabe84a6-249b-4991-99db-ff233059acd2", "value": "T11EB4F1CA21400973DF73CDF1D4EFE9964E7970210BB18BC7120D9AFA8A462D4A51B97B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498825, "uuid": "6e8b0846-3598-4da8-89d5-edb071daa47b", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498825, "uuid": "23c2a27f-8f40-42e4-8b2c-97bae7be60e8", "value": "12288:CDeYjhTey5shNF4qzAPqwjmn3Aae7AJsocJFsDlQJQmZ:CDeY9Tey5sLBAPqwjWHfXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687498825, "uuid": "3e6fe3c0-0a50-4acb-b6d8-eb7d997a551c", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687498825, "uuid": "71452d34-16b5-4b05-811e-a74fb17cc335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687498825, "uuid": "a0d781aa-b67e-4d74-a8ed-f5bc94da1e85", "value": "225c56ccd78391b99212c7ad291e3ecb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37250da3-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501300, "uuid": "f5b6e0f8-4a9a-4f15-b11f-5186ea87a051", "comment": "Malware payload (RedLineStealer)", "value": "edf248b2d38e0eb719975340e31d9ff3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501300, "uuid": "2abc0ca6-d42e-48d4-9f40-0aa8f82061b7", "comment": "Malware payload (RedLineStealer)", "value": "ebc34b2d2c03e3f543ba3908126c7597e1d23f39094459028b541b1f4ce034a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501300, "uuid": "ce59ba73-2fe8-432f-87eb-7cf95c86385a", "comment": "Malware payload (RedLineStealer)", "value": "4b6b6188fb4ca21191c6f8a4ef33f8c379246890", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501300, "uuid": "397fdb83-248c-4fe0-a82d-bdd3e58d3a95", "comment": "Malware payload (RedLineStealer)", "value": "ce2c86316783a1911deade36ba3146dba5177322fd8cc489e79dcbca705409b738b7eecb0719ae1767385d2da11096bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501300, "uuid": "0cc9855d-2084-4567-8020-d0ae42f12b5a", "value": "T15BB4F1CA61408533EF23CEB2D4EFE9D68EB9313107714BC3124C9AF68E416D5A61B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501300, "uuid": "ec873668-9491-45a9-a40e-d4e839f14772", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501300, "uuid": "100ced1e-2832-4a23-a517-1db617077439", "value": "12288:Sh+tDTey5s9KhKSv3c9k005CKROg9E+0CE6NTCrxmFQJQmZ:Sh+hTey5s893y10POI0CVTC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501300, "uuid": "af40b315-88c0-426b-a386-d7863fe5d27f", "value": 540992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501300, "uuid": "eca24fa6-357f-4c18-828a-80bbf8650a99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501300, "uuid": "fd51f65d-363e-489d-af7c-a6e1b2c32f61", "value": "edf248b2d38e0eb719975340e31d9ff3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ae655f-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687500467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500467, "uuid": "3370e0e4-af0f-4243-938c-e400b7aabbbc", "comment": "Malware payload (AgentTesla)", "value": "600e58225f6c8775e603019ab22663da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500467, "uuid": "3eb63cc9-3094-4869-b898-5c149db73b6b", "comment": "Malware payload (AgentTesla)", "value": "ec35639b78be17a7d87dddb54abb055b39845040ccd9fe275b835f701d6f25f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500467, "uuid": "1b04e1b2-8086-4300-b3a1-7e530c43d0ee", "comment": "Malware payload (AgentTesla)", "value": "ac1c51ebcf83905fe1925d456187ded71417cd16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500467, "uuid": "6e9acd69-8e1a-481f-a0a1-3a73f9493acc", "comment": "Malware payload (AgentTesla)", "value": "56e1066c0d4698dde2222121a8c80088ed2e68922858045b6a2da867eae4de4b2a07253c541e85b0354c884db3cad969", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org", "colour": "#6A8FC2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500467, "uuid": "3b88f4ff-a22e-45ca-9c03-0800dceb236c", "value": "T1DD3533A8B5F5651BFD6A88C5D1908C97BE973834948B138D247C37EE7CE812483C98B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500467, "uuid": "98d51653-8b62-4317-b07d-7ff553580aa4", "value": "24576:QUs0yDk8jtkOubF9kYyNrZ/xE7qpqU7uE48PLwj:QUs0yI8tkPb4Yy1Z/xIFUzsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500467, "uuid": "55a5f9f3-4b41-448f-80ab-330cd8274e50", "value": 1097082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500467, "uuid": "e6846dc7-f142-4ef2-b42e-5be3f730ea42", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500467, "uuid": "c7c0f896-36bb-4df0-9c82-f86c64f090f8", "value": "SOA # 87594094.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb60ffd-118f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1687501903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501903, "uuid": "1ae41fab-ba3c-410d-9f7a-4ec71b97e652", "comment": "Malware payload (Mirai)", "value": "3913c69b7d8afca85447c17575a184ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501903, "uuid": "02a1cfcf-3c53-4026-a694-0a192e15b6ff", "comment": "Malware payload (Mirai)", "value": "ecc72cff1212ae232bd81f147d6668eb8b2e48f8daea93e3bb1622c51af54cf1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501903, "uuid": "fc730730-5ccf-4b0d-8052-df761e588579", "comment": "Malware payload (Mirai)", "value": "2504e25908a688654534d977e570d2866d77440a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501903, "uuid": "ac5d93e0-ad7f-43bb-a7f2-d507cd12a2aa", "comment": "Malware payload (Mirai)", "value": "6d5500f9bb799f248a03a3d7a3e880b58abbdb10df2453b8dec684e6ddbb7f74ad117e3b54a2b74f04b4dda5ac52d752", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501903, "uuid": "21db6ee6-0c41-4c20-beee-919c041f9338", "value": "T145B2E171A1863E72DB70313AB97CCA01576B5BF8A4F672713624B6AC4BD2C4B647810E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501903, "uuid": "1847e9e4-a0e6-4bef-b33b-4596564d3bf0", "value": "384:vZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvdZWRhymdGUop5hKC:yX1De9kONQG5xD+jHMDzuZWRs3UozYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501903, "uuid": "6e13898b-89f7-48a8-af05-9427c6cf3d09", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501903, "uuid": "e0ba86b6-99e2-4222-919f-beff0b8645c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501903, "uuid": "2ad3978d-1ae1-4409-833f-662d45f787ee", "value": "3913c69b7d8afca85447c17575a184ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde4c643-11fb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687548448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548448, "uuid": "b6110c12-02a9-4482-8705-ea0ecda16ed9", "comment": "Malware payload (RedLineStealer)", "value": "59f411d8b7e3a0b5913acea862a83aec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548448, "uuid": "41addf32-b80d-45f7-b0bd-c3e35d9ab9df", "comment": "Malware payload (RedLineStealer)", "value": "ed873a407a827aa2fc81f2f974dcc2e9e102a57b73ad5e5219cd2fc2bb5b0ee0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548448, "uuid": "e696a0ac-6ff4-424d-80f3-a33705389148", "comment": "Malware payload (RedLineStealer)", "value": "7710dc3d3fee59f5646e79fbcd8ab6e98ec42471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548448, "uuid": "cd1c07ff-549d-4049-bcde-6bcea66214bc", "comment": "Malware payload (RedLineStealer)", "value": "43c216bfd45938655919e6cce81dc0943260979f37a47a9477d75bda2dc9ff3589083f43adb70cfaa69dd0d2a26ccafe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548448, "uuid": "5859c123-636c-471e-8d1d-779bc4b97b53", "value": "T1D9747D1362A07D65E9255F72CE1FC6F8760DFA518F1937FA2218AE1F08B11B2C273616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548448, "uuid": "9c463d63-14e9-496b-8a52-9b2526a172b2", "value": "15dfc2af459abce0011d59d0a86db859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548448, "uuid": "3311ea3c-edee-4c0f-bbc1-935e1344df53", "value": "6144:AKpFBILnxuF3DrgEncCn6krOSGEWY3wmz7pzGqoE7fAM:AKfOnxeHXnDn66OSGEWHmzVq4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687548448, "uuid": "39b67e02-9308-4741-a9f8-5f0fc7cd0b36", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687548448, "uuid": "6392977f-10c7-48ec-bf92-e3696f17de2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548448, "uuid": "f02e7053-75a8-4859-8a03-d8c9194379f9", "value": "SecuriteInfo.com.Win32.Evo-gen.416.24188", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6277f8-11cc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687528046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528046, "uuid": "301663d0-37e3-4681-b1dc-a408559fc56d", "comment": "Malware payload (RedLineStealer)", "value": "2de2df32164301b039a8f16020473b46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528046, "uuid": "2b7ce5c0-16ae-4af4-b4a7-c77c2c3708fb", "comment": "Malware payload (RedLineStealer)", "value": "ed96ebf729f236daf7ce9d0156f387522fbf1fbbb7855498b4b99c0db81620c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528046, "uuid": "1d5d7b60-3f3c-4a61-89d3-83f46f86d4de", "comment": "Malware payload (RedLineStealer)", "value": "45de016c3449aa3c931e98c909d25d2bd2aec0a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687528046, "uuid": "3a635506-8a49-4dce-956d-bd63e8d67994", "comment": "Malware payload (RedLineStealer)", "value": "7f6d05f391d48d3c84fdc910de8e9474f04853bdb2ee6ad1f3a224ce1138b0230c423cd01321d1aaf757bf9bc873184a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528046, "uuid": "dc91d55f-0139-4c17-8de8-c6f0c2ef9101", "value": "T1103611792680C973D7DB3771D0A3822FC9182A7096DFB48D5B371CEE286BABCD464914", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528046, "uuid": "b249965d-46ef-4150-ab6d-4b9f9907b599", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528046, "uuid": "1edfbaa5-b778-4c2f-ac4c-627d9e588ef8", "value": "98304:gRLB2SNMqKRI1/Qo6j+PodBKad/f897XrsjwDKJQlnanwgPhjYmNQLe3F4AmaWPf:ULBZQo6j+PodPpf897XrCJInanwgPhjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687528046, "uuid": "9f2237ae-6cb1-464c-8ec4-1ca9596e7f59", "value": 5189632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687528046, "uuid": "a782af9a-f58e-4b2b-9ef0-3c8cd293d2ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687528046, "uuid": "a9656eb9-ba5a-44ab-9a98-b434c6973d55", "value": "2de2df32164301b039a8f16020473b46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e594b2a6-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687501592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501592, "uuid": "3dc8e1bb-5c85-45f3-81c2-50d59fa42053", "comment": "Malware payload (Amadey)", "value": "e1ada8b2f547ea05164c114d35fcc1cf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501592, "uuid": "c5af8738-4943-45e2-b14b-2a9629787184", "comment": "Malware payload (Amadey)", "value": "eef8c90588943a563f427b82c3631db58963ac571c8d33ab4cf57c4a6a2c21bb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501592, "uuid": "90973caa-ad9e-45b8-9e04-b84b9d3cbad6", "comment": "Malware payload (Amadey)", "value": "f1747befdec94d49ddd68bb80a8e5e6a088f9be6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501592, "uuid": "b860bd26-2853-40a3-a42f-90c056ee1a1d", "comment": "Malware payload (Amadey)", "value": "3ce8904c0d8b7879cd8776cbfdcab23bc7660032c51ce03f399c99d06fb56824f0532b5345d7e05d198439dc810ffdad", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501592, "uuid": "050a2cc5-645e-4837-9c82-a886d989692a", "value": "T1D5E401D6710085B3CF33DAB2D4EFE9D64E7A21224BA547C7120C5AF58E851E0E50B9BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501592, "uuid": "facc991b-b396-46e1-b180-f84466d4d04a", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501592, "uuid": "055704c0-128c-4cda-ae14-be2bd466f578", "value": "12288:XyYh+qsTey5sunwSmKCv+9/5emlxxUw3tBuIgml6Y8SyQ2YAQJQmZ:Fh+zTey5sc/mDv+/ZxlDpgml6Y89fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501592, "uuid": "3107a3d5-2e42-4514-9294-179e83ac26d3", "value": 713536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501592, "uuid": "6004894e-ab8d-4fba-9096-3fd476260491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501592, "uuid": "c951f894-c3f4-4a1e-8079-d3bec2af6cbc", "value": "e1ada8b2f547ea05164c114d35fcc1cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c272c4cc-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687500675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500675, "uuid": "5639e90c-31c9-4054-912d-12c21bc25b7f", "comment": "Malware payload (Amadey)", "value": "abcaffc12b226a8680b22895d0e86d22", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500675, "uuid": "f4352c6e-48d4-488c-82b4-7ba60502be5f", "comment": "Malware payload (Amadey)", "value": "efbdd2ef0c7dc6295dd6fa46fa8645723896d9c3613899366d99356926f360a0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500675, "uuid": "96bcd1be-0504-4291-a591-c61c50ab6a96", "comment": "Malware payload (Amadey)", "value": "09137ba6bfb55f67fc0f3aa32430e07b78347a96", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500675, "uuid": "9dfa3f11-8392-4785-8679-f9925b1bbdf0", "comment": "Malware payload (Amadey)", "value": "817a2d99c1515a4b03ec74d5f7aea7560993513c730576bafde487a60d24d985beebf1824037f936cbccc58052fc883e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500675, "uuid": "c8498fa2-27c2-415f-8c08-130f7aa54a9c", "value": "T194B4F1CA21804573DF73CCB2D8EBE9DA8E79722147628BC7530C95F58E512E4E61B43A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500675, "uuid": "b1e54541-bb46-4e38-be57-e29110782e47", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500675, "uuid": "7d16c451-17af-4fa7-b256-88335ead6716", "value": "12288:Rn4mO1HEFrATey5slTtAsU1fijgiUfPuXxCMLcAM3vHpQJQmZ:V4mO1HEFUTey5sJtNU1q3UfPqxpc1/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500675, "uuid": "ce8d708a-8c57-48c0-a4a6-3da161a1044e", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500675, "uuid": "96d3d9e2-11d0-4037-8fb2-9ba29e775f35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500675, "uuid": "4a6cb734-5220-4e0d-90eb-591a9d347f3d", "value": "abcaffc12b226a8680b22895d0e86d22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7c238a-11fb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687548449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548449, "uuid": "04549cfe-8141-4083-920c-a195875bd160", "comment": "Malware payload", "value": "903371b9e2693db0b09a12a0745cd995", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548449, "uuid": "3b3b067f-8381-48be-8bf7-e6ebf6c94c76", "comment": "Malware payload", "value": "f0e34aaa47e482b2752eb7948454ee847f080ba6194218c7a1793e7772981f92", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548449, "uuid": "bcbfdd46-b836-449a-8b4a-07912453d55b", "comment": "Malware payload", "value": "ad29ee587b1ae3101efb1e7a7276f187f92917c9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687548449, "uuid": "a895cf24-cdf9-47f9-b6fe-26732aa87a70", "comment": "Malware payload", "value": "1f8985df0c13f37b71f0d9b2bb1178dd3a4ba53e5ce48769222d558d2cd4189d4963bca9bb2cf0282e7b7362ac42530b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548449, "uuid": "c1d54619-1f83-46c8-8545-7cfdfb0b5a0f", "value": "T15E612C39D5999C03D4499EE2D8767F721236F20B41CB6481E1BDF634077E5B6AD83882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548449, "uuid": "ef424cae-a7c7-4658-8ef2-51073068a9c5", "value": "96:qV6K3foNE6UR/6dsq5mZsX77YTH4/m7xzgkXhyaFzK:pgf/lr6X8H4mxzOaFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687548449, "uuid": "6cb9cebb-6005-440a-b5a2-f865e04a3268", "value": 