{ "Event": { "published": true, "date": "2021-07-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-07-21", "timestamp": 1626912181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d0336f15-dc42-4032-882f-621588995f47", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fce680d-ea72-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626906332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906332, "uuid": "b61fe51f-46ed-4691-8b01-6314cadeaaa8", "comment": "Malware payload (Mirai)", "value": "8f7f282cbbde517b583cebedfbfc782b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906332, "uuid": "53b1e6d9-dfff-4cbb-aa03-d6fb881f7633", "comment": "Malware payload (Mirai)", "value": "00cb4eb8ca25993d4b484062e724710ffb546564fb39e0f98c41f99208dbb7ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906332, "uuid": "32e10252-2520-4cf7-9650-7a98cd38a08b", "comment": "Malware payload (Mirai)", "value": "7a1dcfe30c9a0975c4191fc5637799f1825aa2f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906332, "uuid": "184c806a-0d8d-42d5-89ff-20feab5b4967", "comment": "Malware payload (Mirai)", "value": "755a58734f1290fe5a3a0cc6d87a3bf3a5e3e324902e8bd88c7cc8ef3db47bf4f57452339c5a16042b0f85d6859f5f15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906332, "uuid": "0f0768f4-d74d-41f5-ba4c-fc377b34583d", "value": "T114B2C070A31AAE73EB70BA30EE3CC10756CE0BF5E8E53533511B0265AA154066E77AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906332, "uuid": "cb92b3c3-ba5f-4464-a434-51062675bdd5", "value": "384:EI2jPsyD0EqZ+O/lUUwq3UdOAwT+oseSQrBh99v7l7kgQACi3BUjD8ERhymdGUon:EIIsyD0EqYOeU3UdO09Wh99vygbFa806", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626906332, "uuid": "9702b16f-173c-4db1-aebe-d11787382220", "value": 24012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626906332, "uuid": "4526ebe1-b20c-4b4f-9e47-47705022218e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906332, "uuid": "d9b7ebc3-63dd-49d4-a996-2ffe80b5f88f", "value": "8f7f282cbbde517b583cebedfbfc782b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6037cca-e9ed-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626849246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626849246, "uuid": "c6de5ceb-6d99-45cc-a4c1-e0441ee7f991", "comment": "Malware payload", "value": "4edcf2c49d6843e47174249b8bc13c30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626849246, "uuid": "618a2a38-3938-45bf-a2fd-40c474011bc4", "comment": "Malware payload", "value": "01581f0b1818db4f2cdd9542fd8d663896dc043efb6a80a92aadfac59ddb7684", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626849246, "uuid": "75be384f-4308-4703-9204-866255f43922", "comment": "Malware payload", "value": "ba8a3140ef52886dfe2c7801be8f0a596c462b73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626849246, "uuid": "16827780-7ada-4533-878a-9edb29272dd5", "comment": "Malware payload", "value": "158152d6a4dd384433851b548feca7940e5692d4f15f2982fd4514775975f7990c2b32db0d2dfd24a0014481cb92d340", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626849246, "uuid": "b26a1a6d-cc96-402b-ae29-bb823247b501", "value": "T1C63429A2B2F62CE6D8FAC1368553E627FDB134144326D7978600475EBF23B90AD39349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626849246, "uuid": "0d74d902-7a41-4fe3-aac9-27143c660f6c", "value": "0663e68a6f307587fde4471586d066ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626849246, "uuid": "a19b4006-e7a5-48d3-bf7b-1affbbc192bb", "value": "3072:5gZtUZWkCgij6KvMolun2UaQOqVbmNXGAfRZupesMK2U4TBf918yJ5fm/1hRuCmF:ymZcjbZQOEmxRCesMKp4TB1JoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626849246, "uuid": "71b6b1af-eebc-44e0-9288-03ea3b7cca49", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626849246, "uuid": "1e7ec13b-e7d0-4688-831d-54f2acdfa8da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626849246, "uuid": "5d794978-53b4-49e3-b283-5b5bbc54fb3d", "value": "svchost64-3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a40807-ea5a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626895960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895960, "uuid": "355d8765-5fc5-4683-8730-1a4e1412e7c8", "comment": "Malware payload (Mirai)", "value": "3bdc1e4366ccccdc5b636d58119b2d38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895960, "uuid": "9f4d38b2-f92c-44f5-8be3-0a8a346d9f86", "comment": "Malware payload (Mirai)", "value": "01e4934f4599473494881a35e2e6d72a1c96cb791343f7874e0bbb7c88bce9be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895960, "uuid": "f9bb6ce6-a800-4b4e-9923-7f4666d1328c", "comment": "Malware payload (Mirai)", "value": "2cffa8d6373d72073a972e0d529c62a92669be11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895960, "uuid": "6da747f7-8639-45c2-8813-b8f19d1c7977", "comment": "Malware payload (Mirai)", "value": "d36cff29a0c7afaba4e9100a5e4b60ca492ca987a6ac489aba4c955b7e0249d931de45b58d612e8f91619f5ebfc43636", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895960, "uuid": "e2942b90-4073-40c0-a87c-5736d8062e19", "value": "T1C7A2D01925CDEE62D170903BE13CC207AEDB47A652FE313E1E1807DCE49581AD6BA945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895960, "uuid": "5d90753f-ec23-4dd0-bc7f-7b464262982a", "value": "384:YAmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSb0hymdGUop5hXh:Ypoh/DxCvhdR4IjWVFbSgs3UozJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626895960, "uuid": "086142b7-cc9b-45d9-9a52-afe4cb767af3", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626895960, "uuid": "1db9fd52-5b05-4618-b3dc-79adc7f7ea78", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895960, "uuid": "c2dd6da8-0df8-4ec7-94c7-444820b0c96f", "value": "3bdc1e4366ccccdc5b636d58119b2d38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d865bf-e9c1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626830373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830373, "uuid": "08027129-ba8e-4c9c-9888-39d76cbda5bb", "comment": "Malware payload (Mirai)", "value": "91645704a739d458b0ef2d7de840a9f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830373, "uuid": "1934d02f-81c8-498f-ac98-b1157cf0b802", "comment": "Malware payload (Mirai)", "value": "0300a2be664ae39fa86bb0c2a8fa6f75ef7fb88108bfe42617f515a8ebdec71b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830373, "uuid": "25f6474b-98c2-4e49-b7cd-499e26684320", "comment": "Malware payload (Mirai)", "value": "d5d3cc157f98369677ec68cd46db4417f5a0f3e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830373, "uuid": "736eced3-d54f-4c5f-95c4-acaf69f92115", "comment": "Malware payload (Mirai)", "value": "9429a47ae1f62df90dab196bc55550bce3a4f88e530d0a61c2b4ebf776beb6d700dc9f3f8965260a0cfeea3da475a5b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830373, "uuid": "3a600e72-a723-4ccf-8a9e-3cb7a82299f5", "value": "T1D4635BA5B801AE7CFC5FDABAC116090EF53073544A930F27E65AFCE76D72094AD06E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830373, "uuid": "2b3761df-18ef-48eb-93a8-6bf55a0c44be", "value": "1536:KjXUOAMJqF6YlpSOMMXSmAvr+R8By3qveb8z9:aXUdMJ46LOvX1uifqG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626830373, "uuid": "a26e507e-f2a4-405c-b749-2db197ac548c", "value": 67248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626830373, "uuid": "8dd35c7d-6008-41ad-9b55-f3cd04d19c68", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830373, "uuid": "e2bb668f-cbef-48d2-8af2-9409db75bf32", "value": "91645704a739d458b0ef2d7de840a9f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea95e68-ea60-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626898760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898760, "uuid": "d56e9fd9-4427-49b0-9645-b34425ca6606", "comment": "Malware payload (Mirai)", "value": "d8e1bc313eaa13e6232c040a66039e8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898760, "uuid": "671b8fcb-ae21-4fc8-ae95-de098d6e0607", "comment": "Malware payload (Mirai)", "value": "0360b2ee40124e8f497d2d1645ae91d4998242cf9d244c896825d35f8bc03891", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898760, "uuid": "d0e55261-67fc-4324-974f-ab6b12c1e4e0", "comment": "Malware payload (Mirai)", "value": "fe421f1b24b15cb84d7a78093916ea5b9d5e01fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898760, "uuid": "67b2e8aa-a7b0-4ea9-97cb-e25cf12e72b6", "comment": "Malware payload (Mirai)", "value": "cf152ea2c8f647b97100e2f186b6eab6853a499b4eeeb87a0333e71311e25a535d8b03adfc40456e3594475b30d08724", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898760, "uuid": "ca07e605-ed63-40c0-be9b-d19b49934eee", "value": "T139C2D0DFF49B3985C91C5CBC25CC5AE115A9A2C3234A9B0837603DCCA57645EB8AC8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898760, "uuid": "62220c0a-b94e-40ae-b7c3-dc43ef8611a1", "value": "768:MLCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBe+qWj:oCrJgHiOJrfwmQrctP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626898760, "uuid": "06f0c653-da16-486d-8ab8-ccd65f24d897", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626898760, "uuid": "6f92c0c5-ed76-47ff-8a0d-14e42ffc5f1e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898760, "uuid": "eb500cc9-23b9-41be-8ce5-6720a67ab688", "value": "d8e1bc313eaa13e6232c040a66039e8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a5092a-ea25-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626873299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873299, "uuid": "9e2426ae-3e6a-4fc1-bc28-c840c66f07ab", "comment": "Malware payload (AgentTesla)", "value": "9b1e8cf1b62804c4fdf40c97d4680c5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873299, "uuid": "80cc7823-4534-402b-9301-73b133327a1c", "comment": "Malware payload (AgentTesla)", "value": "04bc957b4a8ec5780077baf2e8960cddfcef204cad9eebee56efbc647658da7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873299, "uuid": "cc9d31a4-5e6b-45f1-a209-b0f3c9c5045c", "comment": "Malware payload (AgentTesla)", "value": "7ab69368a60fc7c0ab2895435b78a68044c05456", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873299, "uuid": "e07b8335-30e9-4658-85b0-3c959bfa21c3", "comment": "Malware payload (AgentTesla)", "value": "5e1ea524c956277fdf45c8ae5147221bc1dae13a51e7dcd040309f9e34feeefcaeaa9733451a82a58570dde5d75acd66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873299, "uuid": "0526093e-09f8-4b46-91e6-8280ac9c0d72", "value": "T192458D61F307EA98EC2213F8D87AD9F02263BD5DD524892B359E7E1DB9B334150E2907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873299, "uuid": "3ad23889-41ff-4385-bd55-cb35c3ed3292", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873299, "uuid": "cdbed1d5-06a2-4e3d-8837-433a60054cde", "value": "12288:WvtfYgZwuKkZlStadQnZWeR0xIIQjZ8DkNHM49KDl0CGYryaUVKnp:aYgSdk7VdQ+It2DesB0Cjeahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626873299, "uuid": "a9bce7c8-6c5e-4095-9c8e-1a2cec831f32", "value": 1204736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626873299, "uuid": "d2970165-1950-453c-ae8d-b662dc577cc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873299, "uuid": "cabc6591-7187-4855-a2f5-cb81848e6787", "value": "New PO 3112021 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858dcb2d-ea4e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626890853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890853, "uuid": "78e917d4-29fb-4aaa-96ca-400ba0ab1d3d", "comment": "Malware payload (AgentTesla)", "value": "affd8e6bdc328d5db92a6ae4d210f916", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890853, "uuid": "1a6f14f8-7fbf-4080-95eb-23d1ee7d0c15", "comment": "Malware payload (AgentTesla)", "value": "04cdbb87050fa773ed542d18c1993851661cdebcd06acb6af05bd9e03d14a1c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890853, "uuid": "12b8e078-6dc0-40e6-ad39-eda057ef7041", "comment": "Malware payload (AgentTesla)", "value": "3abb4b3cb1ad4d12c81d611623973e8401e3e23b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890853, "uuid": "7dcd2b46-f550-45c4-acfb-6996788250bf", "comment": "Malware payload (AgentTesla)", "value": "d43977e8a7e2ba1511e6ac51259706ba582ad6d764353350d0ecef9cf3ce0332c04ff375626d55a189567e226f772187", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890853, "uuid": "27827d40-0dde-417b-8627-27de22306f49", "value": "T1E235D02363177B48EC7CC3B96915A045AFF5B407C31ED65C3ED8B0E9A871F259BA1A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890853, "uuid": "314a9dff-8265-4244-9703-9b0885d3cd43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890853, "uuid": "e21312e6-b589-48ac-a562-b0868a90360c", "value": "24576:ByhdsIbEsKrvDBa1LA/tLoE+Ch5sjmWFlivLXZjTVhYWX:LNmc9oLpOvLpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890853, "uuid": "b8cf95ff-824a-40af-af73-f946b07234fb", "value": 1111552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890853, "uuid": "1c930670-bc11-4266-a589-4fff3e8762c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890853, "uuid": "23a32c8b-e3ea-40f9-b2a2-b7791ab1315c", "value": "affd8e6bdc328d5db92a6ae4d210f916.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75087fa-ea64-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1626900358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900358, "uuid": "a13014a6-f1f5-4249-8ae5-c15cfbe449bc", "comment": "Malware payload (BitRAT)", "value": "493a1481892c26bc0939053ecfe52bd8", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900358, "uuid": "9ed8c714-15cf-44d6-a376-6db11a85d4df", "comment": "Malware payload (BitRAT)", "value": "06563f00355b6af7247e643234ff4bab3bdf580e295ac374c6f5a7cd7867a2e9", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900358, "uuid": "fd2e3aa0-b641-4e46-a112-23ad925720ec", "comment": "Malware payload (BitRAT)", "value": "ec33b3c266336bf384abacd5ac2e2cdbf39c1d05", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900358, "uuid": "3f7fe99b-8f55-4956-9dc7-365d5b5e300e", "comment": "Malware payload (BitRAT)", "value": "387fff92efb279e988b1410283120b3162d5b9248c1f3e1ebcf3bc56c5ef011dc9246f023ccd227f6f89856dd62b2e53", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900358, "uuid": "e95baa24-58d4-4d38-b19e-562e26ee8eda", "value": "T1EA1733AFE08361BED320D6B9962DC7EB435A8E647C4256C7F7C63E4D40306D22675A0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900358, "uuid": "7cbe5e6f-ec08-4e69-8e77-cac1e9fec9ff", "value": "97d91400de25b81272a3c0454b5cf248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900358, "uuid": "3d134a34-6ddc-4866-ab9c-6476790e22eb", "value": "393216:01n4QZY9EU559Y4NnyiumUV6tqhaKl8lUe4qz4bcjrDb:bQZmEMYmyTu88lUmz2cT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626900358, "uuid": "407c1dab-4bc5-4b21-b93d-911d4d68dff4", "value": 19713024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626900358, "uuid": "43596430-b874-44ad-9d43-76ade843c0d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900358, "uuid": "0cbbd5f7-2737-4a10-8f5f-fdbb7d5c0267", "value": "493A1481892C26BC0939053ECFE52BD8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4778a78e-e9ca-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1626834055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626834055, "uuid": "256fdd65-e1db-41c3-bd20-cc60930e4df0", "comment": "Malware payload (AZORult)", "value": "997f26e502eb7d3c839b71ab5e77a647", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626834055, "uuid": "422646be-7e0a-45dc-a5b2-ccd001d3878d", "comment": "Malware payload (AZORult)", "value": "08a6193d0afc12de32573390251740b4b1d7a1af0b19ef0cc3a12c078db76449", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626834055, "uuid": "2586c634-db54-4133-96b6-8b4a924d3e23", "comment": "Malware payload (AZORult)", "value": "1c6aaec928e5bcaa07c7ce00a253b618fa7320ba", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626834055, "uuid": "c8996ca1-7ba2-4729-9764-947588b4447c", "comment": "Malware payload (AZORult)", "value": "fdd9a00f0a502d223a94d1f27fdbe1da638e4019e278225a351dd7907386b40f39f905d04d5070a881d8aa37a364c7b5", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626834055, "uuid": "ff5e7f58-2f96-4095-9a22-4ed14702a222", "value": "T1FA44F112C75C57EDFEAD65F8166A3A362094D935330F98BFD70CCA1D44B8AC21292E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626834055, "uuid": "ae6349c4-8185-4bea-9a4a-eb07fa498891", "value": "ccee145a81e286cb2a8f53a6b40fbc2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626834055, "uuid": "dcdb3462-80e4-4481-90e0-806c0784584c", "value": "6144:393VXj7QNEL6VFILqmcdXgu86WVngeR+D02Lu/UBL:3BXeWVngeQ0X/Up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626834055, "uuid": "1b712fbf-69dd-4364-984e-901d9549599d", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626834055, "uuid": "410ca8e5-d8e5-4580-91b6-a69c43c8ba33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626834055, "uuid": "8012c790-c483-48ad-a16f-b042eb146790", "value": "08A6193D0AFC12DE32573390251740B4B1D7A1AF0B19E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e609116-ea2e-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1626876990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876990, "uuid": "6a25a5fe-80d4-462e-832f-e3552fa51bdc", "comment": "Malware payload (DanaBot)", "value": "de9a1e3fbb72d4a01fabee53230f2017", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876990, "uuid": "6e876b8e-23c6-4b53-aae2-ac199839f1e3", "comment": "Malware payload (DanaBot)", "value": "0a3c1d6736893714d0e5552795fb8ba026ba2bd3f5e34afd975b9d463c1e46fe", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876990, "uuid": "cf825ab1-4bc2-4e66-af45-b02c73835dfb", "comment": "Malware payload (DanaBot)", "value": "b7c3bad04551b68b408ef4eb3f9be2fab836d3db", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876990, "uuid": "9f79588b-46b2-401f-8184-678f26bd20df", "comment": "Malware payload (DanaBot)", "value": "b19035d2d74361502fec645c8ed7751233c25d1fe02e0651070311875499e723c3c3772b396cd42033f46948a1164d47", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876990, "uuid": "ec5caca8-2af2-4798-90e6-9dd1dc8d1402", "value": "T1BBA41217BFE8CC32E1A40DF1D5B5AF67067AB5302D36E64AB3505C8FBA716428920727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876990, "uuid": "3f6c2093-9433-469a-ac72-656147f6e7dd", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876990, "uuid": "3c09f375-4fef-4e51-a519-b5682f0cb1a5", "value": "12288:c0gg5IfdyZTg1JjOQKZCqHYWv8IECAX4LdDRveu4nUu:3C1ZnOQkxrtvlRveuoUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626876990, "uuid": "9f3fd989-d939-4df3-abdc-1385a6925614", "value": 452643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626876990, "uuid": "686b8d5a-13ce-4edf-95e8-062db48c1490", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876990, "uuid": "0b1f2f07-a6a6-4ab2-8202-607c0eb1650d", "value": "de9a1e3fbb72d4a01fabee53230f2017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49023df4-ea04-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626858969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626858969, "uuid": "bfe7aa84-2ab3-4c13-8423-c4a1bc2af4af", "comment": "Malware payload (Mirai)", "value": "491b3b4f87c8c8aaa73728f36e3218ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626858969, "uuid": "67d84dd9-ab1a-4546-8ed3-c2f155c9bcc3", "comment": "Malware payload (Mirai)", "value": "0c284287b2b673df61be685d01a46de38858f6b8b340eaea92ca02344014e0ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626858969, "uuid": "fd5d53a7-22ac-48da-a321-e437fe866871", "comment": "Malware payload (Mirai)", "value": "295574cc66c82ff7df5a9bfd4ea085657ca64b6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626858969, "uuid": "7cf7da22-9a20-47a9-ad48-49a005cc63d4", "comment": "Malware payload (Mirai)", "value": "93103dbe1203c5a1bfb6401f9f119c937a64ea5c50327dc68bc59a27dc680247f09ad053deea3183f8e455d86390a6c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626858969, "uuid": "bdf78e45-861d-4b44-ad13-84560ecce7b0", "value": "T1D0A33B92B808EFBAF40F963B84634502763273F3AAD45B71A2136877DD761C11D6BE81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626858969, "uuid": "7deda64b-a6c1-49cf-b9cb-c2899f873204", "value": "1536:Uu7Obyj7HUQK5efs08Od+opXZ8imwj7oFauNL24gyyOFXTQ6:ybi7HUQnfsO+oZF72d24gyyOFXTQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626858969, "uuid": "2e6bb0a3-0c2e-4c54-b611-541a1504a4ee", "value": 98404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626858969, "uuid": "cdcf0b31-d24e-43dd-9a0d-7f26a54ae9a8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626858969, "uuid": "ec01154e-e0a5-42e6-818d-c7fd2bc47a8b", "value": "491b3b4f87c8c8aaa73728f36e3218ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3a5fb9-ea6c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626903564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903564, "uuid": "661b4642-4b9f-4753-a96a-0cee8cf8ffeb", "comment": "Malware payload", "value": "a03b02fddec9a527e5bd2ec6e17fbb3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903564, "uuid": "dfcd8b94-38a7-4e5d-bb29-a52ca5ca6965", "comment": "Malware payload", "value": "0c66ab7992f278f1bbcc3256c2dc934b9e87247c2dfbe234a8d4c4800aef8e0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903564, "uuid": "2a88c29d-aa93-431d-ab3f-63342a18afae", "comment": "Malware payload", "value": "da6b0023136519a5b52ddab22227a31e84cdd927", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903564, "uuid": "592ab5e6-0855-45e9-a305-f99b7f4db4d6", "comment": "Malware payload", "value": "a153a88802fb60ef9603fd5383038e514692c915c052a67b52ab1208d933fcb159fc1614161c5bb90d72f64ceeb7f796", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903564, "uuid": "d393548d-c469-4d43-ab4c-83db1a975390", "value": "T140B40144B680DD32CDA4053208E3D3A92EBE7C256E7E4A47B7547ACFAE381C1716E356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903564, "uuid": "7a2ac49a-9e34-4e72-853b-5364c37f719e", "value": "562fce12eccc4f3ad217a9cd9041ef76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903564, "uuid": "decf220d-7acd-4d60-b880-40bb794b3d7c", "value": "12288:mUYVY3jAVcxnvOqbOkCkKDolnvyuLhm2ld:8VYzbxmqbOkCnDodyuLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626903564, "uuid": "716b3a83-cbb7-4745-918d-60a94029878a", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626903564, "uuid": "d66e1012-4cb4-41f8-a200-376335b0f0c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903564, "uuid": "40a617eb-fcac-4aff-9d51-0291422e901d", "value": "a03b02fddec9a527e5bd2ec6e17fbb3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228a0cf4-e9c1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626830128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830128, "uuid": "7e80123c-19e7-4564-b73c-082536376098", "comment": "Malware payload (Mirai)", "value": "715548ff99b1b5ed7b6391d5340e9590", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830128, "uuid": "2974f8bb-e619-4212-9fda-d7a49144ca86", "comment": "Malware payload (Mirai)", "value": "0e724fdb3059732a825fd17ed7497d8c6a6653fd1172f88cd1b9e9f573585e42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830128, "uuid": "5c000a7c-327c-4259-9a1b-4311a308a328", "comment": "Malware payload (Mirai)", "value": "e4fc39c47cea4913144b6d25257f5c393a07b37c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830128, "uuid": "e8766888-96cd-4597-811e-52ac5d2a9880", "comment": "Malware payload (Mirai)", "value": "b5781b1d2fa3aee35dd07b74594c74112bec81f28b2e906279af83b5b97a4a867241bd66355c0f1ad04934fb6d8a25db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830128, "uuid": "d10039f6-8a3f-41ec-b407-5d9840f0b0da", "value": "T183435CC4A687D9F9DC1146B53077EB338ABBF47F101ADBC7D799A832A842601D50728E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830128, "uuid": "c11bbe9e-a3c9-4481-b157-a3be76f9797b", "value": "1536:DDniX0Uzkjao8bUSA8tGJZET0JN6f1x1J5sS9E5t6a:6X0eKaTQSAFJZEQJ4f1x1cSuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626830128, "uuid": "216650b0-6cd6-4f47-8931-fae82580f333", "value": 58256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626830128, "uuid": "b3ec580c-fb76-4df1-93a8-db4ade0d011a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830128, "uuid": "9057bbb9-b128-4c37-b9fe-693fafb2bd32", "value": "715548ff99b1b5ed7b6391d5340e9590", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ae12a0-ea27-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626874207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626874207, "uuid": "495ee501-1d11-4b15-816b-f5902ee99d05", "comment": "Malware payload (AgentTesla)", "value": "fd759dd1bc9fd7410275b3241e033056", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626874207, "uuid": "ea60fc26-258a-460d-9450-cecb606569f7", "comment": "Malware payload (AgentTesla)", "value": "0ea5f38a33714a857aa46a7dd180fd85fea2e0eb1e919671d13b2fb5cae5296e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626874207, "uuid": "787b986a-fe6f-4388-9241-47a4e4450fb6", "comment": "Malware payload (AgentTesla)", "value": "1b54a28e2733bb327613d9b28faf52bd03cecefe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626874207, "uuid": "e6c8af8a-6197-40e3-8714-1c443098ee0b", "comment": "Malware payload (AgentTesla)", "value": "9146631cf6bd5ba6906682311352c497dd8d266734630bce758a97b3f9b6dac7aa3688db64ca012876f4ea660da6d126", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626874207, "uuid": "8cfb2daf-9ea3-42e8-863c-9ac4a13ec57e", "value": "T1852418566315D510CB6F527DC01A821831F1E703A72AE2CF5AA6D8E92F832CDF90BDE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626874207, "uuid": "a80997e1-f21a-4334-969d-3c968f070bc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626874207, "uuid": "80c8dc5c-6a65-404d-8793-bf0b8f9023b9", "value": "3072:kVQEctjK1Mq80J5f3kPUJ6V9k+pYqYEukMN0MvbV/SGY8zeLit68ddKhYUk9pp:kUD0qU4JpYLE7Mx9Yko26JSUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626874207, "uuid": "52be23db-2474-4788-a953-15cab85f4ec0", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626874207, "uuid": "36d0a549-a971-425d-9650-7dbf66e45485", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626874207, "uuid": "bd64144e-cbc6-4e41-afe7-4f3d31513c0d", "value": "JMIRLlEMHBPEEQvrxjqCV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59481529-e9dc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626841816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841816, "uuid": "5393f577-bd32-4f16-8aed-b965a1b07de1", "comment": "Malware payload (Mirai)", "value": "82d864922140af9e3e1e4522bb8ea27e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841816, "uuid": "5c1eed2b-618b-41d5-8bdd-824fda5f7330", "comment": "Malware payload (Mirai)", "value": "0eab5191ef1f62d895ce4a99ed2bf1dde7ccb713b9d0048fa3a6938466744420", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841816, "uuid": "c1486bf9-1b9d-4e48-ac02-56bd932b9313", "comment": "Malware payload (Mirai)", "value": "2dd77db6d80a05ecb3be0d3970baf16c13f51162", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841816, "uuid": "6f3dab45-8e94-422b-b9a6-8714cab20dba", "comment": "Malware payload (Mirai)", "value": "50452020651fa89cee7fa034c358d60b2e25cb62ae8a6c0ba71435affe4505c0fc00241ca199b0da5a287ad7d42d6764", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626841816, "uuid": "57a9f1c1-46d0-4260-b249-8f47e49eeb1b", "value": "T1F9539409BF650FB7ECABDC3709A9170524CC641B21A97B39B934D818F64B25B09F3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626841816, "uuid": "d9db601d-4f0d-4e97-af09-816cba7ea112", "value": "768:7cxLkY4rZd0cx12hOPKfxSlA/el58XeOegEeDNzH6Za5EXiCQrblb9wnzCo:7chkY4tdKoKSGLdE0NzaZa5hbtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626841816, "uuid": "9684cc1c-44d2-4f59-bf41-8fc967dba456", "value": 64588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626841816, "uuid": "6ba95a6f-0a71-437c-b72a-438a0ba0ac98", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626841816, "uuid": "d752fe33-cda6-4ca0-a4db-eb59d48eaa42", "value": "82d864922140af9e3e1e4522bb8ea27e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717a3c78-ea4b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626889531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889531, "uuid": "ee02c8b0-fd7a-4314-ab49-986aed634797", "comment": "Malware payload (AgentTesla)", "value": "af3a59ad59b90cdbb755d2226f07d2f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889531, "uuid": "1c0fe83b-b89b-4068-80ac-fe857675dcae", "comment": "Malware payload (AgentTesla)", "value": "0f19539c1aca12bf11bb1084ea7745240b7b7690a80140c757de6ed382eb58c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889531, "uuid": "bfb439da-7d0d-480e-a517-4285a61fbab0", "comment": "Malware payload (AgentTesla)", "value": "da66f2c7723a91e3a2db3e9d30fce20a3a5443a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889531, "uuid": "1f0a42df-84ec-47bb-a59d-3f4d124d4f60", "comment": "Malware payload (AgentTesla)", "value": "616ec107d8072d2f4b43cf69b5795a11a541816eff452a279781e7d0fbdfa0af44c983fc6bb05961a956c9555569c49d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889531, "uuid": "4009e366-64fa-4c28-9efa-6e74d9309cd9", "value": "T1F015483439FA902AF173EFB94BE4749ADA6FBA733B07645D10A103464623941EEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889531, "uuid": "62b478b8-07e1-4f36-9550-00bd60739d4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889531, "uuid": "b0fb4ae6-e827-4179-bb9b-47798f2a1f00", "value": "12288:eRter7kVQzLRqjO87d+0q7+iwmsxVYv0XrStH4aSmJ9RYSYbu0imLGrI5G0nY3+N:OSzeRStpz+dDdTPH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626889531, "uuid": "d5a37b11-33ef-4765-a712-42c19ea5483f", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626889531, "uuid": "721bafa0-c890-4de4-b863-42b89da17995", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889531, "uuid": "6ab9929d-4d88-423c-b8d6-b89e1bf3ad4b", "value": "Inv_7623980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e1647f-e9e8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626847119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847119, "uuid": "37cbdee6-7f39-405a-a4c5-42f3159bf345", "comment": "Malware payload (AgentTesla)", "value": "8f4ba6f084527fe557a3f6cc42e20302", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847119, "uuid": "c0fcf2c1-a69f-4287-9e63-b16fa5bf8186", "comment": "Malware payload (AgentTesla)", "value": "0f1c5f7c1941915a62e4acf5963a05f1e3be95383d61f1db24317599e82e70bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847119, "uuid": "b4cc631e-0056-40d3-8e6d-ef8c86593594", "comment": "Malware payload (AgentTesla)", "value": "558fb64c38a191116f4cc4ac669dfcaf3a270f1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847119, "uuid": "03d972a0-98da-4571-bab3-512510df2cf3", "comment": "Malware payload (AgentTesla)", "value": "21d1956e10ede54d088ba4b96051ae329321eccf2968785e43e5ccfacd64c8d550b9afa34e78afaff87b620269ac1d78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847119, "uuid": "616da37b-9686-4480-bdde-397a8b10de41", "value": "T1DE15492439FB502AF173EFB94BE474DADA6FBA733B07645A10A103464623981DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847119, "uuid": "95ca68b7-7b24-4346-8f8f-36168158cf6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847119, "uuid": "9cbb99fb-9a14-45d9-b81b-43e12fb8cfca", "value": "12288:HvOz60fijELOGen1nsLg5Wo4g3gBbP1aHnuwqUk6LaBzM7+Aw+Z6UignzvWD2eej:HmugCmLg41C5B83+oO99Ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626847119, "uuid": "7a3dd7cb-dff6-4639-ab0c-7b35552d85b8", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626847119, "uuid": "d6075521-e48f-4b39-9c9c-c2e4283e97a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847119, "uuid": "e0009e2f-2502-4042-8c20-979766ca92b0", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4f1fd9-ea1a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626868453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626868453, "uuid": "71ec4a76-24aa-406d-b773-ceca44758fc1", "comment": "Malware payload (RedLineStealer)", "value": "3f6b84ccd4292674328ab4754f4a5ba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626868453, "uuid": "2c006dff-54cf-4654-bd3d-ad64c26f759a", "comment": "Malware payload (RedLineStealer)", "value": "0fbccc26213ec041b38565416c423bbf000c8ff5fef6f2dd4ca1bcb112bc4794", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626868453, "uuid": "05c3d800-9a6f-4e5b-99a0-e2092db9a6e7", "comment": "Malware payload (RedLineStealer)", "value": "74aaf6dde13a3762503188b4e5c5d4f79dd5380a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626868453, "uuid": "7600e20d-1129-49bb-bfb4-6319f4ba3612", "comment": "Malware payload (RedLineStealer)", "value": "b757417e603d3d6bc8ae3621543bb30efa6dbe9ed305e4ed586ee64b55aca6aaba556c7942f803cae44f02443e501ac2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626868453, "uuid": "3fb0e87b-f642-4db9-9370-8c4f73729a5f", "value": "T1C424D477F331436BC54D2E30E461FA0F2768962B0B4071B4FC7BA2999D18E4D89BB265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626868453, "uuid": "94c972cc-2f9b-474b-975e-27daa9609173", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626868453, "uuid": "3dfd0d2d-6023-428c-8ba5-b9bb3aa5f627", "value": "3072:zBkd94P35D7mUbFO16wEWSxXNm5LMmYrQ7pzPkUMbia7+r:z2d8HoAww9cLMm2Q7FPkU67+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626868453, "uuid": "c3e3724f-2544-4ca6-a39b-7fce2e3501b8", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626868453, "uuid": "7f29ac28-2afd-49b4-afe5-70b17abfbc01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626868453, "uuid": "91c573c9-0ccf-4662-b904-2bed53c6b7dc", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.312.16604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1866e8e-ea4d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626890497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890497, "uuid": "441be05f-0d1d-4204-8893-6393b437a2c7", "comment": "Malware payload", "value": "015cd5ef0b28e66649a77db9cf73d8b5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890497, "uuid": "4ae2046c-9e27-4c0b-9493-7e5f992a49c0", "comment": "Malware payload", "value": "1017a2def298bcf5c39c7664a4228164a0719196c4a4364d2286a9724ab78b87", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890497, "uuid": "5dfbdd70-99f8-44da-937a-2d3bb3afe98a", "comment": "Malware payload", "value": "82972dc8470acd6141f7d1d8e9d6153836371e6d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890497, "uuid": "739d10d5-22cb-468f-9a4e-f4672c4458d3", "comment": "Malware payload", "value": "e84ccc1a9c480ea7b32bfc2a3405362f8a971fc295d40a92ee7ad116b7f4d83f9408cc0fc1c6ef4acc4927e052fbc8b5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890497, "uuid": "bc935f99-8b64-4e22-827d-4d9d3d182d1e", "value": "T1A903F748B291C617F26156798DD7C7EB3339BC0AAE01832B33947F0EBC796749A06764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890497, "uuid": "5763bdfa-bbd8-4461-8781-59efdcbe3f42", "value": "384:3Wf8yGcSdW+wRsCBkX/l+JVA8p1r/zYVB6MeUogrUr3QAl9ethuZap:GJKCBcEVA8pt/AB6MI2Ur/lVap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890497, "uuid": "878d8f0b-d243-46f7-a640-27baba3f392e", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890497, "uuid": "6fe6a5e6-7d21-4e69-8d60-3eb0c1e505c7", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890497, "uuid": "4e3144bd-147c-4173-a893-b6b07da41fef", "value": "015cd5ef0b28e66649a77db9cf73d8b5.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d121133-ea4c-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626889792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889792, "uuid": "874d4324-f104-44e9-84d9-b7aea84aa052", "comment": "Malware payload (TrickBot)", "value": "06285860cd0beb177a7fb794bf8c1eb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889792, "uuid": "eb70c9cd-8ca1-4a9c-8ab4-ac2898dfaecb", "comment": "Malware payload (TrickBot)", "value": "101c5a5784112e7fa5c2f766476dff8663021e2101c8d4569cb5698390cb4636", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889792, "uuid": "9a6dd777-11de-4593-b04c-455e87faf229", "comment": "Malware payload (TrickBot)", "value": "c5f84431a2270f0840b29c90302ed8ae4ffcd7b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889792, "uuid": "85ed8e01-ac7a-47c6-afd8-51fb5d8a8c53", "comment": "Malware payload (TrickBot)", "value": "8f0b207d21138215ad89141587997272e7ee77f870432d0348e96c98739c4a8ed35188eb03b1d99fae8e28f095e8caa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889792, "uuid": "8f82ae3f-91a4-4ac6-abd9-0e9c9520dc47", "value": "T136C4BE117790D076C2A231724A57D2B6A6AEAC708F2943C77BC43B3DAF741D19A3871E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889792, "uuid": "ee54dc9f-5798-471e-8dea-60f5bbd44f4e", "value": "c87b41c87102773dc24260dc0eb07e9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889792, "uuid": "f9d3d446-e9cf-4b8b-9ca8-dc5c04149d98", "value": "12288:VBZAPzUI75uKIWutFcOd1XZYANbdlFf/eOqVcwkRYv8:v6gI75uKIWLO20b1f/e5VZG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626889792, "uuid": "4e139c24-e7b4-45fb-9882-e392a32224ef", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626889792, "uuid": "0de71c44-dffc-4c76-8317-f1c009783f64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889792, "uuid": "663ecb89-3bb7-4f7a-8ba1-f076a6729156", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5aadd20-ea59-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626895658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895658, "uuid": "80c84723-6dc6-4f28-845f-bff91bb00585", "comment": "Malware payload", "value": "15e98764d969ee310fb1cdda85a26862", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895658, "uuid": "7cce9e35-aa75-4945-8a49-4a7e71a7957f", "comment": "Malware payload", "value": "10a3c0dc25be73191ca2ea5dc2730e07e544d44549954244d0cb36a94bf6c446", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895658, "uuid": "7e90c67d-a1e8-4de2-9dd2-a4fe6ada731e", "comment": "Malware payload", "value": "718382bbcf75fd62c07ad276ff0201c62f9da1f6", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895658, "uuid": "7ece9843-897b-4ca6-b1cd-3a04351d0575", "comment": "Malware payload", "value": "d6d5ddd5bd30044b033cb215d2f2143ab17a39712db215b10cbae6075a6d8ee779a6b9c809c1e2427251de80819eca0e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895658, "uuid": "8dda0bec-6035-43e8-9045-401049fd8b68", "value": "T1FB83F80388594B57E82D43F8BD470E982F1A67ECE5863FEF15650E8F7BA12260C4E16D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895658, "uuid": "d70704fb-126c-4d74-80b9-9d3ab7d19439", "value": "1536:rJx/IBjfM268htEI0Y3s2iwdNP7rLlU0KLv:1+dMb81MsZU0Kb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626895658, "uuid": "5084606a-0e0d-4bf8-97f9-db5022cc0f3f", "value": 87470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626895658, "uuid": "2c719b8d-fd48-4ab0-88ec-10cac6051dc2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895658, "uuid": "1643ed98-5fa0-4b35-a9bf-4b95909a44b2", "value": "10a3c0dc25be73191ca2ea5dc2730e07e544d44549954244d0cb36a94bf6c446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ce4637-ea32-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1626878994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626878994, "uuid": "245d583a-3c22-49f8-a9bb-abf3cb30ead3", "comment": "Malware payload (RemcosRAT)", "value": "a2e20b0f0d230852ea456ff2603d2f78", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626878994, "uuid": "40d48c27-4561-4717-8cf3-0873e398aad2", "comment": "Malware payload (RemcosRAT)", "value": "12e45d9842e64a393cd24914d38dbcaa2f5aad6ddcd8b7e3215ec29af274a88f", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626878994, "uuid": "f3cccf7f-57c0-402f-ac8c-fb64ee2fac86", "comment": "Malware payload (RemcosRAT)", "value": "48c953bb80fd5cf52753d725cdbcd526eee13362", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626878994, "uuid": "03b80437-9e81-4e24-935c-7052c6022521", "comment": "Malware payload (RemcosRAT)", "value": "37b959dec39bc438f7aaa5967a08fba553e3941696c5e42654dd14612b9583f6991a067e8198b5f8ada11ec08e4ffcaa", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626878994, "uuid": "2227f79c-949d-483b-a365-2b041a8773e6", "value": "T1AD15235DE528FF6A7D5652AE603CFA63C8E3380C72D4CE580C228DF76248AD6972550F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626878994, "uuid": "56224844-4e07-4533-9714-0f35bdcdd8c7", "value": "24576:tqL7DEylmQbz8PoN3yzU6Y/v9zBlWbbMlD2:U3EylmG8wN3yw6K9tFli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626878994, "uuid": "fd16f235-0107-404b-82c9-86944fea2911", "value": 930271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626878994, "uuid": "fa2bb3bc-570c-4bf5-991e-f402eb047921", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626878994, "uuid": "96fab25e-3da2-41bb-bc0e-612ee484fd92", "value": "Payment_Advice.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f8b869-ea25-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626873251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873251, "uuid": "b7725859-27e4-4faa-a277-1605af70e569", "comment": "Malware payload (Formbook)", "value": "29aa61fab0d0a3868c1bfc5af0573740", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873251, "uuid": "aa9b756b-ed99-4fb8-b4ac-7dd7d782ba08", "comment": "Malware payload (Formbook)", "value": "13bce5abe3e50d2d91387b5de52da3b3339e0139d01072cca59114de61c58c44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873251, "uuid": "de71c925-b5d7-4738-9513-76c58a693baf", "comment": "Malware payload (Formbook)", "value": "6d0d3f16b8210385416f80d5dd52f88bc22d78b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873251, "uuid": "05eb0147-c7e1-498d-ab45-298744f03a69", "comment": "Malware payload (Formbook)", "value": "94738bbdff250ba3deaf7f501de2c0c66dfebacda24e6cad7d819b39f951cbcc0e0d144ce12c9bfc093a56bfa3e77e91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873251, "uuid": "54f7b48b-fff7-4de3-b685-9b82b3071cfb", "value": "T1C053604033FC6F26D5B997F56632248027F275AA592AEB0CAFC271CB14B2F405624F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873251, "uuid": "9120e072-0c02-44af-bd65-dacd1d11b6d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873251, "uuid": "b0ebd9d3-a6a9-44f4-aa43-9ce159e5d423", "value": "1536:AKXdOdl66kz2gjQ0SjyxRwzyVsVgRRvhO4VijD:AKXdOuHz2p0SjynweVPRvY4Vi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626873251, "uuid": "7f32087b-da3c-4682-9e73-982324d05e69", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626873251, "uuid": "1f72dfbb-85c1-498b-840e-c235287b8d40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873251, "uuid": "760db073-cf08-4f78-8139-4656e13d358d", "value": "NEW ORDER DWG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c66f6c-ea0a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626861762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861762, "uuid": "3c96e630-0e69-4b9b-8adb-dff992ef5197", "comment": "Malware payload", "value": "cd3c8cb6a2037629426586f339f26597", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861762, "uuid": "d3b4e134-c99b-4044-ac74-7b92c12ce85b", "comment": "Malware payload", "value": "142791cd50c010a2e860583ce8b6e357debf66b56040e851d91a86a40dc55cc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861762, "uuid": "f6e85949-6dcc-4f71-a3f9-44379d6b9d85", "comment": "Malware payload", "value": "3c6d64c5f72d93f32a156876409933d9316309bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861762, "uuid": "841eb408-53ea-4e8d-9aff-167a3c041653", "comment": "Malware payload", "value": "f4184ccded52238b6e18879a38a197af9dcbfa27898f1a1a1e13a15cc436f8b7e3b1f2f54c6143eb63768b391115c1c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861762, "uuid": "8fb2105d-0f17-4ece-9934-050a1c887077", "value": "T1B692E056EB650947EC33AAB9657415A639183EDCC840D588CA7129FFE90302CB273F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861762, "uuid": "4ddf8583-8f8e-406e-b75c-dbbd2a3978d7", "value": "384:ZB+DMT/u74vEoTaaQkI713fs0LKBR4MoBXtfm/8nPyOxll6BQCRBZL:ZtaQTaH713lKeMMrnPyoll5CRBZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626861762, "uuid": "c64c5f84-eabc-4100-9e83-9e2f629ce170", "value": 20160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626861762, "uuid": "ad113120-65de-4225-8806-fcd8cceab952", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861762, "uuid": "9edb2389-cb8f-4428-836d-d817780857c7", "value": "SecuriteInfo.com.Trojan.GenericKD.37213729.5003.12483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9575c883-ea72-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626906341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906341, "uuid": "b9895518-77e4-4bdd-8178-6b74cfc68c84", "comment": "Malware payload (Mirai)", "value": "965b8e946cf2aa4df6693f2f01e82edf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906341, "uuid": "a4c85012-4597-448b-b619-9df42fd51bde", "comment": "Malware payload (Mirai)", "value": "14ad6367bd1409bb4eead923fd533a9ee57e9d13d237b7fbeeee7ec037a484ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906341, "uuid": "4b5a0352-d60e-4764-b02e-066369848676", "comment": "Malware payload (Mirai)", "value": "9b2e665146e3248aaef7769ce9ecf64f70a41603", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906341, "uuid": "5c30f304-4971-49bb-a2f0-090a13c9a1c6", "comment": "Malware payload (Mirai)", "value": "76479458aeebc55d63f570b68e820624ace735ca55b2e42f60207106cf12f5df93bb724111b779675bd5a6968484b901", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906341, "uuid": "e1cf6b88-8b23-47ca-a9fc-5951e5e59a03", "value": "T1A6D2D01DF5D2B843CCFEB9BE654D0A217D8A706062CD539E63438CD4B22A04B72C9C76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906341, "uuid": "7ddac59a-4b07-4242-8041-846a7e73be63", "value": "384:C1DgJGdCKstlMAtjSXxbZeElDdhbvNhilfs1T6h/BTdLXzn8thiG4ZRWGVCz0Nvd:C1EatwMs68ShDNUlfsF6bTdLXz8oXWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626906341, "uuid": "d77570db-7901-40f8-8e59-eafc414e249e", "value": 30252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626906341, "uuid": "cdf62edb-4ee1-40e9-9db0-b382d2d23829", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906341, "uuid": "cd14bcf5-f137-4616-a7ad-53c4f9ad1982", "value": "965b8e946cf2aa4df6693f2f01e82edf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50958ff7-ea33-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626879168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879168, "uuid": "58c07b67-f1db-464e-a461-e700d0d5deac", "comment": "Malware payload (Formbook)", "value": "bd74930ecc1b91cafa74e1b0268650af", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879168, "uuid": "1cb9a7be-40e4-4360-8a6a-a59c7b448216", "comment": "Malware payload (Formbook)", "value": "153db12d1016932980a84bdd663e46fe92a7324383cd83d0881715f8c6436764", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879168, "uuid": "94dbc85f-6ffb-4ebd-b5c0-feefb55e9481", "comment": "Malware payload (Formbook)", "value": "be0328924f2885d5d986896b52a2463c5bbed6f0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879168, "uuid": "654a0b49-2310-4ed7-9e8f-f76f851469de", "comment": "Malware payload (Formbook)", "value": "06907a5ed5c5e7108b4f76d460fe4ae7d7a43140b7c205f329e8f55d17ed6c36952d9f7e9c9465f073b08926d12a2efb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879168, "uuid": "64230a75-9081-454d-9cf6-9887587dcf50", "value": "T1D14512F4AB8D6FDFEB6FC87A84D9C46135491C08DD60B2472BC03A646C7FAA5464F052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879168, "uuid": "6f6aea4e-f481-48e0-b2d6-db1a9988bfd0", "value": "24576:dcsrm6ze1t3N7hSgdlZvum6IhWSbO/8xD+JxWFtv6G2IgVe+J:dcsrmL1nF5/GmxWAxiJwFtCGHN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626879168, "uuid": "f4803853-acb7-4526-a039-1ffd8e18e8ae", "value": 1177088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626879168, "uuid": "e1b304bb-42ce-47dc-9f12-599fc4efe367", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879168, "uuid": "4152b6c7-99c0-4fd3-bb72-a6692459bd51", "value": "Purchase Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfafc58-ea25-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626873093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873093, "uuid": "e8e2adb5-5b08-4447-8f6b-2dbf0d124f29", "comment": "Malware payload (RedLineStealer)", "value": "ad2917599132e15656b78cca87799907", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873093, "uuid": "1d70eeef-1f99-47c2-a6d9-e348f5673cf4", "comment": "Malware payload (RedLineStealer)", "value": "157da2de491550c5ac25dc65049e0d6188cb1cad5d5e6124afabf5627b669573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873093, "uuid": "31372d9f-10e7-4d9c-9a7b-70fd169afd86", "comment": "Malware payload (RedLineStealer)", "value": "6420a174293f9530ca89ff618ca9d42ac4a38c47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873093, "uuid": "a89ffd70-aded-4f02-add8-cb8cd6fc53ac", "comment": "Malware payload (RedLineStealer)", "value": "bae8e48a2a0e48bf56c58d62d4b3a9fcac1a6f856438aebf66ad62a393e7c170e9aceeb31c9a7d522c70bbbfc3c902d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873093, "uuid": "6398e5cc-9961-4075-ab4d-8270c0d17a30", "value": "T11E663398F3B4FA4EC86775795D099CB973117D3AB64A02A3B4533A958F3C80ADF814E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873093, "uuid": "ac0be9f4-3a16-4af6-aefc-c4d7bb5dc5a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873093, "uuid": "577c1fb1-3896-499b-839f-1e6b5dcc5200", "value": "196608:7qzsLJ3xYAuRLNGG7dPezRKl1STYhkkHp:7+s8Au6GozGYTYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626873093, "uuid": "87cf8c53-4dc0-4fe2-abe3-7850757f86b6", "value": 6929920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626873093, "uuid": "f5b59052-cc1a-40d9-8fdb-2ed5c83e6ce5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873093, "uuid": "61804890-db6e-4a6e-8f19-451e74d08979", "value": "ad2917599132e15656b78cca87799907.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9badf54-ea62-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626899638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899638, "uuid": "e3adba00-55b7-4ef8-88fb-f828be03595a", "comment": "Malware payload", "value": "0a6e3cafaf5cb2656e56be4440d06662", "object_relation": "md5", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899638, "uuid": "67d73703-cec7-4492-bb02-a9e5ca5009c3", "comment": "Malware payload", "value": "15f01cf888792f4f3c3124b6e65a615342c7c8b9788941947f8131f3786a499c", "object_relation": "sha256", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899638, "uuid": "9ef50c12-279e-48ee-97b7-559723272579", "comment": "Malware payload", "value": "01a311c11f47d5b85de8e05dfd3fc59f3b4e12ad", "object_relation": "sha1", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899638, "uuid": "9ade3a21-ffca-4d84-b168-9ddca549240b", "comment": "Malware payload", "value": "cb75e62d82c97b062815ac14775be1631d5aca9119203dcb788bd53caad8492c403db22cb892b6a3170840c924109ac4", "object_relation": "sha3-384", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626899638, "uuid": "400d56ab-fec7-4afa-96d1-e264680a0ea5", "value": "T1BE449D0633DA4679D9D603316B9BC312CB72EC308663852B568A7A0E2DF1594F6773F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626899638, "uuid": "1769b964-8ec4-4443-bab2-c9a1db2a4a0d", "value": "3072:q/qrFpdn7BU6ij4qpXqnnDibAJBVkm9i3DUY5ANz2L9rQn4J9+3Z5yOV2nSP:q/6Hn7BTqp4nwEg3DUY5ANN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626899638, "uuid": "e532e617-c559-4f24-be97-b5a5c949e7d5", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626899638, "uuid": "1fed8d30-08cf-4629-a0f5-c93a761918ba", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626899638, "uuid": "23a01464-edbf-4fdc-b233-313268d592b1", "value": "meu.agendamento.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f59535a-ea20-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626871059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626871059, "uuid": "ab3ea2fd-536c-48ce-9295-ee39f2a2ba02", "comment": "Malware payload (Mirai)", "value": "c2d34053afac97207fa6927672e51339", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626871059, "uuid": "d70a7b6b-6de2-4526-b976-e59c5a220db0", "comment": "Malware payload (Mirai)", "value": "164fb97ba7bde1820bd1f70b220b53a14987b7d7955a12d006ea610c4ecf4570", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626871059, "uuid": "a56543cc-c6f6-4e51-8ab1-fca598616ce1", "comment": "Malware payload (Mirai)", "value": "3420d0576111ec4d0487004cd9d2a8e7d767b615", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626871059, "uuid": "c3c4e3a0-b006-4711-8c5e-e4e5d46636a2", "comment": "Malware payload (Mirai)", "value": "3ff6c5c075bd322e3d251db4d7147d7bf7fd2d0fcb435a62810ed05ffc31fd82cbd144b2f3e23295de5a0cc2362ba9a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626871059, "uuid": "78a80c81-e47e-4a42-a514-e1f4faec1ec7", "value": "T1F3C2D0881B892DEAC2F9C17943A81B6C19A40F96F809DC8678F8F751DD8E4753417EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626871059, "uuid": "80f9d0fa-93de-471e-858b-c8df85578eab", "value": "768:I2G214DFyosXqgvV9o1ndB08eJgGlzDpbuR1JB:I2GdDgosaaO1nd0VJu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626871059, "uuid": "11355aa1-e23d-4042-bad3-167da9c06d08", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626871059, "uuid": "13cf0e22-6b56-4a23-ad8a-faef00378958", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626871059, "uuid": "07790b51-f03e-4a43-b479-7ab7e1107f16", "value": "c2d34053afac97207fa6927672e51339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e329e537-e9e8-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626847201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847201, "uuid": "3a71f66c-8d20-43f7-a4b2-8345c3074bcd", "comment": "Malware payload (Formbook)", "value": "6f69dab30bc56739e66919ff268b3b2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847201, "uuid": "d33e9dd6-2aff-4c0e-96f3-c9052e512420", "comment": "Malware payload (Formbook)", "value": "17d07aff0e5f1f4ef44afbd6d7e78c9e235d40f909019429ec8b1253c7a89f41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847201, "uuid": "4fd37df6-4fc2-4a17-b61b-da8ee3a38f3a", "comment": "Malware payload (Formbook)", "value": "da4ac5c8fd1b88d389c395b05353b98751d28d41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847201, "uuid": "b0447ea9-e51c-4159-b35f-8d4aaf331f20", "comment": "Malware payload (Formbook)", "value": "42bab700b965afc8dbad2cca1aeea4f974172499218ffae4e3233b57e923ad86ae930d9fddf90c40b5cc51117480cb60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847201, "uuid": "4380c155-710a-4187-9279-e029213b168a", "value": "T1E515BD3814684B67D67AA2B3C560A310FFF04DA77250DD1A4EA3F9C72E12743199EE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847201, "uuid": "63bb61d6-ed61-4c4c-b25d-0db4d508cee1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847201, "uuid": "502e84c6-747e-4d32-9912-bb62e0782c31", "value": "24576:orOn2jrO4+yy1a3wTQiSW4PzcfFNHeDM6DgZY1LSKx:IOn2gyy1aGSW4kNH760m1WK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626847201, "uuid": "dbbd5264-217f-425b-8c3b-66d003c8fd94", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626847201, "uuid": "e61c1022-a7eb-4a6d-863b-0de0afa03ab7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847201, "uuid": "dd60f287-cc4a-4afc-a911-f04b25b3a7a6", "value": "Payment_invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5932367-ea1f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626870747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870747, "uuid": "3f24ff9f-8040-408b-bcef-271a584ae18d", "comment": "Malware payload (Mirai)", "value": "ec694b6e61e9bfca532c5c58d01d3c49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870747, "uuid": "c5212346-1cba-4427-bef6-99b2d88f3893", "comment": "Malware payload (Mirai)", "value": "18f0d2d24de9a40d5a3604a3c01e322efc29e06ab37b4ff45fe3f75088846a21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870747, "uuid": "bee178f5-300b-4988-8c2c-76f31bff72b8", "comment": "Malware payload (Mirai)", "value": "ec537ab7c2c48ddcf3654e2df46cdd8f339d0602", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870747, "uuid": "68c44350-81ed-4ddb-81bd-646e0de25386", "comment": "Malware payload (Mirai)", "value": "8529788716563d96b7e22dcdfbcec98f812dd938321028d76b39ddfe03994dbf0cae668b8a9310855dde767550d2816d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870747, "uuid": "efc76280-9956-4747-adec-376245370f41", "value": "T16E333BD6B902AD7CF99BE6BE80270E0AB13123541053073777EBFC937E321949956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870747, "uuid": "ed7cba91-a866-47ed-a635-c8ee55ec1cc4", "value": "768:8CeKEfhe5XdrbentIYfNMQn5MdgFHj0iPuvWeffpqmUJTXr6Lu380D4:dsfIBZeNlJDFj0imvppqmUJP6Lc8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626870747, "uuid": "05063b6e-9a2a-4617-a2e5-11af93278b57", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626870747, "uuid": "f49e9a78-2a3a-4740-9704-6f474f197cda", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870747, "uuid": "17de38b8-c318-4c4c-995d-0d273d4836d7", "value": "ec694b6e61e9bfca532c5c58d01d3c49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd2f42e-e9e8-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626847191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847191, "uuid": "49561d5f-1acf-4bdb-8efd-d63e2ce38a6e", "comment": "Malware payload (Formbook)", "value": "9486933add946e50daa804e8179d77f2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847191, "uuid": "10e751c7-2d26-473b-920a-821597e77cb4", "comment": "Malware payload (Formbook)", "value": "19206641ad6dfe10bc758922d2917b690431b0bc6b7f45a445cdec3b1a7fb7b3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847191, "uuid": "6baeb622-eb0a-4ebe-b057-5bae302be78d", "comment": "Malware payload (Formbook)", "value": "e4fe0bc4c8efc3095ab6e40bf96df9ddd261424d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847191, "uuid": "e31e388a-8c04-4668-8352-69c2379655f5", "comment": "Malware payload (Formbook)", "value": "faaa3311d38b24d80af5b58b0e4e377e2edfdb663ef623afd3370192b165eab21fe873822c8defb71eccb81422153799", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847191, "uuid": "3ca27f90-3e51-4c92-8ea7-2fc3fee2f018", "value": "T16EF433B88F7273F07CEFA0C0B8E264B6E06C6D6B95B419B154B6C3565ED74D8C0B106A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847191, "uuid": "26190806-d6a6-48e4-b590-83818452a821", "value": "12288:IZdU33O2UqDQIoWuoYSGQGSH2sNPY6Wrf2TLgN7H+3M31m3VRYxZNczP2eLSYxik:IZdo3OzHKfY9QGSWCPv0fDN7e3M43UZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626847191, "uuid": "b2d0ac10-874c-422e-bbfa-969dac52f8d9", "value": 751052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626847191, "uuid": "fce0779d-8e77-4e42-a8e3-98b888a7e233", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847191, "uuid": "40243a64-f398-49b9-8a95-7e55dc77fbb4", "value": "Payment_invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b5371e-e9fe-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626856488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856488, "uuid": "fd38674b-df4d-44a2-9af2-f6f061b7df70", "comment": "Malware payload", "value": "36f178576dcb8db35d6f06448b1eb510", "object_relation": "md5", "Tag": [ { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "pwprotected", "colour": "#08CD34", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856488, "uuid": "63332565-1d8d-4f64-b5f4-6cbfd936352d", "comment": "Malware payload", "value": "192fed6a13a0e73d5196a43bc72eeac16e4962ce465ea67dd60d8b16368c215a", "object_relation": "sha256", "Tag": [ { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "pwprotected", "colour": "#08CD34", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856488, "uuid": "1e136343-d7fc-4a59-b41a-936d43066ede", "comment": "Malware payload", "value": "62277c90cc2b1bb81b36571037afe5081b0605d5", "object_relation": "sha1", "Tag": [ { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "pwprotected", "colour": "#08CD34", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856488, "uuid": "cd7874a9-890a-4728-a900-b6b5c425e6f8", "comment": "Malware payload", "value": "be4dfb55d8dc2226c8f2234372335ec2c26413cb9d342c4aba79f0432b602d86974dbc43859a308bf1d1c5022dd82495", "object_relation": "sha3-384", "Tag": [ { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "pwprotected", "colour": "#08CD34", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626856488, "uuid": "e903468e-a995-491d-b413-2a31cb3e5a3b", "value": "T15D5633166EB1BA737284D336FF0D5FACE1AD1DE63A2F91864C3DB510E2CA291D4D2061", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626856488, "uuid": "c1508f16-b74b-4df5-a416-4f974d680cc5", "value": "98304:ldHEES6j0/MXyeGQSlLUDikMsYCcu/jlt4rGI3XAKrNVtgkH:fTDye1pPMFCcKjl5I3QK37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626856488, "uuid": "394e7367-d6ec-48d7-9348-a2bbeaa4a5c2", "value": 6154094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626856488, "uuid": "4781d85b-4d67-4756-b9fc-89c42b067be0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626856488, "uuid": "9053c7ee-1869-4399-8f49-7dccf8e39ad1", "value": "Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0e70ba-e9e8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626847084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847084, "uuid": "614a386f-e1f3-4da8-82b2-f70843e0d1c9", "comment": "Malware payload (AgentTesla)", "value": "5f67fb00e05a10d2d497b03ea2985931", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847084, "uuid": "91af7825-cc22-4dab-9133-3649586b8cb7", "comment": "Malware payload (AgentTesla)", "value": "19e86e62d336454db9e95a99b3a43079a81a33c883a34649cc706696b679a0f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847084, "uuid": "5131574e-db6f-495e-a9f4-d99fa72088cf", "comment": "Malware payload (AgentTesla)", "value": "8cd952a1a7846cdfc26d80d776379b1c15cfb07f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847084, "uuid": "acb3795a-67fe-4058-a30b-b5fdc0dfd03d", "comment": "Malware payload (AgentTesla)", "value": "d2af2b693ab9c1733e267ac155881872870795fe0ad5566222456e721248663c4b8d5b809b5e0c47f2aeb92982f2fd3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847084, "uuid": "b2d90041-62d2-4ecf-88c6-1d365a9b1a6e", "value": "T1C305BD3800684B63D67A93B7C564A354EFF09E567241DD1A4ED3F8C72E12B431A8EE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847084, "uuid": "c215d4b5-1d93-468a-803c-4a02c48e2dfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847084, "uuid": "30059858-80ab-4344-8fca-0a950e76fedc", "value": "24576:qVQl28rO4+yk2Zie/TYZZIpYBKggntgJeqSTgz:0e2RykMioTYZZs9qEgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626847084, "uuid": "3fb70d21-6f33-43ac-a0e6-0f536a560597", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626847084, "uuid": "c93db826-9422-4b1a-8e73-34e97d5a8bc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847084, "uuid": "aba786ae-f06c-42fc-9820-39553e5cb094", "value": "Released Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a130bd3-ea6c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626903611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903611, "uuid": "106c3df2-b1e0-4bf3-9a5a-949a5c652ed3", "comment": "Malware payload (Dridex)", "value": "65638d179046f7caec06dc03e508b040", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903611, "uuid": "9b10d2a8-e30f-456e-978d-ae78b565c31b", "comment": "Malware payload (Dridex)", "value": "1a560adb810b924e65f91e34664166be2c2adac10f7f28c075d902e4adb1112c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903611, "uuid": "4a940ff9-8511-44aa-a869-af1ef2613439", "comment": "Malware payload (Dridex)", "value": "351ee428ccaa279257ac8fc493eafc62beda580b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903611, "uuid": "d2648bee-64c7-44aa-bad0-c73cec408359", "comment": "Malware payload (Dridex)", "value": "f6708ee19516db7ab1f2e66c9c5151796b99bf39c4d79754191fa69d7f35368bb870166dc40c0bda8c44cfff391fbd56", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903611, "uuid": "f74d4095-fe68-438d-9daa-fe839fe38b7a", "value": "T10104D0C9D2FA1786D4B1A67D1D84531BA4183C09CC39ED96C980CF5EEA3B204EB3675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903611, "uuid": "ec77b945-8518-4339-b902-26a4710abc8b", "value": "44b0dcdef59120fe964e77dc09a5f1e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903611, "uuid": "ae3b962c-c330-41fa-be35-eafbdca56c35", "value": "3072:jbweJIBwzBgXbJ26juQdZHT5K4PrsF2ATdwNBJUiG7NNNNNNNNNNNNNNNuMtbXkl:jse2Gzm1dZtK4Puhha87NNNNNNNNNNNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626903611, "uuid": "b4ccaccd-c696-4458-a6cc-b5f41533010a", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626903611, "uuid": "905fc631-851b-4d20-b379-c4a809ce3a64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903611, "uuid": "4ca8d619-7a9c-493d-afae-e98dbecfe2cf", "value": "SecuriteInfo.com.W32.AIDetect.malware2.31993.22306", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa316cd-ea78-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626908828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908828, "uuid": "b4612a84-823e-4655-a4f2-5a31d72f9e6b", "comment": "Malware payload (Mirai)", "value": "97d45e65f79cae832ea580b77e7aca17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908828, "uuid": "6f59567c-54d3-4147-b3ba-f43930920b1a", "comment": "Malware payload (Mirai)", "value": "1c09c6e04be263bfbb6bdb043b1cec5891e97a5cc885b6588127fa4428876262", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908828, "uuid": "943acdc9-a604-419a-9bf5-de6864412637", "comment": "Malware payload (Mirai)", "value": "8edc7d959e37c20bbd2820b70b3d344e2ddd1790", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908828, "uuid": "4612a702-263f-4e4e-a93e-bf6307ed62ac", "comment": "Malware payload (Mirai)", "value": "efc7ab1975213464fb9b6f933056ebe1dc6b986259a97b043b938201884cb9eb02ee92106888e8a79bf09b0d70d6096c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908828, "uuid": "759fac4c-021f-4a2a-822b-4a7dbad2efa7", "value": "T16933AE71C47C6C58D1994274B9288E3817A3E50DAA572FF55686CA62C04BFDCF22C3FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908828, "uuid": "446f3c2f-1d07-45d1-bfdd-721256098ca7", "value": "768:J/COqtwHTc5HpGCUF3azleURmCaqEyAlYD8mMhKRCEo3EZjeCwYDLCARE1:J/7cs4oCq3azlv2K8BIwzfCDLCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626908828, "uuid": "a0acfbc1-3793-45eb-be38-10548c63b194", "value": 54852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626908828, "uuid": "40013426-2521-4b94-acdb-30a9d750b880", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908828, "uuid": "8bb16e81-66ef-44a4-bea8-ab5cae4896e0", "value": "97d45e65f79cae832ea580b77e7aca17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691bbb08-ea28-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626874484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626874484, "uuid": "60463ad9-e0f1-444e-83d5-08580e51d144", "comment": "Malware payload (TrickBot)", "value": "0ad4b8df130fcd3317a06a11fe7cef3d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626874484, "uuid": "f1e04b1b-a743-40db-819f-282e70eb6259", "comment": "Malware payload (TrickBot)", "value": "1c8a67342a601e649f56e32383fecea6d62036a38a7edd2991bfd0e3323fd5f4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626874484, "uuid": "80f1ab41-6e10-4cf6-807a-b21747545cf6", "comment": "Malware payload (TrickBot)", "value": "27f367c0914f2a0ae9750acf20e72561cf16f72b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626874484, "uuid": "8718373d-286f-46ef-ae2e-40ef914b9b9f", "comment": "Malware payload (TrickBot)", "value": "3ec436d40676a3ba77f699d8bef716e02523724adebe66cf34e2e609f9cdff8da7d2365c2b150869f2446d16d822e448", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626874484, "uuid": "f212825c-3272-4e89-a5ea-4d839b5b5c10", "value": "T163D4C012B590D036D29F01383E515B79B2EFA9A01BF1D463E7F0DB5C8D329825E3B25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626874484, "uuid": "9736a66c-41ba-4e97-97f4-7c680bf09c0c", "value": "aa766223dad1548ddba0e06749dd8601", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626874484, "uuid": "86d79b3d-2424-42bb-be2d-5aa85db48e58", "value": "12288:t7NI5iGRtGvUw0mKBMwd8gzyYhJ/W2s2dFS8J:7YRtGvUmq382yYf/WelJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626874484, "uuid": "905a0779-84ba-4b57-9bed-33b953f8ff2e", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626874484, "uuid": "9f4e0d7e-bdf6-40be-ac20-2206ebf1e50c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626874484, "uuid": "fb7c14c9-ab1b-4f32-8f8d-d3cf83748021", "value": "lovemetertok.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36bc60b-e9fc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626855684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855684, "uuid": "153de635-15f8-43f2-9c66-946ccd288b23", "comment": "Malware payload", "value": "033dc71358590b51315179c8838ae949", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855684, "uuid": "40269968-caa2-49c5-88aa-271e6a2d2371", "comment": "Malware payload", "value": "1d3351293492090c589ad39ec03fc265f44d96fa45d5bd451a446d311ad5a18a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855684, "uuid": "ced7fb36-565d-4656-be7b-e823ca085f96", "comment": "Malware payload", "value": "ff60132222db82321dbd311083d4b8fe3f7d8f1f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855684, "uuid": "575e72bc-b6d2-48e1-9c98-730ef361ed05", "comment": "Malware payload", "value": "a63468066e0a47870fd0f3d6f55514a8615e3d660cccde2c114cf49895c03a89d830846683e76d1c0471ef01273f41d5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855684, "uuid": "9dd7ccc6-d8bc-42d7-8fb1-00da32fdff00", "value": "T12A773399D66EEC13E84FE67270D569CA3B30040E1F60FF173B6A01941D82C96D7E8A5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855684, "uuid": "2182235b-521e-4c8c-ac23-bc11ed463dca", "value": "786432:ASVGgZ7LBLtPpL0Ux5ftQ7kK2io700FKRhjp3S:5VR5BLtRf9PEvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626855684, "uuid": "c1793811-4d84-43ff-bf69-0431ed46c96f", "value": 33836380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626855684, "uuid": "f2303a71-a200-4c32-8acb-3f591e3d4c63", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855684, "uuid": "4aeb8bb3-05ab-495d-abe9-7e7d76c7e9b5", "value": "Claro Securty.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f509fec-ea4c-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626889903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889903, "uuid": "840d07b8-6776-4c0d-a161-ab4aea8e7b1f", "comment": "Malware payload (NanoCore)", "value": "b6a05c3a37dde3db4a8005dfaeda9e97", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889903, "uuid": "732b8237-7ec1-4c6c-859c-bd727a79a075", "comment": "Malware payload (NanoCore)", "value": "1d5026cbfdcd2825631dd77f8f5149e275f03ec78390f94e63dad83d778569c1", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889903, "uuid": "17c40390-6b22-40b9-9ec2-c42001d07b5d", "comment": "Malware payload (NanoCore)", "value": "c0b64b85e13865a76136ce2d5674ebca53246566", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889903, "uuid": "459764f4-5d2c-42df-82a1-fb583df27667", "comment": "Malware payload (NanoCore)", "value": "4cebbc21e026b57f3ff5cada335719b4d916a7c945f90c16ab44f313ee167a4be9e44ee58dc1bd54f36cc092649c1421", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889903, "uuid": "a2cf4335-50df-41d5-b43b-bc048fcbbc9a", "value": "T134B5023086442EDC5B64DF3AF1793A095FF01E4B9856A0CDBBD73D43EEDA8C8A51A160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889903, "uuid": "1026c647-cc56-496e-97eb-a001444b7733", "value": "24576:Rqf8Lpx7oAbNFypaURT3UuL42eUyp2CLHiLG8b5/tXC5I3ASYovcOpiWmSi3D0IA:0kfpg5/byl8b5lGIQY0Opg0IDhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626889903, "uuid": "7837f2be-bb95-45cb-b944-c9ea1ee88311", "value": 2437367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626889903, "uuid": "5077e84f-c4f0-4ce8-9e46-0e8576b6f9ce", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889903, "uuid": "24b57e64-eff6-4b70-b44c-3bca7168f07c", "value": "Inv-04_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfea0276-ea2f-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626877636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626877636, "uuid": "01256581-dd62-48c9-a920-9431a0e2b0aa", "comment": "Malware payload (NanoCore)", "value": "a6bd3de048002bee7a8d973c887227d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626877636, "uuid": "0922f6b5-cbcd-431d-b3e8-8e2055684c83", "comment": "Malware payload (NanoCore)", "value": "1e3539b9de51134004ff4bff43ab144e748a329265decf8421442cef3109210d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626877636, "uuid": "b06a152a-87e7-4250-9b2a-058f4c5e4a01", "comment": "Malware payload (NanoCore)", "value": "90cf93d93b141654a62ff3a3b6810faef2ff3d69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626877636, "uuid": "d0bb7f41-35a3-4bb1-87e6-cf9fd09a7ef0", "comment": "Malware payload (NanoCore)", "value": "c0c6ce18b5923d6c8c00c84b321f586881ae1822274051220609f0a132753fc79438b0aebdc433323bf356a628108343", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626877636, "uuid": "a3327f7b-9c80-4233-9570-5cf9afb45d38", "value": "T18F459E224DCE4667C2644AB7D331EE02DEF11C962544EE152EC2F0EB9D3729A94DED0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626877636, "uuid": "aac0cc52-9b45-4e3c-afde-f3cda6736194", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626877636, "uuid": "7af41518-d66a-49d1-b8d7-6b6b4c8a2f79", "value": "24576:UpAJYYuDA0w9KPf5iodHl5Rus+xr9Yipb:UtA59ExiodHjczZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626877636, "uuid": "94871137-fcbb-4e91-918b-be66dba2395f", "value": 1249792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626877636, "uuid": "96f709c4-2643-4715-8514-241e07b904d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626877636, "uuid": "b85700e3-a667-4ae4-ac75-a97124ca2420", "value": "Contact00212399490.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af71e91c-ea01-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626857852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626857852, "uuid": "fcd4ae4c-736b-4c34-a6c6-ff93f1e6db1a", "comment": "Malware payload (AgentTesla)", "value": "befe3d95c55d3c6fc83d5eeaf8f3e550", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626857852, "uuid": "4fe2ac8f-3a2b-44b6-b4f9-c5acabe3183b", "comment": "Malware payload (AgentTesla)", "value": "20360050391061fb78185db1572aad05b002bf993209fce7331dd7c184e83aec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626857852, "uuid": "edd6c5e9-ce4c-4ba5-a04e-9e0d0250b5a5", "comment": "Malware payload (AgentTesla)", "value": "2eb7b5bd16baecbc8fbb1743904cfc56c088b28b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626857852, "uuid": "c8a93aed-bc89-4c91-ae68-0d76492dccf6", "comment": "Malware payload (AgentTesla)", "value": "78f34056b2fa1c6715dbc574b536abd39c7805014fe3658a06009dfd3879e16d6a4cac787c55d8a9652ef5a10f12d332", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626857852, "uuid": "8312cdcf-9935-4970-8bb9-56c6b2be4c19", "value": "T11D458C61F307EA58EC2603F9D87AD8F1226BBD1ED525892B359D3E1DB8B334160E1907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626857852, "uuid": "3283b93a-4ea3-4de3-9f9b-4a949dbc69da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626857852, "uuid": "0477c99b-b841-418d-81d8-661f798f7108", "value": "12288:1lPZguKQZOFsHi+I4D154YBonGWjNX/TiwO1ORHOvua99YyaUVKnpAc9:bPidQMMVIe54YBonVjNXLtsuCahpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626857852, "uuid": "7f3ef398-d32a-44e8-864c-b518dbb3675a", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626857852, "uuid": "0952244b-b5ee-4f3d-a5bb-dc420c1d9765", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626857852, "uuid": "2b2dbfd7-dfd5-4bb2-9639-06a5dfc23d03", "value": "RFQ JICPRHR10632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a0aa7d-ea72-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626906337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906337, "uuid": "798af41c-a800-4f1f-b336-cb8a15b0eaa0", "comment": "Malware payload (Mirai)", "value": "6a95169b66c90cf44cd15e38e7168f90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906337, "uuid": "ad7e6e05-55f0-47cc-8850-a22f9cd944e7", "comment": "Malware payload (Mirai)", "value": "22ad3adf6085fe2bd4ed83d4909cced27c036d2461b77ed896d88810cc827b66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906337, "uuid": "4831779d-9ff6-489e-b485-8ca80186d2c9", "comment": "Malware payload (Mirai)", "value": "d1206d55322c0b261e5e51dc74b43aaaefb7573a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906337, "uuid": "10c22e99-2fb0-45ff-8572-b5ac811e9cc7", "comment": "Malware payload (Mirai)", "value": "ee2c08a5d158d423a97463218a32c5c59129586ee4e24461c21341153efd87212673c0982e3ed841e899068c7c0fc49e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906337, "uuid": "e399e0bb-e46e-4a80-b004-21fd281e8e27", "value": "T13D330269D62379B6E2509C7230AD8489BC5F5B747E88E151207E403AF7EF262E4FD063", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906337, "uuid": "2fa93e01-0ca4-4607-b186-ee224736640c", "value": "768:5QgpbT8obnlCDkzvZiLe8hNa+tvmOXxaJvX9q3UELMUqEFqSdUwd6EE5+2v35:5zpPnnlC4zvZae8bZrXcELMVE8aUbhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626906337, "uuid": "bb224485-68be-415e-9901-dbaab1bd9fc2", "value": 51756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626906337, "uuid": "294b321a-ecb2-4478-a0d0-355c155cf197", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906337, "uuid": "14a0fa6f-e365-4799-b550-5d3709ecdbcc", "value": "6a95169b66c90cf44cd15e38e7168f90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a693df-ea1f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626870685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870685, "uuid": "08fc9013-0319-4bc7-a008-ff1bbbacdd2b", "comment": "Malware payload (Mirai)", "value": "7d6a59d1629afd1dca8d61f4966a5e70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870685, "uuid": "97b861ff-414b-4cdc-b41f-34035d574544", "comment": "Malware payload (Mirai)", "value": "22d13cac1ff4763b84b7c28d64f605d6a769dc9a90ef7ff4cc4d7b76365f5308", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870685, "uuid": "776a38c7-4eea-499d-be57-555a3399c748", "comment": "Malware payload (Mirai)", "value": "06904b7635ed1c06a3019ab48cad7ec6b91e0634", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870685, "uuid": "e809d3ae-cf09-4732-b694-d3ffeccfdc5c", "comment": "Malware payload (Mirai)", "value": "ea0df1054bbd2ae9d727800de5ce163d2cea3ccb1e2adfe3b684c7e0a16221e1e0b4bf0d6726153802afcb470f1bce2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870685, "uuid": "179c53b5-a548-44de-87de-d7e8457a8031", "value": "T14923024320D3BA03E03058FB4562CCCEB61AA6B9B1BF7BA625454D254C75D93ECB18ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870685, "uuid": "213ab7e5-8426-4bb4-a89f-35a0d7ab0b9e", "value": "768:aK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFB9q3UELWt/iw+kvBGg6+fYtrBH0:E12O1LCNguovDPH7TcrGLWhiw+kvBGgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626870685, "uuid": "cc53d2de-45e2-45f3-b5f1-15c1c49de099", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626870685, "uuid": "9c1fa994-c3fc-45be-b87d-5c8f3ad8bb8a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870685, "uuid": "f2b9af47-8d95-4d9d-b483-28b1fd6605e5", "value": "7d6a59d1629afd1dca8d61f4966a5e70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2fdc95-ea25-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1626873177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873177, "uuid": "ab756414-fe0c-4c77-aabb-91e9446f7406", "comment": "Malware payload (RemcosRAT)", "value": "d6b322095e29d2f780a7d75d7a28f021", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873177, "uuid": "ec0e118b-d161-4d0f-a497-3a1c704b9766", "comment": "Malware payload (RemcosRAT)", "value": "239d05f508f2055daa1e4bf62f465f3ccbe7104fcb3c98504630d40d37466e02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873177, "uuid": "12059f8b-3b92-4846-9da6-c24afba6468a", "comment": "Malware payload (RemcosRAT)", "value": "0e641700071b435f17be3f22d1c29ae44d7d5610", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873177, "uuid": "37951c46-8e51-4fbb-8e9a-153e919143fa", "comment": "Malware payload (RemcosRAT)", "value": "54ab8fcff21831df42dbfab8ab6ac222a35484d387573098c4f2df53da7ba4760700bdd8e3dd21fd266141be4d58b87c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873177, "uuid": "e4c9db27-3748-4f66-aed9-2561072ad58a", "value": "T1A545BF1A7381BB69C25D0F35951B3A5893F1A29733B2F6DF38D05AD08A30B0A971F1D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873177, "uuid": "fbab962e-7a43-4238-93e7-1d503f0b22aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873177, "uuid": "5f963e75-dfed-45db-a321-99500a24aff7", "value": "12288:aMJ0ak7lM0J1BSVNaOgKJfcm5H5xwTMI5BNasB3tIIuHdDzC9y7:DWE2LkH5xwzPaI4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626873177, "uuid": "0fd1862c-9aba-4def-94c9-9bff7aabfd37", "value": 1199616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626873177, "uuid": "23988cd7-9fc9-4538-9477-d14e7e2e0cb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873177, "uuid": "d7b3e9fe-430d-4860-a976-1b5bcdb0f90c", "value": "Requesting Prices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5cc922-ea6f-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1626905123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626905123, "uuid": "a2a273b5-60f4-4b67-9e46-901bdd425cdf", "comment": "Malware payload (FickerStealer)", "value": "70800f0e430d4c9ae411aa87ef26870d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626905123, "uuid": "2c1ec34f-ffa2-4870-afed-5611a823b2ff", "comment": "Malware payload (FickerStealer)", "value": "242b050cc122233e783283296a736b689acfb116c68047c52252a012ba322499", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626905123, "uuid": "882b1a0b-8e67-4d4a-b045-0e003a116c36", "comment": "Malware payload (FickerStealer)", "value": "ae3108303791bf71f3d8a22a81950f56d064ec60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626905123, "uuid": "5c57bafe-eabc-4d95-b3ec-802df79127d3", "comment": "Malware payload (FickerStealer)", "value": "2bbbcc489841afebcb2f924d6024a0c33bcc5e7d9a27f72d19550a84475e63209e2cabf603d814bea7ce99c403ffc83e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626905123, "uuid": "f7c97d14-ab4d-473a-9a7b-79f9345760e2", "value": "T123E533407FE680FBE7122138A9147FF4A0F8C3C8067184DB7B14D95E4F6CAA6D52B56A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626905123, "uuid": "66514eca-e409-4575-8a80-cbbee3c1aed7", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626905123, "uuid": "5d785b04-faf1-4373-85f5-e7f66be08792", "value": "49152:xcBOPkZVi7iKiF8cUvFyPIbUgwvnJTn13QTNyfk5u4ocZ12EwJ84vLRaBtIl9mTO:xsri7ixZUvFyPIbYvnZnpQocu4xZ1FC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626905123, "uuid": "977cef74-dfb5-49cd-8bba-41ea88fb8509", "value": 3111859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626905123, "uuid": "8ac0c4a1-4712-4cef-98b8-f4b0e796215c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626905123, "uuid": "a49e76ea-94de-4e24-b00b-e97156366922", "value": "70800F0E430D4C9AE411AA87EF26870D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34d4807-ea66-11eb-875b-42010a9c0053", "comment": "Malware payload (Pony)", "timestamp": 1626901211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901211, "uuid": "54c9d4b7-5f56-4b9e-94a0-22bae5e6bb4f", "comment": "Malware payload (Pony)", "value": "5530e8dcb60d0dcc68fe18810bb9e53c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901211, "uuid": "f34f3609-784b-46af-8fb1-6ece28d6fdeb", "comment": "Malware payload (Pony)", "value": "24f0d922d0dbd20647e6c89d86b1dec6aac2316833d338dcf9eea7dff0a1c2b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901211, "uuid": "79a20a93-10e1-40b4-a80d-51ffea7531f5", "comment": "Malware payload (Pony)", "value": "0addb140b908fd95f1efdc26e9b90975d1b55b9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901211, "uuid": "6035afe8-9a72-4544-b942-7dacbddf4b43", "comment": "Malware payload (Pony)", "value": "bc9e80980780ae2f8578252a69b1ba4b68bbb9080598a69ef7c9137fc4f99f8a551ec27a3cc4c67d9d1a87b02f75d01a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901211, "uuid": "def41f5e-e7a6-44b0-a610-bdda87992303", "value": "T1C375C01317E3BA3FF25A167B0CE801A871467B727EA3CE43B925A8F7815644D335468B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901211, "uuid": "45f1a02c-8c89-447c-a21a-1b3a1d8f348d", "value": "4e0949dfb15fa89be19c9b90d78b6864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901211, "uuid": "4fb21f6b-7846-4749-b15b-ce2a733111dd", "value": "12288:04TZJHtqPRx+9Bvw6VjWVmzafcWf/rKpHGAcKEZUiX:0mJHjDpiNnGpHGFPZUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626901211, "uuid": "39b30bb6-1cb1-4056-882c-c3d3fd8dea3c", "value": 1703936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626901211, "uuid": "a752f45e-f674-4f05-8557-fc1d43670ae8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901211, "uuid": "82c09006-4319-4b79-8446-bbdab646b82c", "value": "5530E8DCB60D0DCC68FE18810BB9E53C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819b0e58-ea59-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626895571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895571, "uuid": "f8874ef4-296d-4a48-bff5-7e163edcdef0", "comment": "Malware payload", "value": "522613de6c64fbb125351951a93e3e64", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895571, "uuid": "c57696b1-1f67-4733-ab19-4c8515914a6e", "comment": "Malware payload", "value": "25c21312f08085b556530382fee3e20b8bab4cd71807644dd3eaced0b4b03585", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895571, "uuid": "ea512991-9681-4477-8c3e-92d911c66a1d", "comment": "Malware payload", "value": "4bb1a57dbc7d890d97ee82c30f2f97946484e004", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895571, "uuid": "b81ed6bc-6476-42b7-b401-7a49763782c0", "comment": "Malware payload", "value": "76a8930879ece828de9fd3ab7cdf7b1fe5f9019d6a1bf079020d7ea951f5147e26b34b3717e516ddc33e7310646e60c1", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895571, "uuid": "a345f4fa-bb6d-40fc-9721-a484a7285c18", "value": "T172D35A53ED0D4683D42D87F97E066E9C3E482A6CE8927EFF24211ED67E602534D2E41B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895571, "uuid": "13dee885-3ee9-4c38-977f-50ad67312449", "value": "1536:wfJxyiLxL5WiPKbCjQDjWXmSwyEIsMQzWkuiNb0SO+0bQT6bYks/N:wxgmpxtiKXmRyEsPaOjbQebZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626895571, "uuid": "65e7aaed-0619-420f-8f60-72fe0d1589a8", "value": 131278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626895571, "uuid": "b8789309-9488-4efd-9189-e51fb0f3d7a8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895571, "uuid": "e9b684f2-9c74-45d9-a6f8-fe226aa0e904", "value": "25c21312f08085b556530382fee3e20b8bab4cd71807644dd3eaced0b4b03585", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8714f46b-ea64-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626900304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900304, "uuid": "f1072b01-6662-456a-8d1b-cdb8f09a214b", "comment": "Malware payload", "value": "c2d2852e6521b53d220c38d2418fc982", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900304, "uuid": "22165c7d-2d5f-412a-932d-220af4b61f9d", "comment": "Malware payload", "value": "278f1244b407f4cf155a7e63341681f7f5e61b003e1c2a3a70a9ccfd575006e0", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900304, "uuid": "b5f5fcf0-e06e-4c09-ae4e-3143bcaec05e", "comment": "Malware payload", "value": "4ea6c060741d7161cee11c3ccc085790c9378e6f", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900304, "uuid": "925542e8-ab56-4585-9bfa-9906c2db996e", "comment": "Malware payload", "value": "74a4426126387313c96ec4e14cf764406268c58bec526ada3409879c9244003f4f41af6fe3e9c53f9ef9d7dbc64bd6f4", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900304, "uuid": "bcb81319-c57d-46ef-bb25-8691b8b63233", "value": "T11E645ED5EBE1C92FEBD0E53A0C565730527CCC0459900B977259E33AB72BA3C8E891E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900304, "uuid": "1f555763-4d98-42c3-ab47-d5197d4fef9a", "value": "6144:U0Y35qAOJl/YrLYz+WrNhZF+E+W2RGtNPjKBbA2G0VeU+fMGMMzkufzLzUNF:ZjwbA2EfKILQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626900304, "uuid": "934e5787-fafa-4d0d-afe5-c5a58d402c9f", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626900304, "uuid": "dd459181-af33-4a67-b756-fc0e4c6ca358", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900304, "uuid": "6e3a27c7-ce08-4daf-b423-750510611415", "value": "c2d2852e6521b53d220c38d2418fc982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1685aac-ea4d-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626890551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890551, "uuid": "feebbced-5378-48c4-8597-eaf5dd130d29", "comment": "Malware payload (AveMariaRAT)", "value": "4195248b7f5abab63c7fe783554f913c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890551, "uuid": "fd5443fc-3b23-4c07-a535-39589f9de3a6", "comment": "Malware payload (AveMariaRAT)", "value": "284f84d96664f2cd87973b7251e93e4e6dd0f954ec5f043c9f95e5cbddeb6420", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890551, "uuid": "dcb45bbc-380a-4747-87ea-4f8592dfa52b", "comment": "Malware payload (AveMariaRAT)", "value": "1c2b9caa2c0b5a2439bb034b6dcd3d383df5c656", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890551, "uuid": "a4d7221c-ba82-4c1e-b74d-9dd95b5b7b93", "comment": "Malware payload (AveMariaRAT)", "value": "1768885524e5bca62c454c8984a25cf187d6505be1eb3aabe0d3ecb938526c3f750735c968fd5cc4ec389e327d0cabfe", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890551, "uuid": "33347885-a99f-4e5c-b4df-8e67739dcd91", "value": "T139F412B06A37D9E2EA45423F62BB0AB75D301F23C8670CEC562639A9421FD155F064EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890551, "uuid": "5579e841-723e-4da5-8982-ae49c6fd94d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890551, "uuid": "b528dae9-232c-46f1-b5b2-53a06f0bc76c", "value": "12288:wvFWssZm5qy2FRbaXNpIrEf+mPWIPZiXRbvvEuBFHvM1EKv0ZNE9XIHEUnMm:8ULRbkAA2PIPZiXRQuBG1bv0Zm9Cnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890551, "uuid": "d5630ee4-7458-48c3-be64-fbcf8bad5a99", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890551, "uuid": "a1cb29f3-4794-4437-bf0c-05f74c15c8e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890551, "uuid": "453b78ff-19ec-440b-9d9d-f13087c8e5ba", "value": "4195248b7f5abab63c7fe783554f913c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d57ccf2-ea38-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626881283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626881283, "uuid": "f71a8dfc-bbdc-4014-95e1-13590e65ba15", "comment": "Malware payload", "value": "2e6cecc90d6639787e46a0077978550c", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626881283, "uuid": "bdbaae9c-493c-464b-a22d-21361967de58", "comment": "Malware payload", "value": "28fa164871427d01b1856c4fedadc8a615e693081da18cad9133ce2a6ea4807a", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626881283, "uuid": "21735ad7-5ed2-42e6-b666-cb1c70f87784", "comment": "Malware payload", "value": "52f8942a5d0152d0ce1a2d2659b516601eeb5c69", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626881283, "uuid": "783b302b-1e89-408b-894e-a95ec023c7b4", "comment": "Malware payload", "value": "f9ba4036d3de79aff77db3912c8a4761ad8eb0c14822dfe6f60a1a7807be8aba4d8775a1a6d155262877d4070cc23c31", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626881283, "uuid": "6305db14-fc1b-42bf-8f3e-fee6e4803b34", "value": "T1963163AACD011244C7370F7D41BD106CB9E9E05EAFF1264F388872DC19973EB1A23209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626881283, "uuid": "64776a75-ff58-4cd2-93eb-a8290bee2cef", "value": "24:9PGzphVX1X6ClUWjHQfBIq1VeymQ1kLvbWUhyim:9PGlVXwWuiymQ1k3Wom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626881283, "uuid": "f7662153-3097-4b9b-bb40-945342481025", "value": 1715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626881283, "uuid": "3429f24f-48b1-4caf-b80a-8bf3df09ede2", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626881283, "uuid": "d6c9231a-7c60-4ac1-9060-26e6f2c20168", "value": "swift copy,pdf.