3320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687548449, "uuid": "beba8c7c-30ba-4c95-b75d-92a0c477946d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687548449, "uuid": "1c8a200d-bb86-4596-bab3-04876dd7a187", "value": "SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.18026.24635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02812db-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687501583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501583, "uuid": "f085b87b-d612-4b86-a62f-893b6abbc244", "comment": "Malware payload (Amadey)", "value": "f80c3d9468a37663fac7393dd5a485fa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501583, "uuid": "99ff4502-5f22-4800-80e5-0847f18dd602", "comment": "Malware payload (Amadey)", "value": "f1e40c5418417b490c34f323f45fdb91a3e9c84bd1f9faa003a090ef101d574c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501583, "uuid": "9b26418b-f1a9-440b-beae-49a5dd93631b", "comment": "Malware payload (Amadey)", "value": "e82192eef797ae7c2ac947f4bdbb8909a8c83c1c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501583, "uuid": "7841d7ef-ba13-496f-95d0-9f7636318043", "comment": "Malware payload (Amadey)", "value": "e5b8400f0b41cf11488c1dbc442d7dc60baaa3b03d5d79e91ccb340839e433ad208d9d4be655fba016a797bd2eaaea19", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501583, "uuid": "abcf1f68-bcf0-4058-b1e7-005666e40fbb", "value": "T1FFE402C6654048B3DEB3CAB2C0EFA9E64EB571210B7647C7430D4AF58F096D4E64B47A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501583, "uuid": "07cfe4d5-3776-44d1-81f5-0aa9fd30155a", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501583, "uuid": "87b93f93-5224-4138-9f7e-036b1a462ddf", "value": "12288:mUdhDTey5s6BOq/hNPCowPkv/OnKUiJJmww4QWQJQmZ:mUd5Tey5sMO8NPPQPOAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501583, "uuid": "2009a157-9210-4f37-a04b-03a23c54b31a", "value": 714048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501583, "uuid": "cece3bc0-a93c-40d9-ab79-9118c1f2e15d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501583, "uuid": "13ff537b-6ffa-4822-bfdb-2f641ca967b9", "value": "f80c3d9468a37663fac7393dd5a485fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f09abb4-11b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516319, "uuid": "58390fac-27e8-44a0-a1e1-e622fdf2a564", "comment": "Malware payload (RedLineStealer)", "value": "396fd8c2c5e5776e02fa7aee7145ac95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516319, "uuid": "b639186a-6f9c-49e4-bca4-27a57af32e4a", "comment": "Malware payload (RedLineStealer)", "value": "f1fe0a65c7e2ae1b70ee5c02dc24c27b9175018302541c00cc0f611aed40141b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516319, "uuid": "26a655f7-3d0d-4d17-b0d9-934d7ae98d47", "comment": "Malware payload (RedLineStealer)", "value": "b823cced45060c3bc3cdb2833e44b3e70cc49982", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516319, "uuid": "4628753a-c0e3-4924-a5b7-eb3e7123f8bd", "comment": "Malware payload (RedLineStealer)", "value": "c534032648fafb242e6d8cbeda8b6111a90be1917086e794c6a78332ab86180a68665ccd029a778464c60dc054e1fcd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516319, "uuid": "9c6abda8-ce14-4e39-a08c-fe0c47035154", "value": "T175B4F0CA25404533CF63CDB2E4EFF9D65E7A202007B54BC7230C8AF58A566E4A61B57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516319, "uuid": "8ed1dcf3-c882-467a-a42f-a98e2da3b754", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516319, "uuid": "fc3fc9bf-e43c-4878-9a61-eebb4c2c209c", "value": "12288:k+Oet5Tey5sEAQxbRBKImPHu3bLDJfdAib42QJQmZ:k+OgTey5sEA2fKIASbLDJfdAiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516319, "uuid": "cfa8cb94-e320-4908-8919-66f1f6b3c19e", "value": 541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516319, "uuid": "5aef9f3b-c661-48f7-bc4e-6bc80864861b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516319, "uuid": "d2d558e6-a433-4cad-9964-eb3c32f24d5e", "value": "396fd8c2c5e5776e02fa7aee7145ac95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc34520-11ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687520209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520209, "uuid": "6cb0f8a1-ffbf-4087-846c-aa920cb504b5", "comment": "Malware payload (SnakeKeylogger)", "value": "d7e6b486af912ff5fe2b589df62859b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520209, "uuid": "8b49539f-fa22-464d-bb2e-344e1d959053", "comment": "Malware payload (SnakeKeylogger)", "value": "f219d03667d983f7952ecfd96c3d53feb9e6b7671efc736a3edeb8662524eefc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520209, "uuid": "925dfaec-c6c9-4ff6-a43a-8c6417b27dfb", "comment": "Malware payload (SnakeKeylogger)", "value": "d0b41878a16172d8565eac63083507e6f8205c0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520209, "uuid": "5eb3cbd3-5da6-4767-8432-72c618e02b15", "comment": "Malware payload (SnakeKeylogger)", "value": "17defce3027c35a7eb4d4bbb9880f8936c295806952b9d7cb87ebb2bed702200346b16736c93145d8415b3f7a5ee123a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520209, "uuid": "8f0caade-894a-4350-901e-c824bcb382b7", "value": "T174C4AE3467F45F26F2BE5BB4A4F310148FF8B689E11AE38E5D8018DA6853701AD51B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520209, "uuid": "abbafabb-be0b-4317-9797-ab7357d018d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520209, "uuid": "e00d1050-83c5-45d8-9646-b782d551d1df", "value": "12288:tbmqRZ89NNZDGiQ8C9RyfOBYi5TlAxamL:RRZMXDn/C94Gqi559Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520209, "uuid": "20c51e28-2e1b-4466-8917-10159ba80fb2", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520209, "uuid": "f8285ca5-1631-4b81-95a8-2d2d8c53d048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520209, "uuid": "c93f56a1-f924-415e-8342-afb4cdf1341e", "value": "S098756789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e269a626-11b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687519626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519626, "uuid": "4a203974-471d-4949-9941-98db1f85102c", "comment": "Malware payload (Amadey)", "value": "7de6eab58fbff5e7cc2a1baf9e879662", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519626, "uuid": "ef0b5144-13d5-44bf-8343-c41eea76f123", "comment": "Malware payload (Amadey)", "value": "f2a9778a35d7d1f46de88611e8432bbb97fc16147201660273eb1333a59d7ddd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519626, "uuid": "41097786-30c3-4b18-a6bc-a4a80caf04f0", "comment": "Malware payload (Amadey)", "value": "a9e100980b83e936e11271e15f02be85887752a3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687519626, "uuid": "0255576a-30fb-46b5-8f72-2c9182e7ebe6", "comment": "Malware payload (Amadey)", "value": "22520e6cd3d51d570a71f5c06b7ff42dfffa987c7903de302ac3bd6277e964f62b175f2d9fc5c406028b59f4ad6098b3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519626, "uuid": "9aecd91c-c75c-47d5-9269-6555352ed933", "value": "T1E9B4F1DA75404533CF23CCF2C4EFE9D64E7A60310BB547C7120D9AF54A462E8AA1B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519626, "uuid": "478da1fb-212a-442c-94ac-6d1907d7f176", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519626, "uuid": "a657a7ac-ce38-49dd-97ff-3f119a83ef1c", "value": "12288:ZiYPfTey5sM3ciOyNPb/RuOABPliaNkB3j4GRb4SQJQmZ:ZiYnTey5sm1ZBb/4PiIWTHR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687519626, "uuid": "9bb97398-9ab7-4263-9b47-f2624252ec60", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687519626, "uuid": "2c225e5d-3d86-4b58-aafb-d6181b2e4798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687519626, "uuid": "ebd692de-b053-423a-b5e4-2a098918eeb7", "value": "7de6eab58fbff5e7cc2a1baf9e879662.