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145a9f98-ea68-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626901830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901830, "uuid": "24e975d6-a3b4-468e-a83a-ef4f479fc48d", "comment": "Malware payload (RedLineStealer)", "value": "194d0361bdc50abb8479b29934fcedde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901830, "uuid": "2f1484e2-44f3-4950-9ede-074e03f5a248", "comment": "Malware payload (RedLineStealer)", "value": "29016d532a8c967c49aa06b8688541b08d984f0fe807f380742d187595681830", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901830, "uuid": "c0298bc0-275f-4e0d-b320-6f308af18bac", "comment": "Malware payload (RedLineStealer)", "value": "5b8023acb941df513bd28c48e46b2fa4e8a7b7a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901830, "uuid": "85db4dd9-fc02-4179-9e07-c804840b32b6", "comment": "Malware payload (RedLineStealer)", "value": "c04a0b1c854bca232a5b3d39a636c6f3e9c73ce648537e5ad95e512f4be0b9a593b96f26a4bee9031f0db29efffaca62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901830, "uuid": "cb0959af-8e68-48de-8080-5502e0a8246a", "value": "T1D724D57772351B9BC0451F3EEC51DE0B2D688A2A07C07D64BCCB62998B18DBC69F4762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901830, "uuid": "ceca4711-0a89-4a66-8d29-70f449592c34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901830, "uuid": "551dd0a6-b855-4211-869e-12a96216ccc3", "value": "3072:T3EQCrT7PAf9rl31j37tHrH7NyEXqkz4vjq7X:DEQCX74R3137tHrHhSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626901830, "uuid": "964c56fb-e98a-4a63-9127-56f75b6221f0", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626901830, "uuid": "1c163ccb-47be-448c-acdd-a615121fd1e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901830, "uuid": "b0f124d4-7768-4a9a-b46d-97294bf41d15", "value": "194D0361BDC50ABB8479B29934FCEDDE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad1a051-ea1f-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626870568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870568, "uuid": "7bc814c9-af88-4515-94da-b30b797f3fd1", "comment": "Malware payload (Loki)", "value": "060eada71f4d9832ebc38b5e66444dd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870568, "uuid": "3625b515-c0b5-4754-81ba-17234d67355c", "comment": "Malware payload (Loki)", "value": "297f576bc3279f82da94616e0508707489f15ab88f1e7361668a745f13a63eb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870568, "uuid": "20cb01ec-e58e-45e7-849a-24d0e0aed945", "comment": "Malware payload (Loki)", "value": "d9d7b08ae7a8ff61626a995e995cac8773c3bfc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870568, "uuid": "9e652794-9b8c-47a3-a01e-fad749948684", "comment": "Malware payload (Loki)", "value": "fb7bfcfcb752f2faa3f744bb1e6679bc1be0c19dee93fe20dae8f5928725ecbf4f299a004e977c6548e0b6d84b18ce7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870568, "uuid": "9326c9f4-5a22-4c69-ae3e-3286bbe06b3d", "value": "T1BC256B61F307EA98EC2213F8D87AD8F12263BD5DD525892B358E7E2DB9B334150E1907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870568, "uuid": "3b530eab-6353-476d-8223-5aa71e0ef7d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870568, "uuid": "104dd4ac-d5a9-4218-b693-89975df94226", "value": "12288:nsPEJmSZwuKkZEK7e0XgrMJrDee0dsEfR7qN0yaUVKnp:9JmSSdkGKR9tD90TfwN7ahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626870568, "uuid": "00c50d0d-468c-409d-b891-cbd862dc0b80", "value": 1035264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626870568, "uuid": "f88df447-1f7f-4c19-b271-bf77eb030588", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870568, "uuid": "f5aef8cd-d74f-4f7f-addf-6f19ab65448e", "value": "INV#202170607#SGNBM4809600#BL_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c21308a-e9bb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626827540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626827540, "uuid": "791111dd-0ffa-4aa7-93d7-6a123d098106", "comment": "Malware payload", "value": "39117da1ed0239ba9b17bb164dbfc949", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626827540, "uuid": "2044b20d-93ed-4b8b-84f9-7b6ec1b4ef44", "comment": "Malware payload", "value": "29d618275b93ef6ee9276495f0374485909d206e1c3033f6b83298cbdbf907d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626827540, "uuid": "43054347-14e4-49b2-8185-2e8ab7834bf2", "comment": "Malware payload", "value": "646373728a344e85c426e527f0c9190d4aaeeaee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626827540, "uuid": "40e21c2c-62d6-44aa-bb89-db81884dd836", "comment": "Malware payload", "value": "36e6fb7a9e5b183bbb753046dad8a7bb85fad290d7e993e8d64828802b92051c1ea822e87a94e896aa00e91bcaaf1dbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626827540, "uuid": "290ba3f5-7f44-46c7-a107-46eb241cc336", "value": "T1B8377D9773695191C5BBC23DCA8B421BE2B3781587228BCB15998B592F337E21B3F701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626827540, "uuid": "a878cde5-6210-4d4e-aa2f-7b897f4bbc4d", "value": "58a01dcb342d5b69678b6a4c275d6c60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626827540, "uuid": "e06c673d-f5cc-43cd-ac86-aa9b88296544", "value": "393216:rWzPC6+Jsv6tWKFdu9C2cHf1RQFM8IJDS9MCzugBgfC28GRcs7wuki8HB0NXLFyz:aT7Msng67P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626827540, "uuid": "3106100a-95f0-421b-8d74-b42e3c08593a", "value": 22623432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626827540, "uuid": "6ec20ea7-9bc2-4533-98af-ddd4988695eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626827540, "uuid": "9354a8d9-1c2d-43aa-958e-b0d73cd59c26", "value": "sphost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736096d1-ea38-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626881373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626881373, "uuid": "a71116a6-fdc4-4407-8f1b-69a19e3cfe4f", "comment": "Malware payload", "value": "56f4f81251a3d6a6e5c97546d7847b2e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626881373, "uuid": "68bedd7e-6d76-4937-8712-61fd60342f50", "comment": "Malware payload", "value": "2b02f82aed2a34dafcb6e9419821f02387ad7fa26713822477e7d5260b5a9888", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626881373, "uuid": "a7ca66a9-5ef1-4dab-89fb-82ef84969ee1", "comment": "Malware payload", "value": "bb5ff2453fc662f571aff2f530f6432ace23cc17", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626881373, "uuid": "906e0419-f3fc-4602-9612-5de73822535d", "comment": "Malware payload", "value": "3aae8928fcb569e7737163269b52af4e6c2865a455e53135468a96617d937718f6d4c05150b78e0f5ccdfd5a67477a18", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626881373, "uuid": "4f0e6dd4-23f2-4df4-b84f-0616d6db9372", "value": "T1DBD0A73D88114C465A505DF51BAEA606F27251F510E0A434E247C49C235685E9C39092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626881373, "uuid": "c5a73f3c-684c-4a62-ae88-8781d8d902fc", "value": "6:wSxWPNeFHTHHa6XX++tpP4rFcfeMbVhB8pQC:wqHTa6n++tkefTbTTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626881373, "uuid": "67e91aa3-48a3-4a44-be2a-97701b8e5c69", "value": 222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626881373, "uuid": "e77e7651-409a-4ed9-9c4b-bf68ff7dafa7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626881373, "uuid": "1980eac2-815a-4512-b3ad-23289f81cc2f", "value": "N41101255652.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7bbc45-ea68-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626901847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901847, "uuid": "cbcc61d3-f360-4e5d-9d2e-2be9413f3413", "comment": "Malware payload", "value": "31e8c459191e48965eba2e6e50f9f70c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901847, "uuid": "8ce6c5dd-0a17-4e48-8f0f-f021f1d731a8", "comment": "Malware payload", "value": "2b0f36a54f41ddf97236593602090cfcbc4d550c6cdca08d09a483b3d5b7ba6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901847, "uuid": "d0535acb-0942-4f9d-94a6-390ee489ded2", "comment": "Malware payload", "value": "2635112b75a180aa8a3fa31efc5c23b7b3d60b0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901847, "uuid": "ac0fd12d-53d5-43b9-aca1-8662144240ba", "comment": "Malware payload", "value": "daf26862abea702082606dba5888bdb821d661d4cfe52e0286534afb7b737bbb4c660512dcf2558482217f89d97a18a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901847, "uuid": "5080998f-61fd-4c92-bd99-6b53e116e529", "value": "T125C450D7649C4942D7581272F9CB05B38537AC3A20E7322B5DD47FB933AE09E93A6183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901847, "uuid": "6b9e8d5c-78cd-47ca-8592-3fcba0430a8c", "value": "9111a2909fdc32004a0ae869e1b26c4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901847, "uuid": "c40bd871-2f8f-4130-b602-ecc22b4d8675", "value": "3072:kfOUGryfXg9B9VfQdI4N/gVXBBuavdO+avOD6tGX2:syl9bxb454VdOjvW6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626901847, "uuid": "58705d31-6fca-4c19-8977-55721a295d33", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626901847, "uuid": "8661cd8b-94b4-47e7-909c-dad29a2ec4f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901847, "uuid": "5b0919b7-eced-4d48-b95f-e5e49ab4f786", "value": "stin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a552746e-ea79-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626909375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909375, "uuid": "54cd1b25-4c34-46da-a175-68bbf3a6ff39", "comment": "Malware payload", "value": "603e538eb98ffe45f49c7f2cf20ee1a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909375, "uuid": "5982813f-4b0f-406a-bb71-1b45d3f89a23", "comment": "Malware payload", "value": "2b496b44c02b426347ec40f323b9a43912dbf79fdde8196e52c66825b6f5c535", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909375, "uuid": "7d2d908d-f53e-4995-b7eb-dfc0ea60f674", "comment": "Malware payload", "value": "3e9550d112d20c1dd957875e0cc8683fab44ed5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909375, "uuid": "81d0310c-1b87-4314-b3b8-b9a2ed967c53", "comment": "Malware payload", "value": "98e281890cdd0b552bde85ac71416af3ca369d193c7865224e4e7a7788815e21de409409551178c94bae1a6bde24908f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909375, "uuid": "8bbd872b-5a5f-4c10-87d0-88e0f1b1cd53", "value": "T1B6B40180F280EC72D16D093118F7D399667EBC762A6C41977A497ACF6F702D142BEB06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909375, "uuid": "fb2cf272-7630-4b7b-9a6e-d6c04bce9211", "value": "7780eb9cc098185992365509d7637fd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909375, "uuid": "cfb96869-c1b0-46cc-a7dd-c647107a72ba", "value": "12288:qoXjunv1rn7oeUAUKRivnhN694/4eJclvhCy6Lhm2ld:4tnxUIRUhz/tqOy6Lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626909375, "uuid": "5f0fb807-3764-4c69-a2ee-af39b3c50045", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626909375, "uuid": "09507e50-c213-4708-8ef5-f579d6d1f105", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909375, "uuid": "4592e31e-3056-4de3-9035-e7bd6e361b17", "value": "603e538eb98ffe45f49c7f2cf20ee1a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ad56a2-ea51-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626892294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626892294, "uuid": "337f33b1-56de-4f12-92a4-fa2f82686411", "comment": "Malware payload (Dridex)", "value": "397b799c357562c5a8061a39514d7785", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626892294, "uuid": "822ba26f-ad31-4329-a394-aaf2cbab436c", "comment": "Malware payload (Dridex)", "value": "2c54438f5d99d15e5df3965397e25a0fa17ca7f08d317eb4bf31d1268e10f020", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626892294, "uuid": "31125eb0-11c1-4294-b84c-a49bc2dd7dd8", "comment": "Malware payload (Dridex)", "value": "80d3d5366f47d3462ea9e688f444066d7fce2a24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626892294, "uuid": "93642f99-53ea-4a98-9c09-1f7a924859b0", "comment": "Malware payload (Dridex)", "value": "eadd0a829375cb967289f150acd3054b0e5327adcf3f0b45344141f585b100bc76ec3cf6bc130612df198f48d3924966", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626892294, "uuid": "0dfa7e5b-3778-4072-9ee6-524ccb219180", "value": "T10A04C076AEDFC0B9F2A39470103437AB26F57A032419F452DA60C8DBF83D99468A4753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626892294, "uuid": "68b0d219-df50-4db8-97ec-404a62f1912f", "value": "458d7355fbf070054838e3593829db8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626892294, "uuid": "0f341f8b-70b2-4307-9ecc-f929f1a14c87", "value": "3072:qVadvfvemTEtQ9yoZPW/k/nklVtu77wBeZUCEQZRpTBDp57WQhdIif4:zDTyJWPd/nkdqw4/HTB77WQhdIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626892294, "uuid": "5205f42f-9ca6-4c15-bad8-903ecc9585f7", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626892294, "uuid": "6253cc65-c7dd-4cbf-86c6-d8fe93a8af95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626892294, "uuid": "4fb8fcbb-2656-4dc7-ac5c-2fe819692e1b", "value": "397b799c357562c5a8061a39514d7785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93762db9-ea4b-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626889588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889588, "uuid": "8928c9cf-81d3-4e7a-923a-8c42ca070d27", "comment": "Malware payload (TrickBot)", "value": "8c0aceb389291c49bfd4aa86733af520", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889588, "uuid": "22d8e204-ab1c-4600-ba39-9ef3501bd1eb", "comment": "Malware payload (TrickBot)", "value": "2c773049e4974dfd199134bdb84cc99cfbe76a6f09996d87e9219767527e5034", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889588, "uuid": "91f7c8c5-408f-4b7a-8f80-a2b60f956996", "comment": "Malware payload (TrickBot)", "value": "0acdf92b55a4e5dbbfec5aeb0a8739c324c50a63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889588, "uuid": "90747e21-7556-4f2b-aff4-177dd68e1c32", "comment": "Malware payload (TrickBot)", "value": "946bcee7db5cd8469f6abfefba59bc4be65db3ed5037d07fbcfcf849bfe36ca82cfc1dec691d4176cb3812a8e9a94c54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889588, "uuid": "8fabaa52-468d-46f1-a7e7-ca524d193f8d", "value": "T1A6A4E02C3480F4F6E0230175C9999665CAADB8247B2378E7E7C46EFA7F655C09A3431E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889588, "uuid": "519cbb35-38e0-480c-b709-41ac18fd3522", "value": "13012c7764c22db0eea00ae6b1458d85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889588, "uuid": "44569ed4-a523-4a5b-b8c8-fa6484941bbe", "value": "6144:ybRfnjXFr2KeL3bbHHjYXWOZcy8QGd37ci/fW6/gNXtlTF5yVNU5JhJDCyFE:UZr2bHHmjMd1W6/gNXtrkVQhJDrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626889588, "uuid": "8814235d-c7bb-4312-9f6c-a0b1a7907cf9", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626889588, "uuid": "1e25ec39-7dff-4a30-aab4-b908f278bf43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889588, "uuid": "5735772c-2388-49be-9c98-77fd1cb7c164", "value": "suntogether.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ada5f1-e9c0-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626829863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626829863, "uuid": "c3ad3bf4-7158-4c59-af17-3e4e6cad141e", "comment": "Malware payload (RaccoonStealer)", "value": "66a30d61f8432d35bfc039f30d23aa04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626829863, "uuid": "b6c00ef4-1d50-4108-a6c8-f4bbfb73b9e6", "comment": "Malware payload (RaccoonStealer)", "value": "2cbfc499e8f27bf6e4dbc0533febeac5deb0f24c6ce83aa6d60b17433ae3cb40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626829863, "uuid": "50941ee7-da2d-4b83-ac30-b2d5aafe04dc", "comment": "Malware payload (RaccoonStealer)", "value": "200615c74091e9cc11b66ffbebde2cadd7479422", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626829863, "uuid": "5421c6b7-199d-419f-8198-8e2605b149ee", "comment": "Malware payload (RaccoonStealer)", "value": "3a23c9bf8c59c2665e50da8eac1ce293bebf788b916119c3f4ac13333892335655ef812c087a85c673094d6ba9c98047", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626829863, "uuid": "40550bb8-e99a-4195-9be2-9dc2f023b7f9", "value": "T198C4D03166A1F036E0F312B448B69279AD3A7DB1A73C94CBA2D03AEA56345F4DC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626829863, "uuid": "ddefbd7d-9789-4cb2-945c-103276e11771", "value": "cb971fcf399235e4e9a69622d3809fcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626829863, "uuid": "7078d287-2121-47f3-a076-474bd267d030", "value": "12288:WZB/oqYL8EhfucNQOG+LrIHBqpZekJchnabO1ljzIPyfdWfhYVzZQ:WZBHYLqp+/FgkJchnabuMPyd2yzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626829863, "uuid": "476b3dee-1fe8-4615-a646-1511ac40d8cb", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626829863, "uuid": "42be3b98-a4c4-4ca0-8e33-86ed08777732", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626829863, "uuid": "dfc19c53-dbdf-421a-be3c-09e2c063045a", "value": "2CBFC499E8F27BF6E4DBC0533FEBEAC5DEB0F24C6CE83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb9de91-ea64-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626900285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900285, "uuid": "c61e6c25-3ab6-4753-96af-5e6a282d0df6", "comment": "Malware payload (Mirai)", "value": "6a5383fb85a05d4087d3a916f178adcd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900285, "uuid": "17b85619-9ca7-4a58-b8cc-907a1a6a95d7", "comment": "Malware payload (Mirai)", "value": "2ddd61b9ffd703b4a95c117b4e3fd51f131c71dbef60abd283c17dce9e2e7847", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900285, "uuid": "5cc97b56-3a33-4b4b-b795-e0eef8dfaa3b", "comment": "Malware payload (Mirai)", "value": "79b84ab709481d004fd8bae148fa71e48b8967f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900285, "uuid": "f19906b1-ee1f-4fbc-96d7-314781cf4c41", "comment": "Malware payload (Mirai)", "value": "b10f0af45c75436466bb66d994bb4b4825503d1ebaa62cfecc8fd012592841aa556513d86f80d064cafb1876aec6e2d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900285, "uuid": "cf601a51-48a2-469c-b878-44df201d1481", "value": "T1AC432925AD792E26C0D8B57E11F78724F2E2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900285, "uuid": "df0af6cd-28ef-46a8-8f5d-f64dbd9a6850", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDH:eL0AxvSHfymp0xgunvCkV6vTMDaus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626900285, "uuid": "7fcc326f-47f2-4bd7-9c86-b8337f74fe9c", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626900285, "uuid": "d63d3817-8621-4bde-93ec-f968eb711e55", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900285, "uuid": "d3a9ff5f-cf71-46d7-ade6-81b065689c06", "value": "6a5383fb85a05d4087d3a916f178adcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f478cb-ea2d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626876737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876737, "uuid": "6b9a3a26-0380-47c8-8047-00139e397d58", "comment": "Malware payload", "value": "b38108328046da796a81ccd59bbd0b2b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876737, "uuid": "f3d76771-b78d-4141-a1c7-cc8bc4ef8588", "comment": "Malware payload", "value": "2de9837a499a33f4c3d1190df9ddcb79f99719ffdd49580316de56e76d4abb61", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876737, "uuid": "86444f7d-f54f-4453-b964-584d37c9ea6b", "comment": "Malware payload", "value": "7085d7db0c107f7b894eb751b7f74ef3ac54f703", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876737, "uuid": "74ee811b-3be2-4f50-bbb2-f2da6d08671f", "comment": "Malware payload", "value": "0eff0e5714f641bffc8b89123c09d61e1122bc011553a6e42ef414e4bef4694696189caf3987c6ffb98308610d997bf2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876737, "uuid": "8339210e-74ee-4873-9fdc-68d6f9d04ff4", "value": "T173336FBCC09742988F86ABB86B0B1F96154D3A6EF788A573367C577427D1CBB410293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876737, "uuid": "169096d9-e151-43c8-88f7-6f8c6170aa46", "value": "192:8RpTKXAwAP/3G5ZbqWZKPAK3DJrqS3tiKL6F8PxUmln/1LieJMtgseDjpxPuMIS:CVZP/3Gb+WuT3EKL6yPF/RieAe3ptuM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626876737, "uuid": "824376ff-d307-4c53-86b0-9f4355cdc842", "value": 54538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626876737, "uuid": "aae1b567-f140-4e7b-9051-e37f193d5d30", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876737, "uuid": "2a958c42-6d85-4dd9-80ed-6ce42aa5a28b", "value": "product picture.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb575150-e9e7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626846705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846705, "uuid": "470ac3be-54f9-4fdc-bc3a-d55bcf24056f", "comment": "Malware payload", "value": "bdeba8a3ea9e98c5938cb8d611f607d3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846705, "uuid": "b01a5906-6220-4515-b709-290860468575", "comment": "Malware payload", "value": "2e174386633828e5b4c6628c7957dc843ade571ac5644f27924459a76748c706", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846705, "uuid": "da8629b2-71c8-4895-a413-5edd1e126fc5", "comment": "Malware payload", "value": "334f2e2b701c1e801b7951b25f49d3c82267b54c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846705, "uuid": "9c9b4e93-903a-416f-9793-b350205a86ad", "comment": "Malware payload", "value": "f2786aaa9e4bea51fdd1d5da4f64961d2471ef5bb3de02116f72f9f7abaf7451d8ba1bcde9bf6b8a8847aff3fdad8c24", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846705, "uuid": "29cbc62e-750f-44e6-aaa7-861d23b40b69", "value": "T174356AD441CB1AF3F1CD3A541A50F04E572AA64E50914C6A2B2D9FE4BF093FB5F8829B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846705, "uuid": "8dbe81b2-9877-4983-8fd5-0042910c50e6", "value": "12288:Zc+NeyoDJLR7mWZ2b7B/u43mWZsdzFZRsUj:ERsUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846705, "uuid": "e9abb7d9-c8e4-4505-a472-b7c1c1030433", "value": 1067566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846705, "uuid": "253ff313-7fec-4dfa-9f4b-3e09cf9b6729", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846705, "uuid": "6d038206-525c-4e33-80cf-a85ad8adea7d", "value": "PO#021144 .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316ccf6d-e9e7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626846474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846474, "uuid": "800d68bf-0dec-4808-a217-f9535262f058", "comment": "Malware payload (AgentTesla)", "value": "459a093eb5e65eaa2ea203129f6fc91b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846474, "uuid": "bbf29c1a-0fac-48f6-a721-0fa2a8fab148", "comment": "Malware payload (AgentTesla)", "value": "2fa2da63cab278643f6689a14440ec013b59ff0edf2af12d316f50ba0448d5dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846474, "uuid": "c4278d3c-7f9b-40e7-a53e-382125113e0b", "comment": "Malware payload (AgentTesla)", "value": "54dbfa240eca0fe2543d220128563e18b654d3d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846474, "uuid": "fe672976-118c-4edd-b67d-aed1e18350b4", "comment": "Malware payload (AgentTesla)", "value": "61e1fb633cb051913ec1a4b39655b80175c07635180939ec6fa358365dff28953ef10c6b3b4400ecaacfb1ab7c95d205", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846474, "uuid": "bb079cf4-478c-4033-b457-b8a93b4e686d", "value": "T16B25C02113BBA294EC3E67BC8834C04597BB7016C67FE72D2D4440ED2E72765AE9B352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846474, "uuid": "ba2c9a21-4965-4061-9fac-4f681aa1ffac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846474, "uuid": "d24de812-bded-4311-8c33-79aba7c458b0", "value": "24576:PH8CHmbavDB7KW4XFb2brgetb5zFDql8CW:sOgDFKngex5zwl8CW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846474, "uuid": "203f5ee6-2d84-4d2a-a6d3-2a6e0e59fd92", "value": 963584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846474, "uuid": "c854b690-875a-4618-96ce-aebc06d74d2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846474, "uuid": "70b6831a-f150-4cc2-86ff-96465965370c", "value": "PO_210720.