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629218bd-11bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687521130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521130, "uuid": "509fe4e8-c08b-4f02-b723-a6f915c4a21a", "comment": "Malware payload (RedLineStealer)", "value": "dfcca5cc6445817308f644a1fa5db899", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521130, "uuid": "86763284-3a73-4e07-982f-532b99e98495", "comment": "Malware payload (RedLineStealer)", "value": "f2aef8e9511e9f5ee49b76ab7d04703cb2fc478c0c66809d97136be681b0d7b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521130, "uuid": "515d8c0e-a27b-4d87-812c-0be78dcd61ac", "comment": "Malware payload (RedLineStealer)", "value": "6890254739232cdc06a06a34059c8f122fc58f1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521130, "uuid": "098088fa-dd9e-4b8d-8749-9d48ea2fa3a0", "comment": "Malware payload (RedLineStealer)", "value": "c3b536b001d0ee36630103a8c052afd932e0e803458cc542f171639109b18fee69d28d73c0ba7e05a27dd973c7fdf4cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521130, "uuid": "33a8a91a-3a78-4870-a26d-dab1a84799e2", "value": "T1B7B401CA258049B3CF73CDF194DFE8DA8E7930214BB14B87135DA6F54E852E4A21B53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521130, "uuid": "b3192a66-ac53-4fbb-990b-94d3f1e39191", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521130, "uuid": "d698f802-40e7-43f9-a359-8048858d4f43", "value": "12288:ttTxHTey5sD2M0tXmuiMWKow12Rj2uXMuQJQmZ:ttTJTey5sHtdcowQjhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687521130, "uuid": "4b57e813-539a-449e-9d41-c93ccaa78071", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687521130, "uuid": "7a25ee06-0181-4b1c-869a-c8599df61519", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521130, "uuid": "92510bb5-645c-4840-8fc7-a54c931b8ce1", "value": "dfcca5cc6445817308f644a1fa5db899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64397d0-1189-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687499446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499446, "uuid": "e9de902b-0ba6-48bd-937f-cedc15846134", "comment": "Malware payload (Amadey)", "value": "321ea469dc5601a5877f39966a04b678", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499446, "uuid": "582c0a20-9723-4fdd-b84f-27f0e0b01085", "comment": "Malware payload (Amadey)", "value": "f2ba1fd143d885aa09758b8d83fc427ff50a459a86d2ad6ecc7f3eda02ed2fc3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499446, "uuid": "c57a9573-a92d-4c17-887b-73eb8247c774", "comment": "Malware payload (Amadey)", "value": "505c02ccaf5dc50a2f54d0627ed0bf2fdb5d0fce", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499446, "uuid": "ab817a28-74f2-401d-b9b9-f8e0d9c64508", "comment": "Malware payload (Amadey)", "value": "8c7ca6983aab4bb8143805b5a5251b23125ece3f103f8b97c5122bc5dcaf5426c6a4be3bc69124ed050078f1af526d69", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499446, "uuid": "4f93fd7b-f8ec-4ae7-b353-5251b459905b", "value": "T1CBB4F1CA21008963CF77CDB2D4AFE9D74E7921210B724B87130D55F60E426E5A62BA7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499446, "uuid": "68f0d209-f94e-4863-a94d-493f6f8d4995", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499446, "uuid": "4704ae93-cf41-48c1-8f43-2b7b45c3d2ea", "value": "12288:80OE/Tey5sM2SlMpTZzNHraOB2kR3kD4CRmQJQmZ:80OaTey5sBSlSTZdOOsk1kEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499446, "uuid": "055c40cf-2c56-49ba-9609-14b24b0ff1d4", "value": 542528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499446, "uuid": "8bc54ffa-2b07-4398-bf23-f828b9df0de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499446, "uuid": "793e8ce0-8ee9-41df-b4e2-ef80ed6615ee", "value": "321ea469dc5601a5877f39966a04b678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8f4310-1190-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687502354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502354, "uuid": "97285a2e-1af0-42d5-b7f4-b26a1d95548a", "comment": "Malware payload (AgentTesla)", "value": "973fab6c87a01b969ef076604455820a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502354, "uuid": "c4e70f4f-6f2e-4526-a878-6e86484935bc", "comment": "Malware payload (AgentTesla)", "value": "f2e01529a26872acb721dc505ed8da138c9e5d81efe48d6e10829ef694cb4805", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502354, "uuid": "e68a1ff9-4b69-4d10-8b5a-e14fadfbeb7e", "comment": "Malware payload (AgentTesla)", "value": "4c043cc7bcb474357f9deb63f59034706f6def46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502354, "uuid": "f6bb9fd2-d109-4ee0-8073-7c4183f9f856", "comment": "Malware payload (AgentTesla)", "value": "20f23c8cbdbbd69fa526a79450e2b431d1229674889b19b84108c32977a0296a0017cadb8ca2273bdd5982a05b936f77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502354, "uuid": "2a964cf6-2eca-49db-80e2-df0c5bcf0010", "value": "T14D54122821F0D0ABD8F247B0DE754A967EFE051228F0E50F27111999BD2F287B99D763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502354, "uuid": "7e3d62ae-6b1f-45b8-8380-2afc5295871c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502354, "uuid": "fc2abbfa-dad8-429d-89a7-96d503e9359f", "value": "6144:PYa6Utic5E5df6HSiDF+gwXl1pz4F24dKzAurHCm5lxSCzxvj2Qtj:PYqsrjfT0wD4hdK3rntxvPtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687502354, "uuid": "41c90f65-a86f-4f2d-82b5-67beebfc2ee9", "value": 289829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687502354, "uuid": "a86fc9e8-c689-4d0b-9e1c-1e1df87ee400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502354, "uuid": "2b7fe69c-4482-495b-a8f6-3a0633925913", "value": "payment confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf567de-11ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687520530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520530, "uuid": "d4a03204-0209-4647-b72e-c9605d487abd", "comment": "Malware payload (RedLineStealer)", "value": "01e913d42c0a1c326828cc9c87d38fae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520530, "uuid": "bb7c5039-c242-4fb0-8452-182e8cc23b08", "comment": "Malware payload (RedLineStealer)", "value": "f32c74c0bfbd26b155059d61b8fa3b83c78bd55cfd6d80bee529b948290ce1b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520530, "uuid": "f149f738-f785-4665-9a3e-996fef2eb662", "comment": "Malware payload (RedLineStealer)", "value": "57d6e81b0d6e551aaef83e78162faae7e61cfbc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687520530, "uuid": "cb675258-eb9c-4b2b-888e-f9fbbd072b82", "comment": "Malware payload (RedLineStealer)", "value": "41f9924f301c3c112bd689ceb1e3b983dea2f1d150149f83c653aaea7a7f4393ea30e0637406cc0b7fc971bb9b302ba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520530, "uuid": "60d93a17-1d31-42b2-8781-30e09c918c7d", "value": "T1FCB4F1C925804873CF23CDB2D4EFEAE64E7971210B714B87030D99F68E466D8E61B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520530, "uuid": "12110bf4-8664-4245-85df-d78ece9e0f54", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520530, "uuid": "c864785f-6749-4890-a36a-4e60ce7161e1", "value": "12288:m6LegmPTey5smNjyCROsJDWfxoiAvV1GcyEEjlybyibQJQmZ:mYegkTey5sgjyuOSWfetv9yTFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687520530, "uuid": "d615aa57-0938-4332-a31c-9903e6240a31", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687520530, "uuid": "d073630b-c14d-400f-9be4-b0dd7dd8cb88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687520530, "uuid": "ed8c3474-5b54-4c78-b560-36819beeb155", "value": "01e913d42c0a1c326828cc9c87d38fae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35647af5-11a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687510316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510316, "uuid": "7a01c0eb-f433-4dff-b0d0-3c30969cb0f3", "comment": "Malware payload (RedLineStealer)", "value": "532eabe42d3cd60594dec50ae1876062", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510316, "uuid": "0f3a6249-9ede-4b57-b03c-7b2c6a189d25", "comment": "Malware payload (RedLineStealer)", "value": "f3e03baed982186978c424eb7696f9df1989788364c02b2ab3456b518ab5eb94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510316, "uuid": "3532abff-cc16-4ddb-b771-d3bbcc73fcd8", "comment": "Malware payload (RedLineStealer)", "value": "2443b3025e0e2f1f1f0bb52d895a7370b10e21aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687510316, "uuid": "938b6d1e-c8cd-4357-a960-bc9a0749939d", "comment": "Malware payload (RedLineStealer)", "value": "e692f8d68e247c4a372434faeebbb1f7a2f027418ae86646b184f1cb5ce04bf2ec6a2aae2bde0138f5fb95a01b17cc23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510316, "uuid": "7c7a52c3-ba04-418c-8ab5-5c76e0bb059c", "value": "T114B4F1CA224009B3DF67CDF1D8DFED964E7A72210BB54B87130C9AF54E052D4A61B63A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510316, "uuid": "1f399d8a-c01c-42a6-b60b-1687ffcbe0b6", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510316, "uuid": "8f3f5ba7-d123-43a4-a0e8-1aebcb598fa1", "value": "12288:4vEr4LTey5szESVQzK2XBVVG0d+7nZUEtn/8M0uRQJQmZ:0EriTey5sdHmrQ0dKnZBkHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687510316, "uuid": "662cf7ad-fda1-4aff-9f02-4d6345518f27", "value": 531264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687510316, "uuid": "d620e0c2-cbb0-4eca-8138-191e7dbcc9e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687510316, "uuid": "f25f3d1c-dcff-4778-8b16-8a0f023e44d1", "value": "532eabe42d3cd60594dec50ae1876062.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2045fffc-1200-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1687550224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550224, "uuid": "a07d971e-0ae1-469c-aaed-e7b5acaaa7b8", "comment": "Malware payload (Gafgyt)", "value": "e748e162c8c8cd40a8312e44e338f50b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550224, "uuid": "d19c38bd-beab-4931-91da-fd5a3aaaca80", "comment": "Malware payload (Gafgyt)", "value": "f4187fb86c95455db2244f15c68a26a9908f2516bf440c9c6546a8a5666daf5c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550224, "uuid": "0a49f990-67a9-4c06-9caf-9f12719bb492", "comment": "Malware payload (Gafgyt)", "value": "989e8096d6f4c5fa1b44ab5dc9850d5c2ba910b3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687550224, "uuid": "fca82ee5-56f0-4805-86a0-ea3b5beb850a", "comment": "Malware payload (Gafgyt)", "value": "584ba59006ac82c3d638ae3920e84249a13073a89ca647b49006a5d215a37e92e57ed0f8255bac650402b397347178cd", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550224, "uuid": "05ed531b-0c92-46a5-b314-21e83611d90a", "value": "T181B31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550224, "uuid": "af848899-56c5-456a-88ae-385050bff451", "value": "3072:od0w4SAewzi+Xn+8Uhw6W+aPzJmDk1c8xF6KjW:zfO8IBCJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687550224, "uuid": "4b914676-9b46-47aa-a6e3-097d0c4207c9", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687550224, "uuid": "464a5560-e37e-4a66-b9bf-331a98dfea16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687550224, "uuid": "9aac7c4e-6068-4f39-897a-2bab99ecc12c", "value": "e748e162c8c8cd40a8312e44e338f50b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1c71d9-118e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687501278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501278, "uuid": "70784f6c-ea1f-400c-8427-b76dddd7f3dd", "comment": "Malware payload (RedLineStealer)", "value": "d7a01b7d12f0643086b28fbab2642075", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501278, "uuid": "74a11690-32c0-4ef2-95b2-ee3d0c3ba7a6", "comment": "Malware payload (RedLineStealer)", "value": "f4212e8881d01eaa6c057fa155d7df70f6a3a31537ecbe45507d0e6855ddb8fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501278, "uuid": "303c6d08-021f-4403-8cf5-e0cf4e6ea9a3", "comment": "Malware payload (RedLineStealer)", "value": "b5af8a46094cda3a20c690a914d6b5cda1210221", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687501278, "uuid": "233e5003-2cfb-4a62-b08c-9c52106ee193", "comment": "Malware payload (RedLineStealer)", "value": "349f33914d1299c05299bb5bf4455b2ae7e0906ee9c746def2e84cac6a22d21d76503ebf553b86c43e2b1568b13b968a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501278, "uuid": "571b7b93-70c5-4f27-8d0c-5b6f71297e41", "value": "T132B4F1CA25804973CF63CEB190EFE9DA4F7970110BB64BC7124C89F68E455E4A61B93E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501278, "uuid": "ab84935d-836b-47da-a77e-c5d50b6b1722", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501278, "uuid": "8736a9bf-604c-468f-b0bb-6358cb30ee3e", "value": "12288:605czTey5s7FImDU0uH7V6bqkZXSix27rgZQJQmZ:605iTey5s7G+U0y7V6b5lx2nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687501278, "uuid": "6b6ee09d-5506-4234-b0d6-ef68c4157b31", "value": 542016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687501278, "uuid": "fe4dcee6-a48c-4111-b29c-466b0cc8c68a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687501278, "uuid": "3018c4f1-a770-4e81-95fd-5d92f54bc095", "value": "d7a01b7d12f0643086b28fbab2642075.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87c6134-1199-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687506214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687506214, "uuid": "4cb54a49-c10f-4591-8088-acd8dd2d8687", "comment": "Malware payload (Quakbot)", "value": "d08fec647dfea215cdb3fc6409336912", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687506214, "uuid": "4a45d2db-45ea-4ea2-a89b-df8921ae26f9", "comment": "Malware payload (Quakbot)", "value": "f4833f0c2227976b4918e9999f929d22d6e9d8242dafd80f3e0619846d00939d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687506214, "uuid": "046f253b-7ced-4c41-9e99-b2efc46c4ee9", "comment": "Malware payload (Quakbot)", "value": "173e9d89b9a98aaf2b86df63b64c74c308eb81c2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687506214, "uuid": "56ff345c-6dbb-4a20-ae33-91d26b477551", "comment": "Malware payload (Quakbot)", "value": "47828112066ae4e16c90e392bad60faa71e83c8fa1b78a5d6c2435c1b23bd2b46eb00655a23cf46100e44fdb76008c8d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687506214, "uuid": "0632b23b-8505-474d-90a8-1310aac13776", "value": "T1D8558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687506214, "uuid": "c6856a32-645a-4c3b-9d73-b0a0162a104d", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687506214, "uuid": "809fba22-63d3-4b9b-8293-e5f7a01096c1", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4ygQ:QbkS7XB1EsOSNPSp0EAt2bUeM4ygQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687506214, "uuid": "25a99daf-d41e-483c-8923-8fbc9040197d", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687506214, "uuid": "ce1e4edc-2c1a-4298-998e-1d5682f1399f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687506214, "uuid": "505caea0-55a3-48f5-9735-999dcb1ea468", "value": "vodka(1).