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8a9e8b-ea4d-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626890541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890541, "uuid": "59635d76-e6b9-4b0c-9146-56c9231e1ccc", "comment": "Malware payload (Formbook)", "value": "6c15b3de8c54e5e3339a446af50fc48a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890541, "uuid": "20de733a-5540-49c2-84d3-4b3eef4b1a13", "comment": "Malware payload (Formbook)", "value": "306197e367d32ebeb65e18cd9607f58268f6e4751de77ae1cf8f5270e660c1f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890541, "uuid": "bc3a3396-c17c-475f-a4f5-f8ffef51dc62", "comment": "Malware payload (Formbook)", "value": "1133619a11f7410cf2ee2ca0e42324898e524154", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890541, "uuid": "4a5304d4-0d1b-4e8a-80f3-cd5bd49fd0fe", "comment": "Malware payload (Formbook)", "value": "3dcce9132d07f854c5e9a1fc312341f9a7018f971993b2d6678a07c6c3cdd5012dc7976ce77ac5225373d61c9ec549fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890541, "uuid": "ed49d772-2a4c-4b63-b7b7-0c0cc32d6138", "value": "T1CD15C02113FBA284ED3E67BC8828C04597BB7016CA7BD76E2D4440FD2E73751AA97352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890541, "uuid": "3d8121f8-7715-4b91-ad9b-868d70ec5a1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890541, "uuid": "755c1fab-3895-4bce-985e-1129958ecc69", "value": "24576:HUB5g8C6N49vDBn/UoNzQO3b6XpOETGcHgr6:EKK2zQO3b6XkET9gr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890541, "uuid": "a966115e-85d0-4932-8940-f030bee38224", "value": 926208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890541, "uuid": "de9f868f-3b8f-4886-8de3-4274fc4051a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890541, "uuid": "449ed58c-ccbb-4449-ad32-2551a799b255", "value": "6c15b3de8c54e5e3339a446af50fc48a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38749c1d-ea59-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626895448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895448, "uuid": "d2a08606-650c-4048-8f8f-1d79391325f4", "comment": "Malware payload", "value": "6bf05c7bf2922c92b590ccd9f81adead", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895448, "uuid": "f39d3bf9-4e57-4162-90cb-8e55431a3db1", "comment": "Malware payload", "value": "306b49ee2d7c8b286e5ff5334c84352d2d7fa39681f4f5349026cb1d1dbf9366", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895448, "uuid": "2b9b00a1-fe3e-47a5-ab96-216f7ce98d0b", "comment": "Malware payload", "value": "80e46189cde0ffa29e0b587a4fa23a826a260048", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895448, "uuid": "df84b144-25b6-4c73-a198-0cb0db034044", "comment": "Malware payload", "value": "6a865c0bd5342e54b94140639cac0bf87f3c9d6947cbfeebbed55e0763d3d341f1698765623046d216f0766167fd555e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895448, "uuid": "70614d38-1918-49cf-9085-4317b39c6af3", "value": "T17AE38D479112A3A3D03893F93F0B4E986B15AB1CD5C1BCDB14561CEB3BE13221DAE65E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895448, "uuid": "8213ee05-4997-4f53-b05a-378e42e2bc0d", "value": "1536:oJxOIXUJksB977w3mv8fdwLmG9s80okHwjzjoki9cIyhGfaZWDClthH:wZkCS7k3XOmT/QzXIWGfaZW+lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626895448, "uuid": "8e9d909a-b435-4bb6-be8a-aa1885835daa", "value": 143992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626895448, "uuid": "0bb3126a-387f-4540-a212-ec10c89c2afb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895448, "uuid": "1f5a3923-56fb-4cde-963d-80958a42fbcb", "value": "306b49ee2d7c8b286e5ff5334c84352d2d7fa39681f4f5349026cb1d1dbf9366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed3b1fe-ea6a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626902814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626902814, "uuid": "8905d162-9805-4c54-98b5-c61fc94e1ccf", "comment": "Malware payload (RedLineStealer)", "value": "55eb0f78b0b98719ecc423744ee2a11a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626902814, "uuid": "ac0eab10-667b-4437-9c17-f343a3f7f0b2", "comment": "Malware payload (RedLineStealer)", "value": "309aa6af647b1267fef90257e69cfe6be01ed03d3bbcc512dba951bbf4056916", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626902814, "uuid": "6b37c246-d509-45c1-93f4-e618a8b77c8e", "comment": "Malware payload (RedLineStealer)", "value": "a352fbf68b0d3441008e9efdaf1871dd61e9223c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626902814, "uuid": "1e5c8af1-cabe-4027-8778-51e296d73584", "comment": "Malware payload (RedLineStealer)", "value": "89a645fd4fddbf14db04c6499d98075be34218b44581f67cf6f259bc83ac0b007bb2cd56cb910459c7632fd7a4ad0d70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626902814, "uuid": "f97d3f87-63f8-42f0-95f4-b1763f0e4722", "value": "T13A64E140B691D832D1B6093118E787A42B7FBC726F7D8A5B664C37DFAE312D2526D302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626902814, "uuid": "702b6b1b-a568-4b4d-8b89-e069446956db", "value": "010b99662693ba25ba201961c31754d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626902814, "uuid": "35bfa6d2-13f7-4f01-8f0b-4c9ece602884", "value": "6144:J7ieble0HNjhCmnjJQC2X2GnockoL5uJLyXrvWQlrFzBnmytldWgy:J7ieddCmJ2mwou9u5yzLhm2ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626902814, "uuid": "027d6572-3739-4098-9ca5-8e98bae2c698", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626902814, "uuid": "1847a252-d089-429b-97fa-ac34c8c156c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626902814, "uuid": "f4a979f8-af76-4073-98e9-2c3ffa14aff6", "value": "55eb0f78b0b98719ecc423744ee2a11a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911a6a2c-e9fc-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1626855654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855654, "uuid": "321c8840-45c3-4fbb-b71c-355deecf5da9", "comment": "Malware payload (njrat)", "value": "47b320e00bece91f878ea9ba3250ac43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855654, "uuid": "9ee371fd-7866-444b-bf00-fb4e56a0fa91", "comment": "Malware payload (njrat)", "value": "319b6b852006b89fe1aca8715cd3720e9a15ca2176ea256b9fd93557130d4e79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855654, "uuid": "75ded37c-600a-4ddb-8f91-cf363015b97d", "comment": "Malware payload (njrat)", "value": "7a415bd12d860aaf3549feae624c63f82e7a553f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855654, "uuid": "749fe3fa-5831-4f67-ac65-1b2d21d298a1", "comment": "Malware payload (njrat)", "value": "3807b7ac9274029148e36626f33da3eb6fb68155ffeb09d9a6bc1b5973bc9a935b5c0275de0cccaa15c4dc97df0d9be4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855654, "uuid": "7dd30d95-5909-4ff3-b036-240f55238cba", "value": "T1AFE3629C766072DFC85BC876DEA82C68EA50747B931B9203A45316EDDE0D99BCF140F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855654, "uuid": "320cee4f-b889-49f8-bad2-b4ad4a2e6e51", "value": "3072:DZK7SZ0WKOUngWRdaD48Fn2U1wDPIlwKbpogTJw:DMy0TOUngWX+b1wDPIlwKbpogTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626855654, "uuid": "3471b5be-6095-4f7e-9fc6-9ba9dd00578f", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626855654, "uuid": "602d1d48-c22a-4bbe-8c9f-f6f8caa94577", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855654, "uuid": "9208d56f-325b-4bbd-a4e4-308209f4a83b", "value": "Win defender.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505f5dcc-ea4c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626889905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889905, "uuid": "78c09c41-d084-40b2-a80a-da9ec9cb38fb", "comment": "Malware payload", "value": "274cce7fcada1c5f5dabb95258c8f397", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889905, "uuid": "cf442f47-6041-4073-9333-4cd003d670a7", "comment": "Malware payload", "value": "31b94c9e52001f755b808a74e266827611a0ee34cedfae52911dea2aff8cec5e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889905, "uuid": "22d1eff7-c44f-4fce-bd2c-3d628fe95341", "comment": "Malware payload", "value": "4291ec913b353da68d2e949a99b96695bc03dc82", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889905, "uuid": "bd377b3a-b6cb-4f68-9727-c5a82fee1335", "comment": "Malware payload", "value": "d0237a95924cc1a39d235f9a54354dfe6f996eb4d8f1ea46647a6e129b32d3ce849012e3b52d2e685af2927af665f450", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889905, "uuid": "f9963722-8384-4c02-b956-e12318921581", "value": "T1C52186296ADEC87FE60BA5B10541A13FA7A990101C4E0227214A286CCA28BF55B06EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889905, "uuid": "5ee522ca-54e8-43b2-a57e-a8cd55c0b676", "value": "24:9EGtDq3IHOt+E45yr9Izq957SWrTsqUWoMXx8r/d:97tG3IHwYuIm957SP3MXx6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626889905, "uuid": "e750f439-618a-47ea-bb22-05aeacc4743d", "value": 1164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626889905, "uuid": "1f75793d-6aab-4c58-bef1-f8fbe3e21c13", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889905, "uuid": "1420c4cd-f49c-4aae-980b-f5c818746ed2", "value": "OC_0077.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ab244e-ea4e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626890801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890801, "uuid": "88037420-6ece-4a04-8bde-ce814d7c4da6", "comment": "Malware payload", "value": "23e2997ec02160eae8f64c1a8a50bda5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890801, "uuid": "03b476c7-129b-467d-97e6-d0b4448ac909", "comment": "Malware payload", "value": "336f9668baec97cabdf9bbcef93c92242f3614f52b21baa9c36971fe489ad828", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890801, "uuid": "d556c8b4-b986-4cfd-8556-2742e541db39", "comment": "Malware payload", "value": "9afa53cbb9b8b9855a615fe4c96e7a936398fb55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890801, "uuid": "2669815e-cd12-4ca9-a02b-09baebf8d040", "comment": "Malware payload", "value": "5446a7328393fbd3e4486fe8db4a0d606e02ec01316700fc4c21343d9fa79e2a66c5ea7e95f089cd74e35319dd1a0a24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890801, "uuid": "1c7b99f7-527d-4a6b-ac2b-e9ad51959ec9", "value": "T110E308FBF056905EC4F81335F950EEC73CF8B83265807548AC86E294896AE4C69F7764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890801, "uuid": "19684bc8-273d-4258-993a-17ac90065430", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890801, "uuid": "69be92ed-8ed2-49fa-9e6e-057d43d9b181", "value": "1536:T+v0vCYHBD+FCXbKiusxkHXaPUFWam/A2T05IRufdLWgP:TIpQ1b3TwXaPdam/A75IRuW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890801, "uuid": "ddf64f0a-4720-40ff-a3ac-6129f261ad58", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890801, "uuid": "cf80c643-87f5-4a8c-a0a2-4b40a595d529", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890801, "uuid": "86948d67-cd84-40bd-a3b8-7cf885012d21", "value": "23e2997ec02160eae8f64c1a8a50bda5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d435ff6-ea72-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626906328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906328, "uuid": "dc53c69a-7442-4cfb-af8c-7195199ddb59", "comment": "Malware payload (Mirai)", "value": "38f63af695adcbac76e5f34f7871dc47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906328, "uuid": "9a615be6-9ab8-4989-8496-aebde5c58eb5", "comment": "Malware payload (Mirai)", "value": "33c427ea3566f4cbb517506d1f4d832557b5947d21f98238312953b8e6188451", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906328, "uuid": "09127328-c9ab-4a02-a202-190719fa44a8", "comment": "Malware payload (Mirai)", "value": "651a7400b9e709d42e88465722ae58f954990f8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906328, "uuid": "9dd0919b-0292-42ee-a69e-985fb2f6b776", "comment": "Malware payload (Mirai)", "value": "e0207968fd90d1f90f433509fab33b0af675d8ab1752ae982bf9d92002cb8964e147162efba38122cbae68b33fb7e067", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906328, "uuid": "b3617de2-8abb-4a9d-b2a0-8fa6c4393699", "value": "T108538EA1D839AEB5C041477869144D325B13A0819AE22DF7DE6286F58C43DACFC9EFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906328, "uuid": "3bdc585e-2b9d-4629-96b7-9bd90785952d", "value": "1536:raIvVlfdFOXwtkDzHQPGdfs3QaK+/qgC0VmCU:r5rfdkXFQEf+QbWC0Vm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626906328, "uuid": "b0998be5-3f47-4cc0-a6bc-85e4103eab07", "value": 66548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626906328, "uuid": "a4c05153-3e09-42b0-a201-5bb45f6ffbaf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906328, "uuid": "41a86100-0583-4ead-98a5-f1caef949567", "value": "38f63af695adcbac76e5f34f7871dc47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd48d502-ea0a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626861741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861741, "uuid": "0c9a8b0f-a48e-4f05-9c00-ee0b2594695a", "comment": "Malware payload (RedLineStealer)", "value": "c8135ba225fdb1f63d3f78f57eea2cd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861741, "uuid": "7e098758-f7df-4af1-ace3-358f350fd79b", "comment": "Malware payload (RedLineStealer)", "value": "344232575bf5142418d1a1dddd9060deebe9f81de2882385de02aa39a53b2e5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861741, "uuid": "a0eadef0-ecdf-49d6-a003-39866469fd9d", "comment": "Malware payload (RedLineStealer)", "value": "6ac0bc97fc9599291be78932217da34cb5935ca7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861741, "uuid": "3db7f4d2-281e-4ac9-a5a1-1c2edb5b4622", "comment": "Malware payload (RedLineStealer)", "value": "105b8efa221d032d1cf35c87f8d3472a0067d2a33edc3e76e8d8138ab0fd7ba6d614bb99d18351dcaeb1c60f6cad5d91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861741, "uuid": "bdf670a2-5caf-46b1-a6d4-5598b4ef9a1c", "value": "T157E31777F331135BC55D2E38D821FA4F2768652B0B4072B4FD77A2888D28E5D49BB268", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861741, "uuid": "ee69239b-bfb2-4ff9-91a5-ba08d7dc603a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861741, "uuid": "2869d100-d903-4464-ab00-e076ed1ee1fb", "value": "1536:A3rbjfUp3MO8tG6dkIqJqVFt74flAzmAu9Jyv9T3TDuek+F:A3rfUpzJaqAFKflAa9W9S7+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626861741, "uuid": "c53f0d6c-d428-4b70-b06f-a314acf07272", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626861741, "uuid": "ea55bba3-c817-4d47-98e0-74a66f9b6f7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861741, "uuid": "aa318cda-7ca7-497e-90ff-fbf9cb579016", "value": "SecuriteInfo.com.Variant.Cerbu.108262.10538.12136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8bc6039-ea3e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626884067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626884067, "uuid": "920817cd-d4ce-43cc-8785-33acbb2d7cfe", "comment": "Malware payload (AgentTesla)", "value": "8120bed0e0875b8318ace086962b79ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626884067, "uuid": "4efe2d83-295d-4e01-ae79-19ec72d0713e", "comment": "Malware payload (AgentTesla)", "value": "34d69bd8b5f821d7287f3e04e119b2c039721d09232ad769c5209dc2605f20b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626884067, "uuid": "68a47f30-ca48-4a60-8241-7d2491ed7046", "comment": "Malware payload (AgentTesla)", "value": "d50078fa3081c0b6b4ce281d3e6a90263e936dc6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626884067, "uuid": "bfc76f0b-e2b2-43bc-96ea-2866e346522e", "comment": "Malware payload (AgentTesla)", "value": "68ed38b0bcbe895d8ad334b3a88bd0f3d41119e767f82c7a3988759aacf2b7ea1f4718951e1fc8b8aa1b04a071f056c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626884067, "uuid": "d2653c1d-a1b1-43f7-9566-1a1bbdc0e030", "value": "T1B9358E224DCE4667C2644AB7D331EF02DEF10DA62544EE152EC1F0EB9D3729A949ED0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626884067, "uuid": "4b19646a-5a75-43db-a512-62d4274b8538", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626884067, "uuid": "81a1ca75-4d62-4670-b091-7b8dcbb72fba", "value": "24576:JrFRaDGhRHwUdRSq13hGUy9xxKaIMipV:T7h1bdRz3hGUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626884067, "uuid": "dbe280a5-22a8-4163-83cb-3c1db5e1b26b", "value": 1141760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626884067, "uuid": "e93d7a5e-11e0-48a4-ba07-195cda3ae2fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626884067, "uuid": "6cd4094c-0db2-484e-99e6-e7f47213f770", "value": "Ref 4359-0201-106.034.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa30640-ea4a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626889340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889340, "uuid": "905af573-f84b-47fe-afe7-aee75abc477b", "comment": "Malware payload", "value": "25f485e0ef7ee4ad57dcf6b31349acc7", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889340, "uuid": "1f55c944-e0c9-4d93-b863-851230a56036", "comment": "Malware payload", "value": "34f1a9c906fc08849f9c7d85edfa9915b46516a0708d2835f7a19ba9e5a1b386", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889340, "uuid": "0d45d456-cfc0-4bf8-8947-646ac05a3979", "comment": "Malware payload", "value": "3a24b3e770b146665f218080808269267727cd43", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889340, "uuid": "8e55115d-d437-4b8b-91fb-f0f80894dab9", "comment": "Malware payload", "value": "e6f181f6960ab78911ae93429a02ce792baaa06683f7939ccc2f8d8f7c24fd7afecf369d56c8eb442ce1b38801623d12", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889340, "uuid": "a8d8f09d-d43d-4b21-9770-cf06a330eee6", "value": "T151329E0EF420F138C23A89BFC4098AF4D64D60175A46B6A53551F99D1A677EB03EE3C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889340, "uuid": "f205478f-fbdf-4384-b43e-93636e6b6327", "value": "192:tb3xScIOxNw1TR9NspLZaFUlbVvevUqzCybHxeMZ8++4iG1:VFIOxNElPsoUlM9z/F8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626889340, "uuid": "a50355f9-34be-4ca6-842a-557a6d6316db", "value": 11561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626889340, "uuid": "56d6a7b6-867d-418c-a754-a77427b3e048", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889340, "uuid": "bd375f88-69cc-48f4-b25f-7ba9d63657b2", "value": "Readme.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5f4557-e9fc-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1626855647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855647, "uuid": "50d08553-7e4c-4135-843c-70779993832b", "comment": "Malware payload (njrat)", "value": "b941df6a19c37ff4f77b1ef1cc2ae16d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855647, "uuid": "0206a565-6e5c-47f6-99c4-e81d263f5c09", "comment": "Malware payload (njrat)", "value": "3582b41cef347b9aab950ae01a42ecf76d9d13b1b1a4601fc03bc3ee4535fa4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855647, "uuid": "c086e167-e0fe-41e3-912e-c241243dd10e", "comment": "Malware payload (njrat)", "value": "d1531f8fe3cc29cb6be790fbceb713c16fcb7070", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855647, "uuid": "94d459de-9089-404d-9362-2f514c42480b", "comment": "Malware payload (njrat)", "value": "d581bff7aa30a8f9b759e0833c7715bfa9ddb80e42ee6a06dfeafe8fd7325dadbe635ec7f6df571bb22a4971611e7660", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855647, "uuid": "2bb63545-0e3c-4a94-8c0a-31a902dec9a9", "value": "T1B9D3939D766072DFC85BC8769EA81C68EA60747B931F9203A45316ED9E0D89BCF140F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855647, "uuid": "abad51df-884d-4848-83a7-10b7d9b1a0f1", "value": "3072:SNbunwxGaGIf5qq+lTyqTSPtDN8ecfQ00gv8E6SfzsMAIY22TJ2:ScAGzIf5qq+lSxqxfQLW8E6SfzsMAIYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626855647, "uuid": "c26a0474-9353-453b-821a-eed86a927738", "value": 136192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626855647, "uuid": "23b2a9f8-29be-4a2d-b028-72b40ef56c70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855647, "uuid": "11c7ba9b-4126-4d18-b9e2-b24fc7d571df", "value": "done.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b138c969-ea0a-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1626861720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861720, "uuid": "cefe80b1-815a-4428-9547-74f5ac9e23c4", "comment": "Malware payload (GuLoader)", "value": "19cac1ee3a6e5e9f83054616f5d5ce6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861720, "uuid": "40ba1311-f5f7-43d4-ad84-044653cbc0a4", "comment": "Malware payload (GuLoader)", "value": "3709110cc04e0eaffe10bec5e8a5c82b858bee4195975e7bcd30c50b246f56c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861720, "uuid": "81419d58-7027-4a18-98bd-4dfcab08a11d", "comment": "Malware payload (GuLoader)", "value": "5b7f16098760f887b0bdc5fee9223d022e0597fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861720, "uuid": "d936eb20-27f1-402c-8367-ef118612209a", "comment": "Malware payload (GuLoader)", "value": "8ec55eab895484d78d770b8c5009fb4abccc1a79ae4b57373132a55ac201c71cafd7ec1f0938890b2237cde633582b4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861720, "uuid": "3121251c-669d-4f11-9ad6-53a917ac926d", "value": "T1A33417EC777DFC8AF88BB8346A51BC2556B4A4A58B4C878664C472D9ECF0F8204B5317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861720, "uuid": "63a10323-07e0-4c39-a6f9-eb3dd3c0db58", "value": "4e1e57f6de47f654992269152dd1e659", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861720, "uuid": "8a84e1b7-7ad4-4349-b059-c4d6e1ca07d2", "value": "3072:MtU2Qf98DH332/jEvQuUZZNzPmhd3QPBP:KU2Qf9iXm/jduUNzPKNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626861720, "uuid": "53324877-f4d1-4772-9d4a-6e4304458576", "value": 246888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626861720, "uuid": "fdd61960-41e1-489d-873e-54c973aee79d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861720, "uuid": "fcabf078-b751-4509-873d-439aaa3b38a5", "value": "SecuriteInfo.com.Variant.Graftor.981190.24096.12674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82d9593-ea7e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626911554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626911554, "uuid": "dfca58af-b2de-4f34-bc34-796c04bffc4d", "comment": "Malware payload", "value": "d21abe71ba2abf923b575299dc17854f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626911554, "uuid": "026059a9-1d71-46e8-9722-271341ef9b60", "comment": "Malware payload", "value": "3805dae603dcd659643f0888fe35b9bbbd0173c63ff5ce1ed5bf678e4fa5db90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626911554, "uuid": "ea37c102-9d5d-4718-a54a-d3329c758fb7", "comment": "Malware payload", "value": "392e079c675a0065c6a982ec848a18f3277f30f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626911554, "uuid": "3c7d4733-d03a-4eee-bc3c-b0fbcbedb19f", "comment": "Malware payload", "value": "f7b138d39256227dd96b03b3f304a5fa7eb4b04a77f1e7371cb6f1c8e008da29c2a7eda1ad84cb0bdf96aea9599d5199", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626911554, "uuid": "7f5a0848-10ac-465f-91af-9a5247a979e2", "value": "T15B64EF10B6E0E832D1B7583148F7C794563FBC226A2C860A766436DF6F322C16A7D7D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626911554, "uuid": "be656f7b-f6fa-450d-93a0-5d121ac3eef6", "value": "266aa3b561e26e3b4d438fb26814163c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626911554, "uuid": "a714f44d-9c0f-4b5e-bb3c-e6e6b47405c7", "value": "6144:9s9bsXsfMJ2aVP+EWXVDVILyXgZvEDlrFzAy:9s9YXs00aldWXVDVwywZvEDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626911554, "uuid": "326d2183-d207-4c73-8882-74ea57d9c844", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626911554, "uuid": "5ad4b691-2359-440a-8e0a-3b7b1f9e59e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626911554, "uuid": "ac995762-32c8-429d-b785-feeee58aa8e1", "value": "d21abe71ba2abf923b575299dc17854f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e56d368-ea0b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626861984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861984, "uuid": "14b255b7-24d9-4c20-9077-539cb8677c85", "comment": "Malware payload (Mirai)", "value": "006bcdda0e8cf5490201099cdc674526", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861984, "uuid": "b4c45ffd-e6b5-4816-908e-89d2e4e7c390", "comment": "Malware payload (Mirai)", "value": "386f5ebd8d227315944e9e1741cc98354563973378b06aa7fc6c40d92876a1bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861984, "uuid": "c964a848-4657-4390-b776-7ad2250d005a", "comment": "Malware payload (Mirai)", "value": "5c1661d965967b9e15cbbfc0679887267355ff22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861984, "uuid": "b0e3b74b-fcf3-4a0b-9e25-f1c53cf8be3e", "comment": "Malware payload (Mirai)", "value": "1461a69f6963bba2efcc17a3fa506d80a3e0d7b085a61742cea88390d81fc740e3b8415cff097c8e1e4af6de561d177b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861984, "uuid": "d05f22b4-b7b1-44ee-a39c-956a8a5057a7", "value": "T1305329C8A593F8F5DC140978307ABB66AEB3F13F7035E99BC3D86927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861984, "uuid": "1e4d091c-c8e7-4a52-8c44-e8919b41c644", "value": "1536:IEX9170vwHbQXZ5+qXDEuXi95TSW7V/DjObeFt6PuQ4ZL:d917iwHbQXZ5+qXA599SWZ/XObeb6GZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626861984, "uuid": "6f6c9fa4-438a-4a6a-8913-9708195bee74", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626861984, "uuid": "03cc47ab-9a0a-4691-98ff-0ccec304265f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861984, "uuid": "bcb7769f-ca0e-4e5c-96a6-b31f0ea8bf32", "value": "006bcdda0e8cf5490201099cdc674526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5ff9ba-ea08-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626860909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860909, "uuid": "d0085120-55de-4873-970f-d45d00396628", "comment": "Malware payload (Mirai)", "value": "60d39bf5f865f6cd3a946078273366a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860909, "uuid": "11c88eac-4d2d-421e-a1e2-aa0639d9c89e", "comment": "Malware payload (Mirai)", "value": "3a214b05426347f73f3fe14f75315cd6ae2533b1e6ccf89e929271846a034b40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860909, "uuid": "ddb0d2c2-3991-4edd-887c-69cd48ef08c5", "comment": "Malware payload (Mirai)", "value": "294a929245fa6af5d6ed4f65920ae7a0fb4180b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860909, "uuid": "8395f970-ac15-4f58-b41c-d9be66898f4f", "comment": "Malware payload (Mirai)", "value": "cd45958fb3f5ba20323c3b475aeec77f7d12a85b5e8bdd743cdaf4813f271db4989122a8b4d5b4708982b177f2b6e949", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626860909, "uuid": "9f9abcf9-226b-4485-bda6-48bc9859be66", "value": "T119B2E14092D32EA3C685233FD4EC4E2DF5F36740874A86121A15399F778B14F57EAAA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626860909, "uuid": "e735306d-830e-4e28-b4ae-cbe5cdc5de64", "value": "384:MVDKKQOcRpmYLdn6RBOFRFhVrUFgpImAV1M3/9te4yn0H1P1TXWozPLK4g9v1RcU:w/QOC0Yhn6RODyFgpq1M3lk4yU1YcccU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626860909, "uuid": "e38c3d4c-1572-4818-bf55-bc38e80e8e2f", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626860909, "uuid": "ebce55b0-5bd0-41b0-b46e-80bc23d8295b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626860909, "uuid": "2500d686-ff7d-4b86-8554-73bd702b20db", "value": "60d39bf5f865f6cd3a946078273366a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5fe34f-e9e7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626846739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846739, "uuid": "188b6d18-906f-47bf-ac2b-77ec2eb52a23", "comment": "Malware payload", "value": "9c641651b430f3250a63877c74d77e7a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846739, "uuid": "d1b0eb38-b228-410f-978d-5c6d151a8468", "comment": "Malware payload", "value": "3c77ba2d84d91215e09d96edf47de3113194ee4154b0e38b9bf5de1d4d44031d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846739, "uuid": "ce845cdb-48bd-4d44-997f-ab372acdcfd1", "comment": "Malware payload", "value": "d47fcd5f7636703215d6a8434a3d8a98e18135b1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846739, "uuid": "cb028e66-1ddc-4f4e-8ff3-fbb5bfcd9def", "comment": "Malware payload", "value": "c6e26e229f1294962c1e06693048a104c91fd76a247785fa19e65d6962ea6528a99b82cde99e20855235946e1ad3af7a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846739, "uuid": "65eb4b06-1c35-4ea9-9eb3-627e9059921d", "value": "T142356AD441CB1AF3F1CD3A541A50F04E572AA64E50914C6A2B2D9FE4BF093FB5F8829B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846739, "uuid": "1a8159c7-d45a-4790-9cb0-29df0398638b", "value": "12288:Zc+NeyoDJLR7mWZ2b7B/u43mWZsdzFZRsUj:ERsUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846739, "uuid": "37b945cc-115e-4c2d-a702-076a6cdb4b62", "value": 1067566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846739, "uuid": "d233c06d-6e23-4513-8700-3b5b0dc594c0", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846739, "uuid": "c0f7ac69-0b5d-49a3-9585-ce423d951779", "value": "Second PO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14830e1a-ea5b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626896247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896247, "uuid": "f4e5be92-2a58-4f08-aee2-0b6ba61ab989", "comment": "Malware payload (Dridex)", "value": "aae1e725e2dbfd91213be22e857f9d02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896247, "uuid": "48ee0fbd-683a-4084-baf0-d9c8f42ad71c", "comment": "Malware payload (Dridex)", "value": "3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896247, "uuid": "263cfce5-d3f0-437e-8d53-364a1989a846", "comment": "Malware payload (Dridex)", "value": "7a2c52b1185e6024787eadaf18bd7f7ccfaa0f14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896247, "uuid": "7f1fd319-e484-4594-82f0-d982de1d5a25", "comment": "Malware payload (Dridex)", "value": "8fb0554df752db0a2a56cfed3e694ba2c5562f76ef40b083de9ea06ea58b151ff3c52395c1cdca495ebdeb6802ad02e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896247, "uuid": "d14e3d18-6663-4f12-ae00-52af22875835", "value": "T1C904C077AEDFC0B9F2A39470103437AB26F57A032419F492D661C8DBF83D994A8A4353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896247, "uuid": "0ef6d64c-a9d7-4d65-97bc-0091c404d321", "value": "458d7355fbf070054838e3593829db8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896247, "uuid": "727c8075-4599-4175-b28d-a54b96ac8892", "value": "3072:TVadvfvemTEtQ9yoZPW/k/nklVtu77wBeZUCEQZRpdBDp57WQhdIif4:4DTyJWPd/nkdqw4/HdB77WQhdIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626896247, "uuid": "2707cee9-ef33-4e59-bd46-cc4a487dbe7e", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626896247, "uuid": "e7bbca89-a527-4686-b0ae-424ca91bb7bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896247, "uuid": "96db2872-0c18-4c78-b47d-9d8a4b6c1b04", "value": "aae1e725e2dbfd91213be22e857f9d02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db55a987-e9e7-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626846759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846759, "uuid": "38fbacb5-a115-482d-aabf-e50667da9392", "comment": "Malware payload (SnakeKeylogger)", "value": "dbd20da7212d4b20e9c7173125d2ff9c", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846759, "uuid": "01e8bca1-f60a-4f52-9a9a-3217f2f1e2da", "comment": "Malware payload (SnakeKeylogger)", "value": "3ffac520312b87f502950dcd7832db87888555a97e96719746205ebf4acfe438", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846759, "uuid": "065de0f3-6d35-4369-b140-81cf5a337d82", "comment": "Malware payload (SnakeKeylogger)", "value": "697060b7826f0a8c3a5ab6ad2ea100b7533dd21e", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846759, "uuid": "c7969405-4f35-4694-b399-afdc17df9634", "comment": "Malware payload (SnakeKeylogger)", "value": "e96e803081aee8bdd452577e2b2e48a93098f95ebda14a0932461148ce8ba59e207e1e0e59af3fae185712e33968773a", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846759, "uuid": "eda5f745-6eed-41be-b8db-17df89cbdd4d", "value": "T18CA423048BFB29749793379343F1E2A1838563BED6536F20C760E64655608F2A1B6CFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846759, "uuid": "6a7ece62-edaf-4694-ae8c-e1503ee0dfa9", "value": "12288:Ech8bgUR2yTgj5Gn0/2DKsd/ll5MjMGdp8R0:9h8ca2WWkGk/D5M1s0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846759, "uuid": "0e96452d-173b-471c-bf58-742d40616d0e", "value": 466915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846759, "uuid": "7a94e2db-a20e-41f0-8eeb-39a0af2c887b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846759, "uuid": "d9ac04c2-7cb3-41b5-98ac-3f4d13674fd4", "value": "2314.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f3b73d-ea59-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626895437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895437, "uuid": "0fbe1d8b-6447-4fce-857f-7990c425dfa5", "comment": "Malware payload", "value": "556daf1119d264ba2732fee95b65ea70", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895437, "uuid": "8e4e834c-6980-43ca-9f15-91b45fbcf1f1", "comment": "Malware payload", "value": "413934e841b46e2dba1902765b5c49d2386736af1492ae274ccb0e50353a388b", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895437, "uuid": "e6d7c814-d47a-481f-99cc-7a20397fe23f", "comment": "Malware payload", "value": "c5f9c0af1e044d9751a7b55019bb6e94bf1f8011", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895437, "uuid": "9aa09ebc-4430-4aa6-b22d-b56ebb295240", "comment": "Malware payload", "value": "06c25baff5783422defd7fa95b1d07a9ba36f5385e2975bace4a564dbe4c28f22e361a7aba48d9a5d75b92038c3bae5b", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895437, "uuid": "2b12dacf-354c-4dd9-bc88-1732ce6cf65e", "value": "T1D0E449C1EBE1C92FFBD1957A0C564630127CCC4456804B973256F33AB72BA7C8E9A2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895437, "uuid": "9c188283-15f9-4678-bdec-edef643fd105", "value": "12288:kGDH3roxGMC/mc4bl3q5uaFsvCgdz2l5MjavMmIf+f:kGDXEUH/4EnsvJZ2lKjavMm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626895437, "uuid": "fe7bc843-9121-4000-ba41-175b99d299c0", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626895437, "uuid": "f1269007-f32c-4514-9900-a5a26c2ab832", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895437, "uuid": "740b1828-2330-43ec-9c17-f88a1ab630c5", "value": "556daf1119d264ba2732fee95b65ea70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bad821-ea44-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626886390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886390, "uuid": "1724accd-cbda-49a0-a2fb-fa81966674c5", "comment": "Malware payload (SnakeKeylogger)", "value": "3e1a052b0f8fc285dbba8f7003736860", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886390, "uuid": "718d3d2b-e31b-41bc-b1b4-973e13192c88", "comment": "Malware payload (SnakeKeylogger)", "value": "41964288f3a3ab0f07ae38f98392b00148c3a5d3a24d038cb1a5fb5331c15b1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886390, "uuid": "efdd158f-294f-4ae3-a209-1510d2a638ed", "comment": "Malware payload (SnakeKeylogger)", "value": "c4d616291cc60ba0251fd29a3eb2b83b3c59c8a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886390, "uuid": "c9562a09-34df-404f-81cb-c4b84bc9165f", "comment": "Malware payload (SnakeKeylogger)", "value": "a36774976c6773d5a410b53822faa9b4f0c0d0ec76b301a08a7856693ee285e109e3ad7fba1a18fe4d9a4768fce99755", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626886390, "uuid": "135293b6-ff96-4063-8b76-758a940ecd34", "value": "T145358E264DCE4667C2644AB7D330EE01DEF10DAA2544EE152EC2F0EB9D3729694DED0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626886390, "uuid": "79ad62dc-1262-4932-bc1f-745ff1e408cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626886390, "uuid": "7c5023ef-295c-4909-8c45-7c2bc6ae663b", "value": "24576:3P7Pj3VQvpB1CAKmJ7qGWikgSp/tZg5ipV:3P7PSvpB1DR3Kpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626886390, "uuid": "0a6498c9-021d-41ca-9138-86a5e31666cc", "value": 1124864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626886390, "uuid": "583e00b3-eaf8-4f7f-9c40-d60bad394c07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626886390, "uuid": "60c05132-e682-4efa-bf90-8f5604ae2c59", "value": "SecuriteInfo.com.BackDoor.SpyBotNET.25.28334.7679", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d9b8dc-ea33-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626879259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879259, "uuid": "7582c2e8-b389-4db4-b20e-f87230d11061", "comment": "Malware payload (AgentTesla)", "value": "edbb2066fd9539e279bf48077b755a40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879259, "uuid": "9045a4b7-7e61-4498-b200-22c17c8bdeb1", "comment": "Malware payload (AgentTesla)", "value": "41f206a7e8b3c15642e6cfad479ae3f0972b82e57ec46a5ffd31e51954a81c6c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879259, "uuid": "ef3ef619-edba-4da6-930d-8fb8e0756408", "comment": "Malware payload (AgentTesla)", "value": "f914783d5d5aeeb95eda30a8c456624e471108a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879259, "uuid": "13629530-223e-4949-987d-fbd7705804e9", "comment": "Malware payload (AgentTesla)", "value": "a43dea9be6b94e9f31e6930498b283ab6d9689d61fa406e144a76692c2f993ea7e43d0c2ff1f2dd4b004927a2063d25f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879259, "uuid": "7926c6d4-11bd-4baf-a93b-dfac235ef762", "value": "T1FE0512B087AAD9E2EE5A427A19F5392A2C313927C0963DD8BD513DDB303ED0247254DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879259, "uuid": "fe21af8b-7f9b-4618-9659-628f4073e977", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879259, "uuid": "170803ae-7eae-4cb2-9c97-c946802f1268", "value": "12288:AvFWssZm5qy2FRbaXUikcuB0HBWrAatN0t5Tkln7heMTk9pfmoQlCxjm+p2S:MULRbkUHcuB0+NITycpPBF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626879259, "uuid": "71e29e26-e653-474f-a4be-f8f5a35277d6", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626879259, "uuid": "e07590e9-1b12-4936-b4f0-4bbed261821b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879259, "uuid": "832c3f11-2f6d-424f-87ef-12cba6f4c782", "value": "Specifications_Details_20330_FLQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7499febd-ea4e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626890824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890824, "uuid": "6604b3d1-0401-4eeb-b43a-832a6839720d", "comment": "Malware payload (AgentTesla)", "value": "90dd925b1990f66414717bf179f8c041", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890824, "uuid": "91c3ef7b-447f-4c5a-a866-f2e12e695983", "comment": "Malware payload (AgentTesla)", "value": "424c2b2020c57524e9478cc214bd98ec2abee1f3fb2fb7b2db54c5e90f877b18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890824, "uuid": "c1fafed9-7d7a-4430-95cb-2fb5a5fed03d", "comment": "Malware payload (AgentTesla)", "value": "7dbf76751d6eed6f84a3c17bea67ff8dc1cb3735", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890824, "uuid": "ab4a8da8-03e7-4f10-8ddb-9dcef7513e2d", "comment": "Malware payload (AgentTesla)", "value": "196d3ca35ec0a3711fd4ffd29e9b419e02381db9c1d54783966bbbaf755eba0f011e5b817f3184ba1ed77088754905c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890824, "uuid": "1ba9981a-28a5-4d97-aad7-03cea198cd0a", "value": "T1D325CF2123E7A284EC3E67BC8834C54597BB7006C67FE76D2D4880FE2E72711AA57356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890824, "uuid": "a677b24b-1da6-4699-816f-6d02fb45facb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890824, "uuid": "428bf068-6f63-428a-9891-6c20e3db5156", "value": "12288:PoI5A7clf5gjHpRWyvUIZbVjysTxME3M9fb0WbxCNRoxtNNrmXhbmJ5UKd:jsclfO9vDBjys11yxWRoXzrghM5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890824, "uuid": "692c0886-94b8-4b39-bdd2-742f5191e7e7", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890824, "uuid": "64ec18d3-c7d9-44f4-8729-1325523eeac1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890824, "uuid": "903b7269-5202-4f90-8fc4-9c44f9874b28", "value": "90dd925b1990f66414717bf179f8c041.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822d8045-e9c9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626833724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626833724, "uuid": "ce295198-d9cd-41b8-8a69-6b8ca2dfb514", "comment": "Malware payload (Mirai)", "value": "e82565c1a16bb72953673a79b8c0ce5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626833724, "uuid": "f8e93ea3-7648-4275-905d-2704bf75b926", "comment": "Malware payload (Mirai)", "value": "4358a6c1aa4ccf54022e20e64e15e7e65b568b9401f8917d37b555a1c1f949e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626833724, "uuid": "8a0b6423-15e1-4971-aeab-5a064592e843", "comment": "Malware payload (Mirai)", "value": "047f50b9c115d81dc41bd7dbf019e54165792de3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626833724, "uuid": "f5a4b742-551b-4c02-935c-f3bbe2cfa8af", "comment": "Malware payload (Mirai)", "value": "0ce7ed6d59796dedbf7b10876fcee684e6d4353249f08eda971bd4d769a7f07dc018c4737a27d04a8fde1108bfe51eed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626833724, "uuid": "3beec8c3-5865-4efa-847a-72831022b5ab", "value": "T152636B32AD7A2E27C0D8A5BA11F75320B1F1534E35E8CA2E7CB10E4DFF58A5061536B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626833724, "uuid": "6f6038de-9dac-4586-b895-be2f814b35d6", "value": "1536:YQBOk50dSVrfjSHKd5hAna6cBwFOO9j0ma:Uk5lhoWb/sjVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626833724, "uuid": "71002110-5328-438d-81db-d9aafab2b28b", "value": 66960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626833724, "uuid": "bd6b20e8-4b4c-493e-b8b0-b0d6c4008f9e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626833724, "uuid": "21a7c6d9-8ace-4746-91c3-585c06d26198", "value": "e82565c1a16bb72953673a79b8c0ce5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8cd432-ea0b-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626861986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861986, "uuid": "f535f2ab-fd0e-4919-9c56-ba0b8372c209", "comment": "Malware payload (Formbook)", "value": "418163503a045e8bd383dc563992d12d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861986, "uuid": "d72b2d4e-1987-48ba-b58b-4daea07d08c4", "comment": "Malware payload (Formbook)", "value": "443b7c4a47da2fccb7764deccda2bb60d217f1c25eb016870c7ec0f11d1c2b80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861986, "uuid": "f8ea8cdf-a04a-4d34-975c-d018eb24aafa", "comment": "Malware payload (Formbook)", "value": "91073baad0f23bbd3a34bb80c0f7df48d3e7eb1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861986, "uuid": "54a77241-0ef5-4fe3-b2f3-cd92daa4d011", "comment": "Malware payload (Formbook)", "value": "c603cef5bbf86d797071618acbae7933821e7471a978e762b8d2d1692d970710ad1cb8e0b13e40941467d196009f63a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861986, "uuid": "84021523-02d7-4e2c-bf5c-ca983c582576", "value": "T136F4CE382554996FC272A933C668EB00FEF349927631CD0A539BE6870F0B143599EF6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861986, "uuid": "ad719839-e2ca-4628-a14d-0f5ccc5a06ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861986, "uuid": "cf77ced9-5279-4a3e-bcc6-a029a2d8c185", "value": "12288:Nx96zkMuwh+kwsDo++sJraVls9aEfW4NmtzMURtUsWtQyh13aSnsfrZ9648Ng:Nx96zRlh9wOru69fAzMGUsmQM3FEZ9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626861986, "uuid": "92665cc8-3f6b-49a1-aec1-0b137937cbec", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626861986, "uuid": "e734c0a4-5264-4a1c-9e63-19543e97e9aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861986, "uuid": "59d2715c-b87b-483d-b4d4-fe3d284e5452", "value": "sX21AoaplqFHxse.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7c3805-e9dc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626841826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841826, "uuid": "14e547e2-2bf0-4f67-8bc6-6f71454a45af", "comment": "Malware payload (Mirai)", "value": "26d6d226f9b971aa1ffc04c183f90fe4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841826, "uuid": "7e0aa778-de79-418a-ab5e-bbc2d026797f", "comment": "Malware payload (Mirai)", "value": "448cba9a4826846e4ae40f2254e23af53eaa26e2f779d740080d5ea942c97212", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841826, "uuid": "6c2f8264-0348-4833-aa79-cb82a0f60f46", "comment": "Malware payload (Mirai)", "value": "1ad254a2292856abaf8827a1117965cbcdc5986d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841826, "uuid": "960c2b5e-df76-49aa-84a3-0e326f2c3f6b", "comment": "Malware payload (Mirai)", "value": "27da0665e49423b8cf467f92bf41f3f3dcffd49b4fefcb24ee0f3f83a3d18bb55e37a9971c294da1524141a5cdb114db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626841826, "uuid": "2158b103-ed04-4ab8-92c7-ec734a0c711e", "value": "T1B343F852BC818A11C5E4137AFE2E118E3313676CE2DF73239E106F54778A96B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626841826, "uuid": "ed5a1e11-8e5c-493e-b0a9-f456d71d5e63", "value": "1536:FxnYYiFi+OVxb+irR6ZC2oINczIoiXqrz4dHr:5iiB3+kR6Lqrz4dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626841826, "uuid": "88e0df1e-6316-4020-a2c3-e3439c7ebdf4", "value": 58668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626841826, "uuid": "b98208f1-a13f-4774-98b1-07492878bef7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626841826, "uuid": "f3d2c5f3-61be-4d5d-93b9-696847ff8ecd", "value": "26d6d226f9b971aa1ffc04c183f90fe4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef243cf-ea1f-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1626870736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870736, "uuid": "786a0b1f-c5db-4ccb-8f73-cdd0a4e55069", "comment": "Malware payload (CobaltStrike)", "value": "1f8438573e8b5623be72c498c7da8869", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870736, "uuid": "a43b383c-bc88-4429-8448-44f1c39caedb", "comment": "Malware payload (CobaltStrike)", "value": "44f521e2ef1f597a2ed34331cf77f497442444a50a0193b508f4c9061799486d", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870736, "uuid": "4638cbf9-9bf9-4ba5-a160-9080a9a7224c", "comment": "Malware payload (CobaltStrike)", "value": "54cd21444dc6f1be76646459c6b8543dbff0875d", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870736, "uuid": "738d2800-2314-4e82-886a-d4b957f3e0d4", "comment": "Malware payload (CobaltStrike)", "value": "20768407677cf7d6e2b1bfa16fe7af963aa13e04dd9f3b60499ad4e240358156e522150f998e3877d482a3352d85bb86", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870736, "uuid": "3b8ebff9-e75b-4ce5-9517-e468f113d7f3", "value": "T1C6D57C52FCE209BEC57DF130459297217A7234A943337B932E8456A90B7ABE43E3E354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870736, "uuid": "5a6de812-5498-4f11-9871-40a2cf617426", "value": "1cd364a9e949d5ecebd6c614e64bc545", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870736, "uuid": "9ff5d86d-43b8-4691-8f42-5dd0a6645b85", "value": "49152:vQw61ATC4Cpp7y4WzUHCwMaMxft29pSggFpUiDZ64Ty:QECTeFz3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626870736, "uuid": "e1de5bf7-7091-441b-b018-3d9cc84389eb", "value": 2893968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626870736, "uuid": "202de434-e578-4cda-94e2-0ad30a929c3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870736, "uuid": "20f73480-f0ad-4785-ac39-a0dc54e1778b", "value": "Outlook.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803fda11-ea64-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626900293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900293, "uuid": "df4f9118-75f1-4bd9-94f3-03078dbe9744", "comment": "Malware payload", "value": "77f2cba48c800cf3c24b14a60168158a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900293, "uuid": "fe84d7f8-9172-4ce5-9cce-e1bddf21845f", "comment": "Malware payload", "value": "4639173bfdc5b0702df9a307a2de81d7973b0e2196c7ba07f5ff02ec3be3beec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900293, "uuid": "398a671a-4715-44d3-a527-6475f5255c9b", "comment": "Malware payload", "value": "00a705f2443da3e5e030e78eea308ef96997f3f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900293, "uuid": "faca79c3-ef7c-4617-bd47-dea7b5470533", "comment": "Malware payload", "value": "479e1d43630fc30711effb557701a3a1de5522ad9476f5ead6666a824ea5eaa3f136112886de97165fcf8af966da0f6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900293, "uuid": "7a45bb44-5464-40e0-8fd8-a0af3b03c7e7", "value": "T1D7350121E1D1B87BDE8D30FAD5A9C7FB7C6CA4708F6021DB9368AD2D62B62D050B05D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900293, "uuid": "9f983d35-f454-4edc-9726-96e62a7e314b", "value": "b59594dfc068d58636c83d19481c521f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900293, "uuid": "07b8043c-f22a-4afd-9b18-3510cacfa07c", "value": "12288:eCd30NAt7btw+x3DC629r/AARVCTSuibiQvO8zNs5lzFMUybeHT5k:BdENAZxwiCXr/AARu1QW8zC5xqUpze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626900293, "uuid": "d2823683-2e6b-4b5f-b9e7-524253463fcc", "value": 1131012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626900293, "uuid": "959228da-f40d-405d-9132-26245c5f05d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900293, "uuid": "8ed0bd3f-2666-4680-8fff-91ba059d3c85", "value": "77f2cba48c800cf3c24b14a60168158a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c796aa-ea50-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626891657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626891657, "uuid": "4c341fdd-52eb-4945-8182-bc6823a2cdb9", "comment": "Malware payload (Loki)", "value": "c25cd68c9aa191a94eb9b1ac56fd795e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626891657, "uuid": "b667e41f-df72-4d4e-b52a-3b042992b0e3", "comment": "Malware payload (Loki)", "value": "465c3102a6884269e236adf1e42176d0a70e375dbb4810231c6acf9d227f9ca3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626891657, "uuid": "edb1d125-b080-4d18-b6a2-c4a004c360db", "comment": "Malware payload (Loki)", "value": "aa344701407a8b35fc18a35e2ef81de46ce75e3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626891657, "uuid": "d79fdfc0-8eae-40e9-bf9c-049b14803634", "comment": "Malware payload (Loki)", "value": "b9b9f66b2f613b8ed17cc5fcbab417b1bcd456b0d66e6111e48d52c70afd9f01c12b5ad2a4a2110c7f19bd50ff92221c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626891657, "uuid": "405ddc7c-cece-4b1e-8299-619df8b4192a", "value": "T1BA358D224DCE4667C2644AB3D330EF02DEF14DA62544EE152EC2F09B9D3729A95DED0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626891657, "uuid": "4e315e3f-55f8-4982-aded-8754bcb46d1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626891657, "uuid": "65579ec1-7890-49cb-a14c-46d78105bc2e", "value": "12288:TKEvPYjt3J0kMPxr+/MYlrVgQYcpCPvkTJaW11zhkAwXSSnLMyTfd+bSAFQipP5o:o3mk8RMr5pCXk5gAwXSqld+oipO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626891657, "uuid": "00a44820-12cd-43c4-b2c2-e310457db033", "value": 1068032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626891657, "uuid": "ebb475cd-b1c0-44bc-bba4-5a102fb32dba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626891657, "uuid": "7ca10b75-141a-47bd-b081-f3b0e6df88c8", "value": "Cotizaci\u00f3n.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79431c8-e9e7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626846672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846672, "uuid": "4271d7e3-9a51-41d6-85ee-9b2908e914f2", "comment": "Malware payload (AgentTesla)", "value": "ad0a8dc9191cebc5364ce7ee9e7b0cac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846672, "uuid": "713fe263-6e95-40c7-8b4b-a5488bb8617c", "comment": "Malware payload (AgentTesla)", "value": "474f8ad5170c4840a256f8c9d43b8e012f380138e2b11e629f6927726e828b91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846672, "uuid": "6d269450-cd0e-4815-b42a-a5134673afde", "comment": "Malware payload (AgentTesla)", "value": "979ef30b3037da0da910c9ba5408e07ed61d28af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846672, "uuid": "b349f598-66b1-4096-85bc-fa9618c03f58", "comment": "Malware payload (AgentTesla)", "value": "2ddece22ad05b9ee074f74cc7ac404af3a55da00af65d02066d6570b8a270e9c459f2e3149de30d2c4a1a6acc1e717c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846672, "uuid": "d1ba5de0-2bf5-40d4-950e-e727e94c4882", "value": "T13052C05CA8C1F7F54DC2D291DA9A036D1A44E723FD0E923DDE2950226CDDA3477E708A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846672, "uuid": "b1ea3c71-8b7d-4470-8893-3f498ac23021", "value": "384:ajy2Vw2et3X/smZkhZCvvABtrgOE7/knl10GT0x9:ajy2Vw9tnkmZkh8vvABtrgr70/CT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846672, "uuid": "e1863695-bc2c-47d4-a5a6-ef85544b81f9", "value": 13594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846672, "uuid": "b7e620f6-7972-46f8-a4d4-ec438fba6fdf", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846672, "uuid": "47ae0338-6335-4539-b79d-336a1a682a6d", "value": "MPU702734-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fbd4b75-ea20-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1626870979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870979, "uuid": "32ab1cb2-83c8-4674-9433-d9a10257e5df", "comment": "Malware payload (AsyncRAT)", "value": "c094c57d960c5db1a798911c59cb9c91", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870979, "uuid": "baea5ac7-6834-47ae-bc95-94426f850d5a", "comment": "Malware payload (AsyncRAT)", "value": "4780ad66fe081922301a8a90ca01d2e30c6bd5cfcfbe3d768773e8cf86e864df", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870979, "uuid": "dd473d48-a561-40ce-961d-6078e8980387", "comment": "Malware payload (AsyncRAT)", "value": "daa83187c52c8fd8349e2525cc0754ccdc023fd0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870979, "uuid": "1a0c868a-31c6-48d1-9805-9ab826c7d9fb", "comment": "Malware payload (AsyncRAT)", "value": "8c15a0806a1a9444ecd003aff18ab10ec3be6d40f495afccf1f6fa30ad3478cacc55c6eaef883a771e800c87c91822e9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870979, "uuid": "bdf6416c-826c-41bc-af1b-9c107efd8026", "value": "T1CEF46B37AB902004D6AB14B168B2D5360B36FC12940A9D1B7D94F84E18B7D47BA77F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870979, "uuid": "4196a93a-d6db-4fdd-bb3b-bbe577ad5f8b", "value": "673f72e4c975e9bc9de6ef08fc342097", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870979, "uuid": "a01dfcd6-e34f-4f83-922d-b00b3810abd5", "value": "12288:wX8HFbaUNurnh5p4apoEKEVjGtH3H8kDrJ5tl2pSF7Wx:wYFOUGnTCapoExjGHJD9u2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626870979, "uuid": "39d24fe2-39d9-4b07-984b-fbbcd081afe4", "value": 784771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626870979, "uuid": "8d4ae0ed-dc05-4848-9469-73848f3144d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870979, "uuid": "161bf34e-3253-41c5-aafe-78bb8aaf02f4", "value": "net5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8339264d-ea72-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626906311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906311, "uuid": "2de22efd-9fce-46e2-a57b-b4c91a61a0fd", "comment": "Malware payload (Mirai)", "value": "14f57e636da6dd3d22620a837aa7eb88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906311, "uuid": "65856b01-45e5-4693-b4e9-e71f843d9d42", "comment": "Malware payload (Mirai)", "value": "47d820b6e132daa26a64b274e89f5b6e41b61d50c90d162ae13a25a5779556e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906311, "uuid": "9060a370-b85e-4f7f-a65b-26939681d3d2", "comment": "Malware payload (Mirai)", "value": "b36b15b952885b4965c56cbd65ebd2176871157d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906311, "uuid": "cbb4607a-6561-4a89-9cfe-007035e79fcd", "comment": "Malware payload (Mirai)", "value": "1a2dc2a8408635cc7f3c004205eb1982e50962ccb471700a2d26a8c191ba78160cad2dc2ac7e6cd19b65865461198b0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906311, "uuid": "56a280b1-0dab-4498-803e-b275a7cd28df", "value": "T1C0C2D060D4AC4A22DFFFAF794AD3A6D377E00E497B12CE90601B9B615111D28B712CEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906311, "uuid": "c0404dde-2614-4736-b218-49646ae7074c", "value": "768:dBHrpv3SFZlpqj9pseGJuhZXuAJw4uVcqgw09m:dB1ySgJWu74u+qgw09m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626906311, "uuid": "986ffdca-8e3a-4746-a2ca-1d7400f55133", "value": 26516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626906311, "uuid": "3782daf2-6ee9-4d11-93af-4ef8921c0b93", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906311, "uuid": "6e8fbb3e-6822-477f-bfe9-a595788c4582", "value": "14f57e636da6dd3d22620a837aa7eb88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e44b686-ea77-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626908477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908477, "uuid": "73b9f770-a850-4eb1-b461-6486ab47bff9", "comment": "Malware payload (Mirai)", "value": "5403ba0ccac28dd482f05cf2985f935b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908477, "uuid": "44cd7fc9-a50a-49a0-b070-ee81aefd02ed", "comment": "Malware payload (Mirai)", "value": "4833fd0e3fbed27305bf198a52c7a101cf8a76eae4f8b81dce8ba1afa301f0e4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908477, "uuid": "c369218b-b7ae-4d54-9c52-f9477c8a7065", "comment": "Malware payload (Mirai)", "value": "423afc5b4e793b2eaa418e8f478028b8e3ef3b26", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908477, "uuid": "d13bb598-e767-408c-aa75-019c9dd3c153", "comment": "Malware payload (Mirai)", "value": "74910fee2ef545878642449939bf078273ce1f6ed3c04c4577a447d76920a388b48617faf9ff58bd059bd6981fa2422c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908477, "uuid": "4c8b0602-ce4c-4ee2-95cb-3345cfe1d8c9", "value": "T14A73764D7E319F7CFFAD863447B74E209648339626E1C684D1ACE9011E7074A742FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908477, "uuid": "77c5645d-961d-4a2a-9201-904c9605b8df", "value": "1536:pmCwyRDOjntQr+JK1h0JAsXhcga1hqWYSvZ/GrvsFVri1PBl7u3:0C1DYQaqJs/2GrvsFVri1PBBu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626908477, "uuid": "f48fe53a-1082-467d-94cb-7cc39ce9cde3", "value": 80216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626908477, "uuid": "75875a27-b1d4-4bde-8220-ca04e8d08bca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908477, "uuid": "94e802ea-bda1-4802-bdb2-819fc8415d3e", "value": "apep.