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd2c31d-11b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687516934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516934, "uuid": "0e0a4e05-bacf-4112-8de5-d30db9abbd52", "comment": "Malware payload (RedLineStealer)", "value": "5d4e506af4f991af0a2ef5c268075055", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516934, "uuid": "bcbba03c-6223-4e96-99e2-bfe2d171b3c0", "comment": "Malware payload (RedLineStealer)", "value": "f51b69d826ba9d289116cba61629a4478e2cd2aa0a859b860b9a8f036a4877bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516934, "uuid": "7a84ab5b-58d9-4803-bacc-e6de05d6192a", "comment": "Malware payload (RedLineStealer)", "value": "0e16acb12e036227359b3a9c687477b61512aa9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687516934, "uuid": "58ef3896-9169-4952-8e13-4e2ff27a78c0", "comment": "Malware payload (RedLineStealer)", "value": "054c1bab322c46617a22bf4762198a31a53381795dcfa041445344c58f9a5eb3fe534e08bef0be05276ce2ba082b1e4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516934, "uuid": "e229bd11-12c8-4b7c-a058-34eab1643767", "value": "T196B4F0CA61804573EF63C9B2D4EFE9868E7670314B718BC7130D8AF28E526D4E51B53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516934, "uuid": "b6d4811e-35a0-43c3-ba36-7da2fe46ef66", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516934, "uuid": "02b6b0b6-44b5-4479-b3c0-4332253ae09f", "value": "12288:5oiWFTey5sxQl7TkXprsYxgZMUSWcJlRt1PsHkCQJQmZ:5oiGTey5sxboZMVpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687516934, "uuid": "f70ead68-58f0-4c85-9ace-3a5c4458b290", "value": 530752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687516934, "uuid": "eff84185-d159-4dd8-83dc-1c96d92f4803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687516934, "uuid": "db91e5d4-4e28-49e8-a9b5-ad7e37cb5dfd", "value": "5d4e506af4f991af0a2ef5c268075055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ef3831-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500967, "uuid": "5bd7005c-d887-410c-8ff3-7b4a3e0a72f7", "comment": "Malware payload (RedLineStealer)", "value": "b9e4ab830cec312873f5ffa6927da9ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500967, "uuid": "3236d02b-5b33-4eea-aabc-d9b3fc276147", "comment": "Malware payload (RedLineStealer)", "value": "f5fccebac35756cf925775c6526084a0a8086ed7d7e9076f4c2572cfe6f93e9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500967, "uuid": "f29c56ed-066e-4172-98ef-fd79b7f13de2", "comment": "Malware payload (RedLineStealer)", "value": "07b8e4bd662b5d33754fccffb9e639c6063d89a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500967, "uuid": "d68948ca-2af4-4ed7-957a-a682e67940da", "comment": "Malware payload (RedLineStealer)", "value": "57613d27f04ce66120d7ae179cdce1e919c553f4f562c8b9c19d36ce13470adb1671ac80212dce27bb487ef41ff54a21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500967, "uuid": "b3f250f8-578d-4f62-80fc-6746111738de", "value": "T1FEB4F1CA25004973CF33DEB2D4EFE9D74E7970314BA24B8B120D89F58E552E0A61B57A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500967, "uuid": "a8d67aa9-1aad-4fe1-b69e-9e3661547dd7", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500967, "uuid": "9fe773c5-387e-4a8d-83be-229afa7968a1", "value": "12288:EPtTDLTey5ss9bb5eN6jzMYoU1QlwjBUuVlkVx6Weq7QJQmZ:EPtTXTey5s0bbMCpGwjLVlE6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500967, "uuid": "cb3b7136-191a-42a2-9c68-a6ef829fa69a", "value": 532288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500967, "uuid": "b4fd68c1-09c2-4ca0-8548-cb9c0a685e1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500967, "uuid": "20d859f9-a58f-41db-b5b2-fb2c5bb8c12b", "value": "b9e4ab830cec312873f5ffa6927da9ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faff52fa-11d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687532552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532552, "uuid": "6a787177-f900-4b78-b254-04d80d9eb931", "comment": "Malware payload (Amadey)", "value": "fd4d73d85121d9c8bb04e1337fdb0d1c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532552, "uuid": "39855838-d2ab-433a-8574-4c4f49c9ccc7", "comment": "Malware payload (Amadey)", "value": "f69cee0856104a6f573df94d0c64ef873d1f56beb7d4df72084d21f68679e709", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532552, "uuid": "56531400-281a-4009-8040-9360250f6a0d", "comment": "Malware payload (Amadey)", "value": "61522a91a3e2f6ad5f35382efb40f29990eb38ae", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687532552, "uuid": "040de080-c3c3-45ef-be40-c870b29f8faa", "comment": "Malware payload (Amadey)", "value": "4d9ed849a4a1a8ec207e47fc027df380e939bebbceb08234a58d2a987e454500afbb316b877e08785a4726ef64585649", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532552, "uuid": "d7effa78-a95e-43e4-8755-5e4692bbb934", "value": "T1C40612392A40D633DBDB2535D567969F482C6AB1094FBC4A3FA70D279AA70ECC4347C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532552, "uuid": "a662ce29-d4f7-4c94-8fc1-915a00e50aaa", "value": "fbf286c9ce76265e80d8e6163a44efba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532552, "uuid": "865122f9-f223-4b39-b7fa-df66055f701d", "value": "98304:vlfA2r7TP9XxCU1Qd29IN4OqM4XHRlEYpx8Ua04ed6WRzOrKPSGJrBSoRypHb51p:vlfAmxCU1iAMyEYpTay6WRzOrKaGJs4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687532552, "uuid": "8d588782-7d8c-40a6-bec8-b4409155d80b", "value": 3787776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687532552, "uuid": "c91daa43-ea93-4dc1-b221-6c909f523f41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687532552, "uuid": "7d3d6c83-0ca3-4032-80e9-fb433a47bc87", "value": "fd4d73d85121d9c8bb04e1337fdb0d1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2eeca68-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499763, "uuid": "2fcdbc59-3a05-41dc-b830-011f235ccd31", "comment": "Malware payload (RedLineStealer)", "value": "50dbcff5d09edcbc319b13d97fac047f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499763, "uuid": "65d9ee48-2d1a-490a-a006-ff94160765d1", "comment": "Malware payload (RedLineStealer)", "value": "f742febfd10cb7d19f21759f6d725c40ce90fb1a69013adedfc64b8dada81925", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499763, "uuid": "f11067f9-56e3-4d18-bce4-39b3a60d66c3", "comment": "Malware payload (RedLineStealer)", "value": "9e01fea475573eaad7370f5e91ea55b32037700c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499763, "uuid": "42859410-1abf-4afb-8184-a84c84de3eb0", "comment": "Malware payload (RedLineStealer)", "value": "367c1201f1e0192b9d86d8876d52cd0f3c05feccd163152819f566dc4045e049bbb79e392e70580f328396e4542c1112", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499763, "uuid": "f897d18a-9816-4507-867d-f43562eb4e76", "value": "T10B444BFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA284CA19BA0952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499763, "uuid": "9d525df8-9c14-42b5-bb83-a0ef1193f624", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499763, "uuid": "aa7ea45c-cb35-4f49-9818-ef3a812ff214", "value": "6144:d4mO1HjtSKJigt0poiRG/XvLNUgYhuE22JQJQmL:d4mO1DtS9gtAoiRG/fSvhQJQmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499763, "uuid": "780f6ac0-1856-40d4-866b-4d4c27eceed3", "value": 276293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499763, "uuid": "92687411-13e2-4e41-a9f1-ea1f6ae2b1a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499763, "uuid": "880f8d68-73a3-462e-bb4c-714214901b62", "value": "50dbcff5d09edcbc319b13d97fac047f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a4356d-1190-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687502485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502485, "uuid": "f75ff5ef-9821-41e6-8baa-aa6885abb280", "comment": "Malware payload", "value": "2d04da19b09c4866849fd3ad62a13488", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502485, "uuid": "7b9f445f-ad0e-42e4-8392-44c7c37f11d6", "comment": "Malware payload", "value": "f790f80920a6bf4c53ffb43269df9c3abf206d44bbce5f6b4e1dd2edbf7d5e95", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502485, "uuid": "92c70d37-4ded-4944-9ea2-88a9aabe496e", "comment": "Malware payload", "value": "15b2b336207bf835e06fd453fdf0522791b13a1d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687502485, "uuid": "66288639-e62d-40ca-959a-8830ea4f3feb", "comment": "Malware payload", "value": "6d1bf5680275b21e0021617f3ebf03ed947d37770ce8d9fa8e7c66fd8c1edef4f1a3c496863acde83f0503dd6b2cf5e0", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502485, "uuid": "c282387e-b497-4d99-92d7-d51eb1510602", "value": "T1FED14C6CFA2A166EC712A375E9242BD6F11A5184E45C92227170E398B153EC8366F1E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502485, "uuid": "33b694db-bf0e-44c2-ae92-a8cc5a4064f9", "value": "96:fsRncyVAmqFxxHC5F76vUd2i1hq2avIWGzbpgJ/BgQ8qRynfn3vrshl/:fAncyqmqFxxH7w2i1MgzsOBnfn3vQP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687502485, "uuid": "07c2ffc0-f865-4fbc-b683-13b24b93e24e", "value": 6203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687502485, "uuid": "9f6c3fd0-6434-45fe-8a34-cb53307a69f6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687502485, "uuid": "6bde4406-0dd6-4346-9400-1018e77d0fbd", "value": "Braemar MTM Report.