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a97741-e9f5-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1626852735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626852735, "uuid": "3bce02d8-dabf-4d5e-a6c1-007d2845ac8e", "comment": "Malware payload (NetWire)", "value": "edded1e2382bd3fa5b966f3067690cc1", "object_relation": "md5", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626852735, "uuid": "ddb85dd4-ef27-4f7f-be0f-d91303714f15", "comment": "Malware payload (NetWire)", "value": "497b04efe79c9dce8bb75a37d72702eb9b703912994c5351a6792a8c217160c9", "object_relation": "sha256", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626852735, "uuid": "63494736-d322-410b-ab8b-e8964b822931", "comment": "Malware payload (NetWire)", "value": "04e0cdfce4fa87ec822736d77090e7eea2fc435c", "object_relation": "sha1", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626852735, "uuid": "6b2ce522-acda-4bbf-8bb2-9e78666a1d42", "comment": "Malware payload (NetWire)", "value": "892d7ec04af5628ae00aafbb9a59b7dcb4059c007a0293400b440e8b5bf326193bb3a421d8a4fe7f084d4edb4bf5c742", "object_relation": "sha3-384", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626852735, "uuid": "42b19974-bb61-4d0a-a253-456f0451bbd6", "value": "T139F4337E608D5FDFDCFAF225C4D7B3EC523032067A95247706E8E5A12AE51E08428AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626852735, "uuid": "91336e76-59c2-47e0-9295-601cc93651c1", "value": "12288:44mLOKmsbwSGUEhZN141kmc+rHpErthBUn3WIHzClHNz6MSfcvJ93ydhtTzlAX+2:fYOKmeGHhD137BhBUnnH2SMR9CdhRz2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626852735, "uuid": "b9aaad2b-4706-4d25-a68b-6695730cfcce", "value": 723061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626852735, "uuid": "b8359cca-c0f3-4bc2-8343-57ded7fbea4d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626852735, "uuid": "e0d333dd-205a-4d66-bd1e-52422e51b324", "value": "order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "294dfc9e-ea5a-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1626895852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895852, "uuid": "65f85a89-2aec-4670-91fb-c317632dac67", "comment": "Malware payload (OskiStealer)", "value": "74b37b00ec4ea2e2ee861621c5191ac2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895852, "uuid": "c7104957-17d3-4c06-a405-45a42689a0a3", "comment": "Malware payload (OskiStealer)", "value": "4a440ef3be94895fcaaab5b4ba0755e8350e6131cabd507be510056739601df4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895852, "uuid": "c0f548f7-3783-4879-a360-ec1d50932dfe", "comment": "Malware payload (OskiStealer)", "value": "f711f8acd1b587e2edc557756019e367d3ac8c78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895852, "uuid": "1e58fb57-418d-449f-b545-324a78cc6c4a", "comment": "Malware payload (OskiStealer)", "value": "4c9fc3ea2a21c288ffc901bd6dcaf9d215d8e1f849bbc44ee7f667d3d1b3ecb46c350f87420581b4b3c10d853e357f5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895852, "uuid": "64a97dcc-e2eb-4c62-93ac-d4351cb4ed0b", "value": "T17F5533B7ADCB9A16DDF98A7E66D11AA703320D7D6094205F74A92E30D5EE430834DFB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895852, "uuid": "7e17ea97-42a2-490e-8ed7-9e2360197f37", "value": "4da7a3c908f70c18780a67a792276e49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895852, "uuid": "59111677-aefc-4d8b-b2f4-d8f3d6316c91", "value": "24576:3XouY9hgpcQ1eCBt8lvT/nfntO6S2bWU+2SJSNoj5TFs:3XoUBty/fnt24Y2ESkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626895852, "uuid": "15de6f8d-9b00-4a72-a437-cabc992fea0d", "value": 1346048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626895852, "uuid": "e2aa7b6b-24eb-456f-9856-f88e0569a0e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895852, "uuid": "ae93e7c8-167d-4fef-ad49-c6046fac741d", "value": "74b37b00ec4ea2e2ee861621c5191ac2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3c3e00-ea59-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626895431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895431, "uuid": "39246225-dabb-40a0-92d3-03e99eda1d53", "comment": "Malware payload", "value": "15d1252024d046b76737f80017b31b5e", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895431, "uuid": "5cbbb81b-bfa2-4217-af3c-d6fb1504e8a4", "comment": "Malware payload", "value": "4a8c152ef7c7e3ced93e8629691f6f66bb67f78c4e17caf0198db18300b19acf", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895431, "uuid": "4ff26cac-de45-4e0e-a667-090fa05c40f0", "comment": "Malware payload", "value": "9d61edbf4819eb9ee8e6de03120ee06e1a8b592e", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895431, "uuid": "354ad91e-c9aa-4b9f-bae8-01a24dce5f68", "comment": "Malware payload", "value": "e5903166abbbb3d57c9cb309f67e04a6da588670826d27aafe885d672415ca82a42d4820b99c7b73e08273e221524d30", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895431, "uuid": "f9782aee-add7-4d95-878f-c1eff7e4165e", "value": "T153841CD1EBA1C92FEBD0E57A0C560670537CCC8499900F977255E33AB71BA3C8E892D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895431, "uuid": "b20c3e3d-c674-4f49-8298-20b7a9fcf7b3", "value": "6144:N0Y35qAOJl/YrLYz+WrNhZF+E+W2RGtpPjKBbA2G0VeU+fMGM9yhy1Ck/ug14z:GjwbA2EfK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626895431, "uuid": "f00e6a70-d563-4840-a774-8ad5ad4986b1", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626895431, "uuid": "3f9caf0c-92d0-43fb-bceb-debbbaa4420d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895431, "uuid": "ec85cb40-1b0f-4dc0-8f3f-581ba3c0b24f", "value": "15d1252024d046b76737f80017b31b5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2b39b8-ea5c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626896852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896852, "uuid": "ca3e3aea-0359-4e5c-b97d-9ab92267af2d", "comment": "Malware payload (Mirai)", "value": "616c7463441c8f5e8b8dff763448fd5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896852, "uuid": "fd42a676-8762-44e2-a44c-16384d311939", "comment": "Malware payload (Mirai)", "value": "4a9e6cd91dea3f96eb62da65dc417bc228f69bb1f508b9b4e1bd8e654a0a5cec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896852, "uuid": "c3f8913f-e581-4ed0-925a-dc889fa2a55c", "comment": "Malware payload (Mirai)", "value": "32e7d6a3a755d0dbf24bc46550ea9e43daaf81c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896852, "uuid": "b481ef95-1a1f-41ee-89e1-62f3d435c3a4", "comment": "Malware payload (Mirai)", "value": "ac65107425e134ad7cebbd591e77e25b90e00b79de62cb702d61aeea7a371c12ec4fbf56e0e41adb5b73a8573e82a80c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896852, "uuid": "2f969bb7-6577-4b0d-8e0c-6f4f62f614ae", "value": "T1B6C2D1881B4919D9D2F5C17847B80B6C1DA40B66F809DC8678FCFB629D8E4753017ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896852, "uuid": "56440c32-d239-4ad5-ac8a-6ea4410d1286", "value": "768:f2G214DFyosXqgvV9o1ndB08KL8JgGlzDpbuR1J9:f2GdDgosaaO1ndS0VJub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626896852, "uuid": "53cde477-7b80-4cc3-b0f9-acad734f2c7f", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626896852, "uuid": "abe50092-32be-427a-9a99-dce487deadf1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896852, "uuid": "3683ef54-dc10-46aa-8e65-9fdabe796e66", "value": "616c7463441c8f5e8b8dff763448fd5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71af21fd-ea62-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626899409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899409, "uuid": "5a915710-4638-41c3-877f-8b99f96a2c9a", "comment": "Malware payload", "value": "3d67b0c7d220a241c6eb2ed5660ac458", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899409, "uuid": "d3361770-e196-4749-aee8-9cfb2512c4bc", "comment": "Malware payload", "value": "4bf58623f91ff9a19c2893061a2a14660f61b2294f976a9d80ab6b3d023c9892", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899409, "uuid": "eb79f62c-fb45-4284-9bee-c557c6722a26", "comment": "Malware payload", "value": "fceed53a83a376274c92d26c870f7b4abd201f56", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899409, "uuid": "44d0f8d6-1403-44f3-bdf1-51e336d7814a", "comment": "Malware payload", "value": "a0648106cd91cf8f84866b9e33be7601760403dac9927c300f52a6e5096c16c6d8f9f060cfc4e28a38fa47fcb8c7fb71", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626899409, "uuid": "324f761b-6b3e-409e-ac24-a1e070b2dd4a", "value": "T169E45AD1EBE1C92FFBD1957A0C564630127CCC4456800B973256F33AB72BA7C8E9A2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626899409, "uuid": "8ba529a4-a840-48da-a80f-90b8db1cdc1e", "value": "12288:TGDH3roxGMC/mc4bl3q5uaFsvCgdz2l5MjavMmIf+El2:TGDXEUH/4EnsvJZ2lKjavMm/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626899409, "uuid": "6a77671f-9220-4124-89d4-814a3c1440d9", "value": 670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626899409, "uuid": "c9a04a10-682c-4348-a325-56a50ff398bd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626899409, "uuid": "dd48ad25-3401-4ac8-b6a8-d3fd61419e60", "value": "3d67b0c7d220a241c6eb2ed5660ac458", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951a2c78-e9fc-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1626855660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855660, "uuid": "ccf64e39-731f-4288-b2fc-d0b4525c9fa9", "comment": "Malware payload (njrat)", "value": "738b57caba3eb8e9e213e74d7bff5f9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855660, "uuid": "a60fc601-300a-46ae-bfbd-e88cec3f852e", "comment": "Malware payload (njrat)", "value": "4f0e5aa77c0e9894c311e8ba4daadeeb5d8b7a6f583cf087a5c90547cfe54708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855660, "uuid": "9b707055-7c93-41d5-a558-8c3f159ad13e", "comment": "Malware payload (njrat)", "value": "e94b0d6a1618eaa3a48c57a48cd60c93dfbcb52e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855660, "uuid": "bb072fb5-5975-4541-b84a-373ceca5fd69", "comment": "Malware payload (njrat)", "value": "e465d3ad55b22b16eee565afca4b2c0af214e5c183ea87dd5169bcf10f68dcdc7f183ded3701d263e556bed761cdd432", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855660, "uuid": "42066af7-6974-4218-b1c0-cee8479a6652", "value": "T1D643FEE4EAA702ADD6ECEB7A4C92F5F80A734163DCC1632DD44D4642F8A319687C6C47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855660, "uuid": "609dc613-8cf5-4a06-a66b-8d30a2e66aa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855660, "uuid": "ae45a9c6-0d86-4856-a0b3-3e1e16db3f70", "value": "768:w0KylPxh50U17qDyGXC3SJhMQqNRgU+HTEU3SuS3:w0KyFxh6fY3SJhM1NRgdHIU3SuS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626855660, "uuid": "a3ded9d5-df22-497d-bb56-9dc7f7932963", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626855660, "uuid": "2fbda048-a55e-4493-a6f3-1b75ac73a50b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855660, "uuid": "3b03af99-99bb-4f9d-90d2-2b05541759ea", "value": "Winver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24bd364e-ea44-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626886395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886395, "uuid": "00353fd8-44db-4243-96a7-329e957f7cc6", "comment": "Malware payload (Dridex)", "value": "bcd570e0e7b1498a3484ee2a66325a39", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886395, "uuid": "734068cd-318a-448a-9a45-cfe98fb8de07", "comment": "Malware payload (Dridex)", "value": "4fc754bd7957493e0b8e127e22cb4599f9ad57d8a581087cd697ae9ee90e6d55", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886395, "uuid": "c826831b-5c16-4c4a-ac48-3bd34dbaaa14", "comment": "Malware payload (Dridex)", "value": "13bae32648bff82f3c05b409f1b2d7901ab73124", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886395, "uuid": "d67ff97b-629a-4867-aa6e-a651bb1bb85f", "comment": "Malware payload (Dridex)", "value": "a4006ebf2810abc6413951c1cf95ddb630cb1f236f45a2b22d2a5112fa45989e4196b39857b5da072151d745676a4141", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626886395, "uuid": "3825407c-f7c3-48b7-abfa-68980deaa241", "value": "T138646FD1EBE1C92FEBD0953A0C565730527CCC4499900B977259F33AB72BA3C8E891E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626886395, "uuid": "bca930bf-8122-4dfc-8da8-6fe894c04b69", "value": "6144:D0Y35qAOJl/YrLYz+WrNhZF+E+W2RGt6PjKBbA2G0VeU+fMGMODf4JYE5g8:BjwbA2EfKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626886395, "uuid": "8649869f-9804-4f20-9061-1023c644a3d8", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626886395, "uuid": "e473165a-33f3-42f2-9dbe-0c1f3b087d14", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626886395, "uuid": "6e13a4ad-3451-44c9-96fd-a4096fbae574", "value": "SecuriteInfo.com.VBA.Heur2.Dridex.4.CD579A05.Gen.13596.32754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977f3ec5-ea59-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626895607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895607, "uuid": "eaefaa51-6be0-4511-9b28-99cc9cc9e9cf", "comment": "Malware payload", "value": "f1e1698ef73827e738bf44328e6cc0aa", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895607, "uuid": "9d4b00b5-4600-4b8b-834f-f9c3f2713a93", "comment": "Malware payload", "value": "50f3beedad39312761c7078aca103c9126553383925cabcb7ac4b6a2332748fe", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895607, "uuid": "747a5061-be52-4efd-b89f-4c95032d8693", "comment": "Malware payload", "value": "b72cec166a6f2286766e7a2253802f306a6ec0bc", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895607, "uuid": "f3d7d346-8800-41a8-8727-74aa55dabe13", "comment": "Malware payload", "value": "b0c2f95b07367a64925a6e8219a9ee910d134dee49325e6a8d7137cb51b825ac30e144772f52da58a730242192c4c51d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895607, "uuid": "5a528469-50f6-4846-af67-08cc9f61420c", "value": "T14DC36B078C198F87C02886F8BD471E6C2A1A2B5ED99276FF50101EEF7F251124EDE46E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895607, "uuid": "b84969d7-5d7b-4666-bbcc-ed3203e9db76", "value": "1536:nSaJx8anJumqeFxBrCQ5GMJhj4x0RBxu07ZG5o3wnAIQEUKtP3HjEv:n3GsoQswMmJZGugAtQ3ja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626895607, "uuid": "3ef512a3-9c4d-4f3b-9df7-d8950f6f4a07", "value": 120418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626895607, "uuid": "37c14df4-6b0a-47e3-9298-c288bd503850", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895607, "uuid": "30c77ffa-d449-4a53-afb3-3ddbd0f34388", "value": "50f3beedad39312761c7078aca103c9126553383925cabcb7ac4b6a2332748fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1292ad-e9ec-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626848721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848721, "uuid": "fa1623e3-76d0-40d5-90f8-6134d1c3bb75", "comment": "Malware payload (SnakeKeylogger)", "value": "458dfac7e6b6a7a9da2816515ae066af", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848721, "uuid": "ba32fd9c-0449-4dad-8307-f8f5c33262ca", "comment": "Malware payload (SnakeKeylogger)", "value": "51875049adec1f17ae0364c723ad5d09a88b82ad70e9d1f1ffb3aba269c16869", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848721, "uuid": "fdf48477-b20e-4cb4-a1b1-ddf07860aa61", "comment": "Malware payload (SnakeKeylogger)", "value": "d5c4cd41913eedd54ea838c0ea706a4d83afcea0", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848721, "uuid": "359768a2-39c3-463a-aac0-5cc21f70b60d", "comment": "Malware payload (SnakeKeylogger)", "value": "064014480de3fbfc021a05319a21e6239a8ee01ed0bac908111743632ac98a84ca94acd9f8454a45ecdffc3f4c57c54d", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848721, "uuid": "61f453f5-b00c-44ff-b857-712063b450d5", "value": "T1CF351246643A9D6CDF9558FA9B2FF748B42E5C01B1064B3FA1A67F29A435CF438E40C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848721, "uuid": "edf5c4d7-2625-4f93-b135-2395cdb45042", "value": "24576:8OhrADleW7jgSgE29yAHx9DgO+WpjBCJedQJhK26hyw5:8OxIF78p9yi9sWpk+f26ow5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626848721, "uuid": "84ab3ee5-5aaf-491e-a002-95599b77270c", "value": 1134080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626848721, "uuid": "a75a6d09-0fb0-40bb-a9df-56599c5bbef2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848721, "uuid": "5dde1a42-902c-486e-a07a-2223db5521b2", "value": "PO.2100002.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732abb0d-ea5e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626897694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626897694, "uuid": "fffbbb09-0360-4253-9ee8-c75afb9bee28", "comment": "Malware payload (Mirai)", "value": "e65a3cda8a55381fcb14e99daee48b58", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626897694, "uuid": "07aa7646-4cb3-4f0a-b716-1baa9be2ca38", "comment": "Malware payload (Mirai)", "value": "51b3e519b9320b6adc1dd3aaf8355107b1fd977baabf0b7086c9aab45ac0efbb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626897694, "uuid": "01d622e0-0a75-4525-8b7b-054eb536ff9b", "comment": "Malware payload (Mirai)", "value": "f517d294e8a235f3c25ef95dde715c131f1aae2f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626897694, "uuid": "1a51c0f5-1da5-4e4b-83bc-d11d21aff963", "comment": "Malware payload (Mirai)", "value": "7f28d05cf85ae8673e5c00bb4116a0eee933b2981647553422dcd9ad9e689b8845497d54ed51988e17da8e7b46374e6e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626897694, "uuid": "2ed0ff05-241b-48dc-8038-5e6e7c1500a8", "value": "T17823024320D3BA03E0309CFA4162CCCDB65AA6BD71BF7BA725450E154C759A2ECB58AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626897694, "uuid": "bcb75350-c835-4d89-9381-15a73975a8a3", "value": "768:nK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFZk9q3UELWt/iw+kvBGg6+fYtrBH2:P12O1LCNguovDPH7TcrFLWhiw+kvBGgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626897694, "uuid": "02d83e88-14bb-482e-9f3a-9707f16f9aad", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626897694, "uuid": "09855cce-ce21-4a24-9113-6ca1bf6bd90f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626897694, "uuid": "9205e216-6824-4d1d-a5fc-9de8b83c46ff", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc068327-ea4d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626890622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890622, "uuid": "2fbed34b-ff52-4f30-8e50-67d5f4777477", "comment": "Malware payload (RedLineStealer)", "value": "3552ac747719cfad23d350d1bbba0f20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890622, "uuid": "6a070ac9-8357-491f-8f93-4e264580acc9", "comment": "Malware payload (RedLineStealer)", "value": "51dd1bfd096aa2df54b2c2f0ead05ca6eae63dfb50c93788163b4a5707fbe0da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890622, "uuid": "52610dab-ba78-4ac0-95ef-92f76878f9c9", "comment": "Malware payload (RedLineStealer)", "value": "3f0bec0d436fa366c83f4e43e09a4f3bf6c9badc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890622, "uuid": "a898f8dc-5b8c-4ad8-969b-ca1de0b99dbc", "comment": "Malware payload (RedLineStealer)", "value": "1f42f27f2a9f7305bb8be0fc4bb0cac299ed9ae20b7a169916f4e84aaaed69f8e057cba1e548480b23088418615ec998", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890622, "uuid": "6aa4ac32-803f-43ca-9a2d-c4caa06f2a48", "value": "T1B884342864BFC05984E3EEA52EDCA8FBD99A55E3640C703701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890622, "uuid": "bf8196bb-977e-4e7b-97d0-07932be1aab9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890622, "uuid": "11c6d125-70e0-4995-8428-9ae7e9c11166", "value": "3072:Ec7YUVNCkrWBRTLunVuOv5MsHrqWOegwq3O+fm58gCp3D9qp9PYBs8hoJ/nL3zRq:LLvCkrWBR2nVu05MsLVgwq3fm58IvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890622, "uuid": "7681b755-d9b6-4597-af6a-179137356d14", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890622, "uuid": "980bfbe2-ec51-4faf-8318-ff0b55a55606", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890622, "uuid": "c3d330c0-1584-4220-b35c-6ed7df297933", "value": "3552ac747719cfad23d350d1bbba0f20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e52be9-ea5f-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626898155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898155, "uuid": "d5cde826-fc91-4048-9bfb-341a104304f5", "comment": "Malware payload (Dridex)", "value": "dc8803148639b547891db02a455575bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898155, "uuid": "bd12e675-bc1f-4319-a2dc-c5f49536c361", "comment": "Malware payload (Dridex)", "value": "537866a96449444a54002776f34eecf053c23122a554a79f4743df0749aa8005", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898155, "uuid": "c1c736b3-8876-4067-af1c-39fe933ed1b7", "comment": "Malware payload (Dridex)", "value": "c51580ef961ab1571e98e8e77bf287c3a4a9c314", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898155, "uuid": "bf713be1-b124-4532-9331-fb57c5da6d97", "comment": "Malware payload (Dridex)", "value": "ae822cf5d75b391c29dbc9e99508d85107b4cdeb0fa288153fcea53b95b197355bf4900e85f4bd6b03b2c78556d9a05d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898155, "uuid": "55d23509-c08b-47d6-b0e9-fd5f9cc20b87", "value": "T1D104C077AEDFC0B9F2A39470107437AB26F57A032419F492DA61C8DBF83D99468A4353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898155, "uuid": "3ed39f31-70ba-443a-b0f1-5c0a6c78255b", "value": "458d7355fbf070054838e3593829db8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898155, "uuid": "dd6950e0-03eb-41a2-ac56-8d12f600870d", "value": "3072:bVadvfvemTEtQ9yoZPW/k/nklVtu77wBeZUCEQZRp4BDp57WQhdIif4:gDTyJWPd/nkdqw4/H4B77WQhdIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626898155, "uuid": "0dd3ad7c-7bf5-4258-a787-f6a6eaa82934", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626898155, "uuid": "473e65b0-94ce-4073-9760-bba8632f20e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898155, "uuid": "a6a6312a-997b-4bc3-87bb-013dcf960237", "value": "dc8803148639b547891db02a455575bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5de7cf-e9e7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626846816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846816, "uuid": "68a20174-699d-4215-b256-a0a10ad5861f", "comment": "Malware payload (Formbook)", "value": "e637c7e64a780948c9a69b202bdccaac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846816, "uuid": "724ef6d9-1a5a-4191-85a6-1661a0b29608", "comment": "Malware payload (Formbook)", "value": "54a4c812a46eacf246ace69c9b1cc1790c63694c091ad5661cffa309d2162da0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846816, "uuid": "5a805563-c981-41f7-94ee-df1d105c8693", "comment": "Malware payload (Formbook)", "value": "317a7ac3d36176667a0eb16b7237d4ba278814be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846816, "uuid": "273b9fc8-8c3c-44da-a789-afae1bea04ef", "comment": "Malware payload (Formbook)", "value": "6885a8c232f08523d929039f4e9d08ee9c3b51f1f0936bb5c6852555825a745041c8f430250b4061300802d3b4430441", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846816, "uuid": "0400accb-5b11-4682-8272-158b54838936", "value": "T16D35482439EA502AF173EFB55BE4B8EADA2FBA333B07645D109103464723981DED153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846816, "uuid": "afcc630a-f332-4062-8ee1-5e5af884e1f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846816, "uuid": "4df25741-9522-46af-a09b-9219911910ca", "value": "12288:X7s7gdwAtQazG1o3takzPafrRIslQiYUcHN5F7s/lZiWqPi0vmlsGkZv+BPlYCHl:X7yyaN1KHNb2JlWY91l//8Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846816, "uuid": "ff617d0d-07cc-46ff-9b94-2efef7dfee58", "value": 1079296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846816, "uuid": "e9792a55-d855-47ad-92ff-02fbb4073502", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846816, "uuid": "46a9511e-aee4-4c00-a95b-051192a74183", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628fef34-e9dc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626841832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841832, "uuid": "88a90c11-7b16-40f7-9695-25e343dcdff3", "comment": "Malware payload (Mirai)", "value": "f627d07c53ecfbdf1a307877d63e6251", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841832, "uuid": "e161d309-7c7f-423c-8a27-ec559498ccb0", "comment": "Malware payload (Mirai)", "value": "54ec2350b58d0fef41492a1ab61dcd18139c956fe502604502e1a54c73ad5c0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841832, "uuid": "f3de8bde-e2de-4aad-b282-3fa9ddba11ae", "comment": "Malware payload (Mirai)", "value": "c1978b951ef8f1f84b4dc889143ab807f96671a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841832, "uuid": "e475a7dd-7823-487e-986f-d3b8f9c3642e", "comment": "Malware payload (Mirai)", "value": "458ce9c851d68ec0362bc14bbe957f408a8f376cad917c1977e236881e11757dddd4c2b1355fb746ace405cfd0f27c2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626841832, "uuid": "f3f24cd7-7567-4382-8746-c0d9c6c146e3", "value": "T191136DBBC879AF84D11487B4A9258E784B63E155C6533EFB0649C5A68043EECFA083F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626841832, "uuid": "3b8767e1-5e80-44b6-add3-bad016e19227", "value": "768:uaGZ3wtzj2vBnrqwepexWIzZLEIoCIoRig7OCW:ua03wtXo3zZLEIoARlOCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626841832, "uuid": "bf2add53-1162-4c30-8046-40f08369d999", "value": 42808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626841832, "uuid": "939d9a8d-bc07-493a-8d9a-fac8cb276890", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626841832, "uuid": "7311a0e6-2041-473b-89d5-d52b23bc7bd0", "value": "f627d07c53ecfbdf1a307877d63e6251", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96708063-e9fe-11eb-875b-42010a9c0053", "comment": "Malware payload (ServHelper)", "timestamp": 1626856521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856521, "uuid": "16d2da90-2ad9-460c-a39c-0fe0b54a7536", "comment": "Malware payload (ServHelper)", "value": "03051f3c44a2c8d196c95ea458b0aff4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "unzipandexecution", "colour": "#895E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856521, "uuid": "ad1c2949-389a-48ff-9f85-b197ca5f36bb", "comment": "Malware payload (ServHelper)", "value": "555f654fb51e632ba2cf49b865b6de5f5772ffba0229d73021a1c6a6f65dab08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "unzipandexecution", "colour": "#895E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856521, "uuid": "75239549-e0cd-42fa-a156-36cd68155df3", "comment": "Malware payload (ServHelper)", "value": "d19a86e11cccdf978ca2d1455d7026d7879869f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "unzipandexecution", "colour": "#895E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856521, "uuid": "2de964da-0cc1-4f73-8ec5-d97006ad387d", "comment": "Malware payload (ServHelper)", "value": "5f90795229424ef74261e5b5fd3622457874eccbf197fb3daeaa258386c04596a29eecc69eff686352e3949babf42d67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "unzipandexecution", "colour": "#895E22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626856521, "uuid": "63ecfa15-677a-4108-8ebe-e02c9217357c", "value": "T1F4563316BEB5BA33E244D336BB095FA8E5AD1EE67A3F95C54C3DB100E3C92D1D092061", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626856521, "uuid": "a493182a-3647-4696-a542-98906a51a71e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626856521, "uuid": "f8938d7f-70b6-4178-b65e-e21d0ee5d3c1", "value": "98304:HdHEES6j0/MXyeGQSlLUDikMsYCcu/jlt4rGI3XAKrNVtgko:VTDye1pPMFCcKjl5I3QK38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626856521, "uuid": "fd45a81e-0410-41c0-9c40-6daf6c14d8be", "value": 6298112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626856521, "uuid": "d0f5b188-4ebe-4be3-b3b5-456b19ceeb1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626856521, "uuid": "e272cf47-dbf9-4ab3-b8c8-b6c0ae602ac3", "value": "ViJoy.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aedcb7f-ea4b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626889520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889520, "uuid": "9e648756-3729-4d4e-9bdf-3f4bc1831e97", "comment": "Malware payload (AgentTesla)", "value": "ee2c45884c328d1da2b4644bd53ad3b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889520, "uuid": "ee0cbe7a-db1f-476f-ae1a-d11c7c9108f0", "comment": "Malware payload (AgentTesla)", "value": "5562cf5618942d43bb59a893bb14f3bb1b45e98550a1bc82a4a75a4b5e504e23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889520, "uuid": "94ebc624-b71d-4188-9911-7fe7d91abaad", "comment": "Malware payload (AgentTesla)", "value": "b814a1aeac1a3949269b3cc12694f067126d6b2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889520, "uuid": "50c80764-ce32-4c89-bc6a-e3ae1031caa6", "comment": "Malware payload (AgentTesla)", "value": "406de5e039ba229c8d9aa0b716152e141e3f5a0a6bcc8cf9cd8145f6ee4004d4ee9d032458c1ce8128d30f7bcbf0b3ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889520, "uuid": "694ff999-0a64-4bc0-b648-38d6e6fb5016", "value": "T10284235E984D8E53B66C0CFA2E37E2C9C1F70F70EA431E8F12A2A4E5756643AC187D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889520, "uuid": "1c3ad519-5ff4-4205-b87a-435273c16db9", "value": "6144:TPhtJQG7jSxMfENRABsijjQLXh5Y3E3vfUN5m291TMhVxiNJ+XvUyc3:jhtaG7uyBsiIbLYaC6kNgX813", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626889520, "uuid": "51457f29-0bb3-4329-a330-add1684ea16c", "value": 390195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626889520, "uuid": "1e5b129f-2639-481b-8c93-5007810c462d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889520, "uuid": "dca3d349-9305-4316-8b0d-661eae7d800f", "value": "Inv_7623980.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed64c382-ea5d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626897470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626897470, "uuid": "aff14f72-8a77-4290-953f-eb9163e21cec", "comment": "Malware payload (Dridex)", "value": "adb1d947f0901a4f3cb0b8ad1a6ee385", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626897470, "uuid": "d58c43b7-1656-4340-8add-1a9a504a04ff", "comment": "Malware payload (Dridex)", "value": "55bc0af1e99d0310ea3e8668aba02e4d3aa3c800b85fe304a6377968a4668cc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626897470, "uuid": "21dcc265-2c80-4d9d-8223-ba8059f21208", "comment": "Malware payload (Dridex)", "value": "b82715bbeab52f75dd44f6396593111ae242632c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626897470, "uuid": "3130de1e-020c-4c42-8812-32ac41924e4c", "comment": "Malware payload (Dridex)", "value": "5c26207d28786e555d274f51ba09a2d8a0f26d3ea46a1f4c08ba11c35aecfbbd18074a9c1b4c611a3036ab0ab4604912", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626897470, "uuid": "dd529e0f-b9e4-40d6-8be9-21bff5686691", "value": "T11C04C0C9D2FA1786D4B1A67D1D84532BA4183C09CC35ED96C980CF5EEA3B204EB3675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626897470, "uuid": "a21dc5b9-13a5-4099-aea3-cbc651da92a4", "value": "44b0dcdef59120fe964e77dc09a5f1e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626897470, "uuid": "749a2212-11cc-466a-93d7-7e5c7dc616ed", "value": "3072:SbneJIBwzBgXbJ26juQdZHT5K4PrsF2ATdwNBJUiG7NNNNNNNNNNNNNNNuztbXkl:STe2Gzm1dZtK4Puhha87NNNNNNNNNNNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626897470, "uuid": "e799a852-a4b2-4d45-9505-b08a35210984", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626897470, "uuid": "779a73ef-f5f7-4baa-9483-89fdccea62a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626897470, "uuid": "f680ca97-f8a9-4f4b-99e9-1798373c5953", "value": "adb1d947f0901a4f3cb0b8ad1a6ee385", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7409ba53-ea4a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626889106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889106, "uuid": "78d2ddc6-48d7-43dc-ac36-01f4956658c6", "comment": "Malware payload", "value": "a02e887652e44ac767e944932f3913ca", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889106, "uuid": "bb73a35a-7b15-4727-9f8e-36865d6bfd2b", "comment": "Malware payload", "value": "579addf4ae37a3dd7a0e2238354f81e8265d1acf0715120f472afb5bcad8c54f", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889106, "uuid": "ac8688b9-88d0-404e-8a1f-fd550d84808a", "comment": "Malware payload", "value": "e00d91e02e805e7412811b2045ed5001712f7c45", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889106, "uuid": "82091e3d-6cb7-4e38-b80a-dffe3cd20822", "comment": "Malware payload", "value": "414c39300120ee7b227e609225915f51a2d2d454ec403644053ee0dc4ac2ba3a9d88d9368186af646e016515c6185d94", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889106, "uuid": "67e7343e-4107-41fa-b761-dba08366ab47", "value": "T1C903F848B291C617F26156798DD7C7EB3339BC0AAE01832B33947F0EBC796749A06764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889106, "uuid": "9bba1af1-558b-4153-8870-2bae183ef845", "value": "384:3Wf8yGcSdW+wRsCBkX/l+JVA8p1r/zYVB6MeUogrUr3QAl9ethuZLp:GJKCBcEVA8pt/AB6MI2Ur/lVLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626889106, "uuid": "ba434a41-f8ed-421c-9c87-d62e2d17133c", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626889106, "uuid": "c3370563-168e-4b40-9ce4-3708175485bd", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889106, "uuid": "33b3db08-7178-4380-9f5a-eb371e2e7027", "value": "SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.22804.27501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62e0177-ea49-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626888868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626888868, "uuid": "a8a23ded-78b0-414f-98b2-ee97c9597799", "comment": "Malware payload", "value": "a1fc90a0d2d73cb38e96158308a4d984", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626888868, "uuid": "a760e4b7-1249-4f53-87f5-6e4060e7523c", "comment": "Malware payload", "value": "5a11b806245bbcf538179ea2805929db01e9df9fc792e577ebe0b1c4694e9a32", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626888868, "uuid": "81863ab2-01c6-4428-8ac7-674a7b53dea1", "comment": "Malware payload", "value": "711c9d1bbc54f1b217fd1816c78b6979e5c52128", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626888868, "uuid": "187050d6-1231-44e4-8335-bae0147e8ea7", "comment": "Malware payload", "value": "7fbbce925006598bc7fb0f74c77e973c82e681e988375f5ee5528172813bc56101462803b685869ed6f31e423009e1b4", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626888868, "uuid": "c5cbad56-9ad2-409f-8e4b-982672654b40", "value": "T181E38D479112A7A3D03853F87F0B4E986B15AB18E5C1BCDB14560CEB3BE13221DAE75E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626888868, "uuid": "90be61e5-8f38-4cd1-9a2e-8a4aa2070ff4", "value": "1536:wJxSwIXUJksB977w3mv8fdwLmG9s80okHwjzjoki9cIyhGfaZWDCltHV:oUdkCS7k3XOmT/QzXIWGfaZW+lX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626888868, "uuid": "db953dac-36f8-43c4-b563-0cb56402771e", "value": 143960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626888868, "uuid": "9d7128b6-f7ec-4209-889e-6df7cbfc692d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626888868, "uuid": "9cdb1c7f-e496-4f53-b74b-16cda0001d28", "value": "637157-211036-853667.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e1775e-ea35-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626880173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626880173, "uuid": "f1a5c60a-c4ba-4a3e-819b-30933fb61f8f", "comment": "Malware payload (SnakeKeylogger)", "value": "3a6c8c240828559138a59cfec12aa081", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626880173, "uuid": "facd896b-98f2-4ef3-9daf-2cf1171f5973", "comment": "Malware payload (SnakeKeylogger)", "value": "5d05226e0bd6559409b3c0e393ff6e663792d0adb27f9145500a10894e16bd36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626880173, "uuid": "176cd597-5c23-412a-9184-2bbb410c0f26", "comment": "Malware payload (SnakeKeylogger)", "value": "c2fe87c26bad47966cdd35d1cfca72c7e4001391", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626880173, "uuid": "a1addfbf-047e-48f2-8244-5ab4f367a61e", "comment": "Malware payload (SnakeKeylogger)", "value": "c87e01462639d1f7f96454935a4ded4a9faa4f1050d25a69a0d5a5e7927b0a7274c4092522961e3e04628f19d3cfa2b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626880173, "uuid": "5958f6a1-0854-4cc8-ad12-5fa53b04fa6f", "value": "T1B6F4BE35F2279708CCB8C3FB181892616BBABCE9721EC7391E58B1F8683367865D1745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626880173, "uuid": "7713c06d-f848-4db3-8049-8551d4179a8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626880173, "uuid": "f25c4b8a-d1d5-4067-b4f9-48b399487022", "value": "12288:vZI4x8nJzch4RTVzUYXTGF9JdrM53W/iaRuIIRyaUVKnp:iK8Jq4RxImGvHrMI/i/sahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626880173, "uuid": "8b97435b-fa2c-4b75-a557-81aac90a7c51", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626880173, "uuid": "ac25ae29-4130-4fbb-bc59-bb2adf326038", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626880173, "uuid": "ca008f54-b4cd-4866-9a42-974142cb4f58", "value": "ORDER SKYMET 847759 REVISED PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87b0264-e9e7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626846808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846808, "uuid": "062d7068-d05d-4c1c-888e-d53c45a29edc", "comment": "Malware payload (Formbook)", "value": "51e24302c3525b761872397b55ec653c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846808, "uuid": "c6ef6419-ef69-443d-95cc-57ecb3b2b624", "comment": "Malware payload (Formbook)", "value": "5dad4092465dce8d51f59b964077033e72024134a2269b929a8002e52bbbb9ad", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846808, "uuid": "308ef32a-9e42-4bc8-9ac7-bee8ffd6c0d3", "comment": "Malware payload (Formbook)", "value": "17938eade1d2a63d7b3039e367314e01dbaa6f19", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846808, "uuid": "9f05b570-651d-4cb4-a794-28f171268523", "comment": "Malware payload (Formbook)", "value": "a02f15f9f1d4206094f61a363f18e952eb50b9b759ae86bb2da674c4cb86386341c5aae1929cc66d456166005a8ec53c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846808, "uuid": "9034ddf3-2cb3-4cd6-89f2-fe1958268e55", "value": "T1219423AB2D3037EFF1D16F7392BF4908A9929EA2F001294694EC843964914BEC57F357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846808, "uuid": "0c199d42-4027-4eb6-b940-9f05cee97049", "value": "12288:PIOXuEKdQU+MaLCF6jpiG5lMiQBUnssYqrRrro:PhyQUECOXRQans4rRPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846808, "uuid": "0185a1e0-f16a-4467-8504-31426d6b8fd3", "value": 447423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846808, "uuid": "ae55e5f6-402b-41e5-91d2-a1721fa161f7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846808, "uuid": "91bd27df-15f5-4806-aca4-93ec7eee61db", "value": "Purchase Order.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db5eb77-ea6f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626904879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626904879, "uuid": "dc542ebb-71bd-45e0-b39b-8e224ab37929", "comment": "Malware payload (RedLineStealer)", "value": "84867d3daccdec9b8d2a10ca4ec9ef45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626904879, "uuid": "a28c8016-c178-497e-a56a-11044a3c69aa", "comment": "Malware payload (RedLineStealer)", "value": "5ef6a3e8a70847b098a042ce963d12ec6e777c0c335b33d64e232912807af219", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626904879, "uuid": "ed2013a9-c5a6-4a9e-835e-d681e84794c7", "comment": "Malware payload (RedLineStealer)", "value": "432e3a5a463f2ec7b18beca594a9f357839c4ed2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626904879, "uuid": "48fb0462-2c51-4b92-bcc4-1c03e104e054", "comment": "Malware payload (RedLineStealer)", "value": "443d6458c9f550280ffb2920a252fa28509a121e0db7dd5a106dc8bf5a09a909bbcdcd86d725bf18fbf030f545f52afc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626904879, "uuid": "b71fe7e1-96a1-4fc1-873e-68189b09d5ad", "value": "T16044DF1076F0D432D5B7693088F1C6A1663FBC225A34964A36A53FDB6E312D1AA7D3C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626904879, "uuid": "beaee469-8d55-462d-84bc-f7b6243f3970", "value": "c0421ed5a83b160afea7e603167f846a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626904879, "uuid": "755022cd-8528-465e-8953-9ccd36152309", "value": "6144:hNlIUiGOXtqmTTTvmDdKASu+jtzYVbLyXnkOpo:j+AYMevmDdDSu+jtzYV/y3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626904879, "uuid": "8501a322-084b-492c-85e4-3ece4029de7f", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626904879, "uuid": "e7888f7f-303a-4036-861e-02aed7619634", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626904879, "uuid": "ab55af83-cc0d-46f3-999a-1e42c52d4b5d", "value": "84867D3DACCDEC9B8D2A10CA4EC9EF45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8fddb7a-ea32-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1626879021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879021, "uuid": "9fa2f7c9-a3ec-4532-a556-65adb442b0ba", "comment": "Malware payload (RemcosRAT)", "value": "90d299316fdd9e9131b1316f8c05a7c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879021, "uuid": "5ae677a2-7c88-44a8-a1d4-deeea7648c7c", "comment": "Malware payload (RemcosRAT)", "value": "5fa4dc80cabd644491180f4af2bbe0001bf4082fe84b45e1452200318b912aee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879021, "uuid": "a9be2f3f-ee02-48f2-af3e-fb1547b901b6", "comment": "Malware payload (RemcosRAT)", "value": "d7728c0d419b36b00f02bd470034d00bcb9f3564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879021, "uuid": "6b9bf2f9-1b7f-46c2-9fc1-65ad40cd34b5", "comment": "Malware payload (RemcosRAT)", "value": "ee16d5e937ab17fec0670873047221ddfb41745066639ffb3350a034743a8e7143f08cfef8e18741c9e3fe5f2b9dbd5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879021, "uuid": "ed3cb041-c894-4e9e-afeb-7f1157a289ef", "value": "T13365AE61F307EA68EC2213F8D8BAD8F12263BD6DD525892B358D7E1DB9B334150E1907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879021, "uuid": "606fb00a-540f-4611-96ce-0d1f7fcfe96a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879021, "uuid": "8798fa35-4fbb-4ab8-bd29-37b49d12198f", "value": "24576:GS3Sdkp4qtyxCCOZiIwMZ9/4Dts0RldmrC0PD9ahp:GJdx7xCCWiM/4DKkjmrb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626879021, "uuid": "d63f5d9e-164e-4367-88e4-7c374bcc1999", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626879021, "uuid": "28b65ccd-5a0f-4944-93ac-0278676ffd0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879021, "uuid": "79616bb4-66a9-4f08-be89-71b9990a2fc8", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fbb70b-ea53-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626893077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893077, "uuid": "5688f2c8-c65f-490f-aa31-c2ce8adc4390", "comment": "Malware payload", "value": "73bb12c76ed5c20288ce04c4f4366a04", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893077, "uuid": "c33592de-3eb6-4dba-bef8-f603ed9f9523", "comment": "Malware payload", "value": "60787d8474b04b246ce69957c1d0e4f31b80e93f699eeec2ae3a707a8e933453", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893077, "uuid": "57484622-01f7-4eff-a85b-d684446020dd", "comment": "Malware payload", "value": "a715c9959b4c077b4f6a336925c2f71b5fcb7491", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893077, "uuid": "c089a450-6fcf-4567-91a4-10e0558ec38f", "comment": "Malware payload", "value": "440c74772f863e9c70e34cdf69c35b0692373fdf5b4b8b595035fcb77024a2e5d382e241d4d5e933797d81cbb78977b0", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893077, "uuid": "48ed6bec-b7a5-45d2-897e-7393eb27dabe", "value": "T1E636DF25F2176B04ED68C7B78858D1A1A7AEFCD97249C7391DA0B1FCA8B37B81190742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893077, "uuid": "9e2abf64-d673-43f2-9f91-320f12223f3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893077, "uuid": "84e4ee1d-0252-4e7f-a1e6-b68ca20e8e77", "value": "12288:8p0XTYYd5mGixiMOYZYgOrItjHcicneYhdCDjj6gHyaUVKnpsL0idt:8OXTb5GROCYYhHNcDvw6gSahpsL0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626893077, "uuid": "10250530-9103-446d-822d-f10d49bdc352", "value": 5242880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626893077, "uuid": "3e8cd646-3766-426a-847c-6cb5a8f66c27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893077, "uuid": "1a44acaa-d8fc-4f07-8514-6ec38bc1de84", "value": "Docs_Ship.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d96106-ea23-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626872278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872278, "uuid": "56d44317-7004-4681-a922-429906b43385", "comment": "Malware payload (Formbook)", "value": "e638d420ebd5c87effb6a696a5cbcb2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872278, "uuid": "d1f6052d-d30e-4577-8b36-dcfda78ed01a", "comment": "Malware payload (Formbook)", "value": "60f84b8557693755d58d9c7c7bcc0e8d764e08f9ead0bffb3a5644690bb3e656", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872278, "uuid": "0eab4551-dd6e-4f0d-bc41-dff285fdf1d5", "comment": "Malware payload (Formbook)", "value": "c5fb364d9f8a0dcfde3ae32ebc684c8d3a4a25c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872278, "uuid": "874e692f-386f-4a23-9693-5bc62b70b3d7", "comment": "Malware payload (Formbook)", "value": "e1a7b95e0d0caef4bc3efecc960d9fc58b30e1fe0911886c83cccc1aaa76c38f29365de8e807a21f85066291f3f1b78d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872278, "uuid": "fa366890-113a-42ed-a7a8-48443c8efd13", "value": "T1C3C29F217784EE22EAEE473766F2B0022F30B2867121CB9E7DC9418C4E837516A7177D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872278, "uuid": "22eb831d-e05c-48d6-9685-51bba9ddd180", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872278, "uuid": "d9b1423f-09aa-4243-8a49-a20a193dbe9e", "value": "384:DkPyx/wmsfQlpYybGfjJqStJ3Ua4iNc25puChUYVhXXHYEjvlk8cm838nQ8la+hf:hlKqS/3/l1wGhXXYEDylm838nQ8/hKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626872278, "uuid": "fd81721c-397f-4836-bd04-db8a3470c235", "value": 25904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626872278, "uuid": "925deebe-094f-4872-8c82-2925ae351168", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872278, "uuid": "ce891ff9-2b01-4a50-9dfc-89b5cc171b8a", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8dd2e1-ea71-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626905734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626905734, "uuid": "c9ff7d75-3ef4-4148-ae3d-715100255c95", "comment": "Malware payload (Mirai)", "value": "9cc9d4bd7d0d03203bea8d3e8151ced4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626905734, "uuid": "343269f6-d178-4f12-8a9e-f65870897d42", "comment": "Malware payload (Mirai)", "value": "60fb041db4d8a5ea2688e7ce97b7fdae546b754aca12015a4fb31408b6629a32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626905734, "uuid": "84bf5976-1bd1-4284-a69e-1ded0c4b088f", "comment": "Malware payload (Mirai)", "value": "be5d04701044734d71240e343fec5d27797e3df0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626905734, "uuid": "2794a6fc-e1ed-4b02-a0ab-975ad3d02ed2", "comment": "Malware payload (Mirai)", "value": "4168805d005ddb5c31ae25adc3f12c4e64e5e6f068d5e085cd45ad7db61fc4dd41f7a817dc02fbf65ed0bfa379c50738", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626905734, "uuid": "a1b50006-fd14-400a-b9d5-8fd4ec5bb9a5", "value": "T175E2E060A92A6D92CCA16C76D7ED819EBF0B1AFCF47CAC22556C1408FD614470BB96C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626905734, "uuid": "81c23de6-8b0d-4733-a596-6208e9e47284", "value": "768:Lmrqowwa35aJOSrP7wAuoTosujXq6RpmjTkNdT9q3UELDU:SrqoBJ7rzDT2O6RpuTkjSLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626905734, "uuid": "e60f97c0-0c05-4073-82ab-402e1d730ee8", "value": 32208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626905734, "uuid": "b47b2565-d70e-4059-8b09-73a396b44669", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626905734, "uuid": "6aabb890-1fcd-4403-8ec2-2dce94675fc7", "value": "9cc9d4bd7d0d03203bea8d3e8151ced4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af3bdb5-ea34-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626879615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879615, "uuid": "8c817779-f1c2-4971-bdf7-a30383d5a19d", "comment": "Malware payload (AgentTesla)", "value": "b773f323b3c4305b74b0280d48986735", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879615, "uuid": "fa996a1b-cb24-4c53-84e2-10e5407ee9b1", "comment": "Malware payload (AgentTesla)", "value": "61b763d5012aee40fea8a17077173a6fbb12ecf8339f9f3d4b5fb3e6f6bea91e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879615, "uuid": "1c84d7ab-333f-4c6d-a80f-09d67e3bf887", "comment": "Malware payload (AgentTesla)", "value": "3365b22ce0583252c64ec8d9b10b56ad8d1c3477", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879615, "uuid": "6caadf55-026b-47db-a110-38cf5f0ca04b", "comment": "Malware payload (AgentTesla)", "value": "6bca46d5a61fc90b8596b9dd1e08f8abf1e3499909364c0adb857db94eea1d17d6f9b2c151f9fdcb354ae47d289b94b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879615, "uuid": "ba27a5b5-00a1-4013-9e65-aae09918e487", "value": "T123F4235F0326BD5117E8551C183C29824FFBF2AA1BDE55048908DDFAFC71EC619BA1E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879615, "uuid": "eb7e2c18-9134-48c2-8cac-ba5062c7ec23", "value": "12288:5CNCXZNdPvPBFZsS/FfKBK5NbPumb0hagc0pDwJqxcimFbh6MDelttgWMfiS4WgG:OCpDPHBFWyKBK5NypwgfpFTmclttgvfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626879615, "uuid": "4248d6b6-076d-4ab2-8b3f-7f0e5debc45c", "value": 749362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626879615, "uuid": "df61ed45-a7ad-47f9-9353-c3730ae2b13a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879615, "uuid": "bc9b192a-7f44-4abd-ae3f-969b7e8d9508", "value": "Released Order.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e7502f-e9e4-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626845115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626845115, "uuid": "bd1770ad-42e7-402e-83b1-c9f8e13dc9e9", "comment": "Malware payload (Loki)", "value": "189e8586a731b1ac3fe68b46c9562744", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626845115, "uuid": "0b5199e9-4a63-4248-a247-1a164386890b", "comment": "Malware payload (Loki)", "value": "629e5733aec3fc522fc66bf9fb7916d51bdbff1f8f8583fd19dbea2c258ba752", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626845115, "uuid": "7d6abd2d-6d6b-4637-b22d-b14f75ee2176", "comment": "Malware payload (Loki)", "value": "437f90cba599c6fc59a706b478abb83915466338", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626845115, "uuid": "5043ccfa-1659-4d69-b466-4db38b20bacc", "comment": "Malware payload (Loki)", "value": "bb30b3fa422c2b0f3a85a0fbb089f49db4a6e781e8d18042054753a8a7eea843651c62565a4b1085774a7718d14c1f02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626845115, "uuid": "620ff4c7-f073-4d83-a451-e1cbe1492d5b", "value": "T1E405AF2113E7A284EC3E6BB88928C045D7BB7016C67FDB6D3D4880ED1E73755AA5B342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626845115, "uuid": "efbc1319-84c2-4ba5-a7ac-6549d8209557", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626845115, "uuid": "27229392-ce6d-42b0-b98e-f42233f1c403", "value": "12288:oo7EbuktHeCujHXACyvUIZbVuTp3bXsBr23tmjhAgIKypD6+o8U8m:fktHZuKvDBuTp3DsI3Ql0pBU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626845115, "uuid": "83d0915e-9215-400b-9ef9-3704dfa1b2ef", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626845115, "uuid": "02649fb6-3343-4e04-8bae-390303d5cf1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626845115, "uuid": "d8252bf1-4539-4513-8acb-7e22970d89ef", "value": "Payment Breakdownpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7fe03b-ea77-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626908504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908504, "uuid": "1cf90321-df9c-45fc-939e-5298496c7e41", "comment": "Malware payload", "value": "dbfbab244b7e7018779a71b82a02fa58", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908504, "uuid": "5a55b1f1-fdb1-4b9e-bceb-25cffd840de9", "comment": "Malware payload", "value": "6347c2353b772239f04925ce71b2a075aecd75299f26d4b4ab7ac7747e5542ed", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908504, "uuid": "a4184f8b-234e-4149-a8b6-29e9809314f2", "comment": "Malware payload", "value": "d01ccda03657b5e92a5148f314811614d09df530", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908504, "uuid": "21934274-e76b-4d76-ab51-197398932386", "comment": "Malware payload", "value": "3ddf4aca671f4ce5c0283877f2d0e2c5d8be2afaffeceab3ce77dd43fc4a9e5d7b875e7485248c7b6c42225f39fe7082", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908504, "uuid": "fc9e0092-5739-48a2-bf21-a51cc6108232", "value": "T17A64029BD9767C4BEE0B4FF021A70E4B5AF9D2DAD3C618907364444439FE386A2607C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908504, "uuid": "26667ba6-861f-468b-8f3d-87224e542501", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6coY:7O/QJHZweEL/NOjCHm7FZZncX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626908504, "uuid": "b4a42a52-ddfb-4d5f-a50e-5b73a851a460", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626908504, "uuid": "5305db90-ba5a-4dc4-865b-785c545c3a89", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908504, "uuid": "93c51d83-7122-4890-971c-cfa09b736a17", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6baf848e-ea62-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626899399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899399, "uuid": "7a6b8c31-dcc2-4a06-a4c0-e051803bf71b", "comment": "Malware payload", "value": "d620e11fcd186b1e9e8c921cee692289", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899399, "uuid": "abacb583-52db-4457-9eb0-07f91c86b28d", "comment": "Malware payload", "value": "63ec2a80765669b56d7d440ccf344be2aaac3f25badfe61f62cb660170f2f3a0", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899399, "uuid": "29f7a04c-8477-4a35-9e0a-e57f35e558c7", "comment": "Malware payload", "value": "5143420522aded1c16acb1abcc2e0ac070e8c316", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899399, "uuid": "0fa2b592-c7f0-4e38-ad5d-02566c7cfc24", "comment": "Malware payload", "value": "a9daab427f7fa83fc3f54fbfbfaecca02d50759f70173a404c7b6396d7d55d423307be22cd3f73ccce30629a681b5340", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626899399, "uuid": "a08b41a1-fb91-42e2-87c0-60fe34c98f4c", "value": "T191E449C5EBE1C92FEBD1957A0C560630127CCC4495804B973356F33AB72BA7C8E9A2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626899399, "uuid": "35f2a5c9-6cc2-4d29-bb74-0594892050ec", "value": "12288:5GDH3roxGMC/mc4bl3q5uaFsvCgdz2l5MjavMmIf+AR:5GDXEUH/4EnsvJZ2lKjavMm/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626899399, "uuid": "49622d72-8c49-4dad-9338-2370b4d9a726", "value": 675328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626899399, "uuid": "4bebd02e-6f33-4e33-9303-17cfbfc803e6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626899399, "uuid": "e3e08251-b12f-4041-9e05-8b5f3ba6c9ae", "value": "d620e11fcd186b1e9e8c921cee692289", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e569388-e9ed-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626849206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626849206, "uuid": "82495c39-4f5d-478a-a6bf-49ca683c057d", "comment": "Malware payload", "value": "8f7205aaf80ce4b5d0ee8f00369f301a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626849206, "uuid": "8bf40566-579b-40eb-88c0-e4ca760b5631", "comment": "Malware payload", "value": "655ca39beb2413803af099879401e6d634942a169d2f57eb30f96154a78b2ad5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626849206, "uuid": "c85cd008-be4b-4e6e-8086-5d192aee3167", "comment": "Malware payload", "value": "401d3336eb33cf82eecb5df5c2ac6d5f7f78aa26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626849206, "uuid": "1cc05b36-dc59-45d8-a1e8-df93ab0c3ce8", "comment": "Malware payload", "value": "0e0a1b473a63cb4efe7841026e6af4587b36153912eff50ffc74d5202df47ecd568b63e29f79a6610428f42c08dae32c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626849206, "uuid": "9177c572-928b-4b11-bef8-b5946a0a3ee0", "value": "T113B45911BB91C076C26231754E5AE3B46AB9BC715E35468B77DC2F3E1F302D29A3930A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626849206, "uuid": "5b63f538-870a-4b15-b8d4-94608a8a7229", "value": "79f7eb84a187c95b4137ba025d4894bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626849206, "uuid": "3db8ea70-f968-4839-b85d-f3afe87e6760", "value": "12288:747jVWnPp3kS+U8u40Rqk84MjKZ5x88tb:+IpIU8ut3MKZ5xP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626849206, "uuid": "911466eb-e4ef-42f4-b83e-4474e5aa6e30", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626849206, "uuid": "371596b5-0726-4e93-baae-6a7af1c7908d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626849206, "uuid": "34f96d55-0af2-43c5-a6a6-10ac113b2e00", "value": "qaz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6584f7e7-e9dc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626841837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841837, "uuid": "6c2176e2-f65f-4fc7-9b52-7ea9c6a795a4", "comment": "Malware payload (Mirai)", "value": "7255f506dae98d7f0bb44360315dcefd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841837, "uuid": "d35c5488-eb31-4e6f-98d4-05fd038edff0", "comment": "Malware payload (Mirai)", "value": "6786063e0cfe9ecce7b7fd3515c2448443bb1ee98d5c78855ff37130062b4bd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841837, "uuid": "7b84bba4-101a-4e1d-99db-ad19dc35b8a4", "comment": "Malware payload (Mirai)", "value": "cf17834f14ca4c5fed5600bc7acdf9af0b978c4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841837, "uuid": "ac1a3dd6-5372-42f0-a13a-4c8d67982872", "comment": "Malware payload (Mirai)", "value": "78eeef0b4d7fb07689601c6c1c92b4f544ecf3d71e6a8cd7c4d04d3e4a94ddbfdf373e97ca20f8f7594e851b5c02de88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626841837, "uuid": "6abd7498-7cb2-434f-b409-cfb223c7fb4a", "value": "T16703F882B8D29966C2E4637AFAAE018D332277A8D1DF3613CD215F1477C5A1F0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626841837, "uuid": "38e6da78-ebfc-49ff-88c4-5bd6ad5d298a", "value": "768:aVdF3nuGtGxgI3Pe86Y69pxLd2mYVOTHkKr+1Zeega93PN:Mnuf2I3wLYVO8Zera", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626841837, "uuid": "74c4e653-41f2-48bf-acf2-a54d4a04ac45", "value": 39632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626841837, "uuid": "6ae10c0d-f38a-4488-b85c-161b88b6b0cd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626841837, "uuid": "ef626dc7-64bb-4e09-8000-6856e34c0cc5", "value": "7255f506dae98d7f0bb44360315dcefd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e96f96-e9dd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626842112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626842112, "uuid": "e6e52be6-804f-424e-9d52-5c47e93ee192", "comment": "Malware payload (Mirai)", "value": "c27a492b3d7cb29062b2d6f5c53851a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626842112, "uuid": "4d10e0c9-c485-49e0-8ce8-e31c7b15f57d", "comment": "Malware payload (Mirai)", "value": "6b6cd7431c6376e3e524a97908787cb7ec0cfe6b57558ef352dd4b3e8f2ab8c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626842112, "uuid": "e430b50b-0d3a-415b-9488-b0da31706b66", "comment": "Malware payload (Mirai)", "value": "9d4977cfd5be5c5e4878146f530e14cbe1319dc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626842112, "uuid": "56b3d900-a6d5-40db-a9ce-456e9beee341", "comment": "Malware payload (Mirai)", "value": "0dfaff7630d17ed6bf162e40c73aa3bd911829c5d3c31cd762c4f9add25a62d1de61240655351ddb0f6e7e00ee6ecded", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626842112, "uuid": "0b8ec61a-434f-478c-9470-66a69fe9b052", "value": "T148231996B8039D3CF81FE7BE8816090CF625734561830B2767A7FDA36D321A4DE5AD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626842112, "uuid": "7dc7124f-61b5-4022-b4ca-ff994042069e", "value": "768:dv1e8X1w2izAYzusYViVgnuy86BrZeF85/l796g0zo8dE3d:dtdwrzT1hguy8Sk85/lR6gas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626842112, "uuid": "ae3c0010-9696-4444-90b0-c1256dfb6e98", "value": 48032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626842112, "uuid": "2091fa