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84e4928-1181-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1687495906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687495906, "uuid": "c0c510ae-8984-46bd-84a7-b209c170820e", "comment": "Malware payload (Quakbot)", "value": "b6edeffb9267c868f42d68bc33a6f047", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687495906, "uuid": "3792ae92-ce1b-44ad-a5b0-f5ff0f3d3e61", "comment": "Malware payload (Quakbot)", "value": "fa1045fc59b04921565babcab31099e929c0671151ae23f8b515aeffff9b671e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687495906, "uuid": "b4cee566-8e2b-418d-aee5-480e5cb1cef6", "comment": "Malware payload (Quakbot)", "value": "9ed5888f0fbbb7820359e6cc6a66a56d3f683b73", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687495906, "uuid": "7de75e82-45fe-4714-acb5-f33a97d9f236", "comment": "Malware payload (Quakbot)", "value": "7c011691ab95345122615b120a84adbdebd62a673fe8c2e7e3a9ebaec37e08f7a7322120407aa2331a3bb1c8ca655c99", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687495906, "uuid": "4e136175-a117-49ed-913c-0ac12ae2e0ee", "value": "T1F674496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687495906, "uuid": "87ff14ab-abd3-4903-8c66-563caedbd1fe", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ5936:fIS1xb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687495906, "uuid": "d3547919-10a0-4261-a374-457bf081bd29", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687495906, "uuid": "f3b9f4a0-1f39-46c2-92fa-cf6688900a1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687495906, "uuid": "b24a78f7-1b71-49e5-a963-10018554b5c7", "value": "1_qbot_downloader.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c163f720-118c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500673, "uuid": "3a00ef72-85b1-46f6-970d-8978ee4c3d7a", "comment": "Malware payload (RedLineStealer)", "value": "a7d54971870181270ac2ee7e1ce94d76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500673, "uuid": "9f2a4974-1c92-423e-ba7f-88597b093071", "comment": "Malware payload (RedLineStealer)", "value": "fb401e83ffbb271372c4cc3c8e7fdd869cad35f6e678e80fe3fac9b80535a075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500673, "uuid": "bcbd9600-1957-4cec-8cff-706bc40506f4", "comment": "Malware payload (RedLineStealer)", "value": "dc9c51768cb5cd9efa7a8d1427e1d377f505be74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500673, "uuid": "113eeda6-3ddb-46f6-9dec-95c49e87e192", "comment": "Malware payload (RedLineStealer)", "value": "f567736e70c36611f917176b150760faf22de5e90a5fb0dd992f507c5e927342a9676099a1cad7b1c44cf64a71a00ca8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500673, "uuid": "06310f68-c840-40c1-bc0e-70bfa27432d6", "value": "T1BFE401CB62804873CFA3CDF1C4EBAAD75F7AA12007754B87120D8AFA8E456E4D50757A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500673, "uuid": "18720473-700a-4201-8eb1-8c5c11a9b40b", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500673, "uuid": "cc29f68f-2ffd-4a25-9931-8be386a691f3", "value": "12288:0tTf+Tey5shKS27tB7AslqwnyQI1rfNEWBrZ8wCpCTf3nhsnct/vQJQmZ:0tT2Tey5shKS27tB7rAwnerfNrZ8pGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500673, "uuid": "a54a8f44-8982-4117-875d-b597681bd33f", "value": 715584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500673, "uuid": "6a2fe4ad-e914-485e-a759-229b7c84aa54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500673, "uuid": "7ae3420b-648e-42bb-8b67-72bf6cf3f796", "value": "a7d54971870181270ac2ee7e1ce94d76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72dbb64a-11e5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687538766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687538766, "uuid": "accdea10-1cd3-4429-839a-a744182a7bd1", "comment": "Malware payload", "value": "e1aab925ae1627cee14bf6512afb0d1d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687538766, "uuid": "d2b1d709-c196-420e-925c-156857e77289", "comment": "Malware payload", "value": "fbe2cebd6a7bba2718df43e42e91ae31716d20e6cd4a1de1856ad8771d51bc3b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687538766, "uuid": "76e68cd1-4f1f-40ab-bbac-567cf74924fe", "comment": "Malware payload", "value": "792be774bf8a09112156aa954cbfa982c0503213", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687538766, "uuid": "020a257b-a574-46ef-97ab-7bcd65060575", "comment": "Malware payload", "value": "90680e079b3e6cbbf16562cae3632f37592aa1d04cfe7980bf76dc6d88c3dfd962f1420a3b9fa37e3a33934bce046a37", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687538766, "uuid": "1e06fa41-a04d-4666-aedb-f10ef6dbc177", "value": "T1BA842303A6EA1DC9F1E22A076A7B50B44BF779A1663DC45C50CC0A0E4BE3E5C8D55BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687538766, "uuid": "68ea7364-6fce-4cc7-9aaf-443ca7be3f94", "value": "6144:tH7zJGG/NGGTeP5RP0OZYRTnLWGP97bhGGGGYPMVOLgIuO8Vjn23MxzaklL++pUf:CuO8ViMxzaklL++pU+e8+xuVK8ba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687538766, "uuid": "bddeed58-ba22-47de-8bd4-c55506fbfc26", "value": 372312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687538766, "uuid": "1a6b228a-2ace-4c55-8925-1c19fbbc108d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687538766, "uuid": "697a09a8-5176-4f31-a340-97ea93faade8", "value": "Pago 202306.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5139da4-120d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687556111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687556111, "uuid": "b4bbd253-433c-475b-8039-f47ac2c6682f", "comment": "Malware payload (AveMariaRAT)", "value": "b3d4ac091f93689150b8470d2215b53d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687556111, "uuid": "5a5a67df-f42f-4b9e-9f83-d2983527ce5f", "comment": "Malware payload (AveMariaRAT)", "value": "fd01addc511cd631506fa3a1c74a4f0f7a11f5967f87c7f0766be417bae0b1e3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687556111, "uuid": "e61dae33-c0c9-4f96-98a0-0c846f2ae9cd", "comment": "Malware payload (AveMariaRAT)", "value": "08a551501b80c8811b9ed05474ad3203a96c8bd7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687556111, "uuid": "04cdc058-140f-41ec-803b-5036ff9b1117", "comment": "Malware payload (AveMariaRAT)", "value": "a33cedad1edcb326eb81c3f587982020b24c481eb0ae04be95048a90f890b681b0fd5713c844c2b45f6f26ae28297b7d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687556111, "uuid": "042fc49d-1c14-4e27-ac8e-7475ed007b84", "value": "T1D6D4126902B10E19F93F2BF5A9B48518C3B9BE105F12E62E2FF230E20676B555E03757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687556111, "uuid": "ea47765d-baea-4769-9a1d-0543f8fbff72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687556111, "uuid": "d4a9c223-1c70-4bf7-8a86-8d3338bc6e35", "value": "12288:d2iNG4/mNUAfbnvBOohyQGgW0U8WdcukgO/3RaBvMwGf5VBF7R:d1M4/QUmrFG7QZ/BaBvnAvFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687556111, "uuid": "f03e69b7-d178-4ce9-923b-2ef4d136844b", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687556111, "uuid": "65bdded4-e417-4522-8c3c-0b8bd34f34c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687556111, "uuid": "6f9d6b1f-12d0-4aa3-843b-d83d19192c30", "value": "INV2023.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a622943a-118a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687499768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499768, "uuid": "05597f0b-3856-4df3-a170-877dcd943a37", "comment": "Malware payload (RedLineStealer)", "value": "58e51e4c9352383ea7a967ce0a48c668", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499768, "uuid": "0ede9ea6-7c06-418a-af7e-fa3c7ab794ac", "comment": "Malware payload (RedLineStealer)", "value": "fe594af07a31017b551c5ee2408990cbb3cbcc3eae0e7631640d68c70d338811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499768, "uuid": "c4d2b21f-23c0-434e-bac0-089a9771650c", "comment": "Malware payload (RedLineStealer)", "value": "14a865c84058e7dc5014132ca8688111abd36d55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687499768, "uuid": "d8922266-a9fa-475f-b803-9e3dcfdb4f0d", "comment": "Malware payload (RedLineStealer)", "value": "d651e34369dbe09671025d20c8665eefa08472724230c6d530a5290164ec205d3121b86cd006aef674a16f6ee74b4ebf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499768, "uuid": "5e686669-b70c-49b1-8e38-a201ebadb86b", "value": "T1FE444BFB52D1D460DD0FA4B02C6EE1BDEE31B461DEA284CA19BA0952D3530E4BCE758D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499768, "uuid": "973219d2-d368-4873-a7a3-e8b0b2a16739", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499768, "uuid": "de8def50-b8cb-453b-ac87-7a1cec6715ba", "value": "6144:xeeFKigt0poiRG/XvLNUgYhuE22JQJQm:xeejgtAoiRG/fSvRQJQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687499768, "uuid": "48b1a97f-13a7-475a-ac30-a705dc07c06a", "value": 275782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687499768, "uuid": "9edb2e2e-3d07-46a6-9fbf-40a0256e0ae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687499768, "uuid": "0b7b23d0-8c69-47ab-accc-cd3c02b1a5f5", "value": "58e51e4c9352383ea7a967ce0a48c668.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e089008-118b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500050, "uuid": "0236c5f5-6f8e-4169-bcc0-1c1f885b00a5", "comment": "Malware payload (RedLineStealer)", "value": "5999ee2ca9368aa56fdc940e3de75fe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500050, "uuid": "31a61978-03d6-4ccd-b718-c2a8ce3028fd", "comment": "Malware payload (RedLineStealer)", "value": "fea7cf2c35307452cc39bac8bbf21723b9ffa3a7a9101a3d35df6db80ada408c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500050, "uuid": "0243bbb9-f317-4366-abe3-deb0c0947c5a", "comment": "Malware payload (RedLineStealer)", "value": "747036c9fe84f2ece6f23d60fd96d3a9b3c02a77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500050, "uuid": "ca1070cf-4092-4916-8c79-9742c4470d0e", "comment": "Malware payload (RedLineStealer)", "value": "8ac94495ccd840f2c0a98f99aaa82d8f5f3519f0a391ed32b8212cedf9852f82bf0cdaea9b939d9433998e50168b3c85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500050, "uuid": "d2671102-011d-4566-a253-263103535ec1", "value": "T1C1E401CEB1408273CF27C9F2D8DFA9D65E7A71214B760BC3120D89F54E462E4A51B93A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500050, "uuid": "153df081-a2ee-43c7-b587-6a6fe1203d11", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500050, "uuid": "b0439ecf-ad2d-4a15-8193-731c312b2cb4", "value": "12288:C6EF/sTey5silp1MQywrzRgjPMA8RIhS0PAUhTQwJfnHQ+EE+cXvjk3hkf2ULpvK:HEFUTey5sipiQyiN0P3/PPD+SChUHLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500050, "uuid": "b138244c-c06a-41c8-bb37-b8c645671ea1", "value": 714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500050, "uuid": "2e85e4ea-27cc-4a44-8103-7e305a5f5370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500050, "uuid": "93f784ba-71b5-480d-8a93-600b1ef218ff", "value": "5999ee2ca9368aa56fdc940e3de75fe8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6d14bf-118d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687500988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500988, "uuid": "0acceaa8-0c71-4474-8b19-ef1b08b6afa6", "comment": "Malware payload (RedLineStealer)", "value": "b64eb9e24e22d5ee244aac5ad9ffdaf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500988, "uuid": "5a1660f3-7324-422a-95ed-b0db5b0481a0", "comment": "Malware payload (RedLineStealer)", "value": "ff59e068a01f2f4049bab9aa1b8d2f82a457fb8c02dfd02a03f23aa144db9460", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500988, "uuid": "fe133dd3-360e-462f-b134-15fea02f78db", "comment": "Malware payload (RedLineStealer)", "value": "b11802babe3d00c47826d67c2f10fd2d6c730bf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687500988, "uuid": "27eb2bfc-8b0a-47ef-b402-56e14194fc4c", "comment": "Malware payload (RedLineStealer)", "value": "a863581dd57ef52f15e2a772535ca7251cb9902cc420540abbe27077bc09dda2bf5764074e7d8c25363f6749860e9789", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500988, "uuid": "c321fe24-5ddc-4c29-847f-df5f6d63d5aa", "value": "T172B4F1CA21404973DF33DEB2D4EFE8D64E7670210BA18BC7120D8AF68E152D5A61B57B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500988, "uuid": "74623bb4-b0a8-42de-ae29-3ef26b66f8fa", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500988, "uuid": "ecafedad-48b0-4637-8cd3-9bf8037a0944", "value": "12288:E/4mO1VacM/Tey5sET9mLu9Uv5elrl7uQsgxmvcn09UA7EQJQmZ:s4mO1VacGTey5sET8S9ZlrRsgUvcn0Ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687500988, "uuid": "c42511f0-ec3c-452b-8ee0-8aaa56423dc1", "value": 531776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687500988, "uuid": "8cbb4703-01ff-45b8-9834-fb6d1e4878ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687500988, "uuid": "1edb4a41-30d1-440f-a338-defdf1dff3fb", "value": "b64eb9e24e22d5ee244aac5ad9ffdaf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153524c8-11bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687521429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521429, "uuid": "b779595a-2d63-4414-b279-bd65c523a0a0", "comment": "Malware payload (RedLineStealer)", "value": "dc7466d010517d25495ab6f12cbc8446", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521429, "uuid": "da87d987-89c1-48ac-9a37-355885ad2698", "comment": "Malware payload (RedLineStealer)", "value": "ff5d0df729ac430a1345ac550e5c9dd516bc91b3cde96a00bcc83034558f1dad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521429, "uuid": "3e8d30fe-bab3-4807-8b4b-7886d98b9732", "comment": "Malware payload (RedLineStealer)", "value": "2b24387835b1aadcde438db7546638f60088988f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687521429, "uuid": "d7678cc7-e87d-4e6c-8e4f-854c855852ce", "comment": "Malware payload (RedLineStealer)", "value": "38fa293bc5e578dfad09f8559e0711e83d9846ac7bb493fe378eab5d1d9fba9789471c6c0a1cc714fd0c56fd03d57098", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521429, "uuid": "3317669a-5241-4aac-8277-04bb3b01597e", "value": "T10DE401CAB2404573DF67DDF290EFE9C61A7AB11107B607C7130D9AF68B152E0961B83A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521429, "uuid": "c8e8a453-0e12-446b-a33f-c40d84a2fc0d", "value": "00ec575575de41d0435d66fe37ebf010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521429, "uuid": "49dc9408-1383-4a4f-b839-7e03b7750e4b", "value": "12288:Fkv+0Tey5sMqAeg7S47QfcBfpX8QTBaCwghrJHK/Yg3wlw8PgWozQJQmZ:FkvPTey5sMqBSYohXHUghrJqQge7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687521429, "uuid": "2ec8a6eb-df50-449f-b346-7b3ab5a70825", "value": 713536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687521429, "uuid": "4bd230f3-d4ed-40f6-baea-51bce1533bbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687521429, "uuid": "9b707d77-ad48-46f2-803a-99bd12b30d84", "value": "dc7466d010517d25495ab6f12cbc8446.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }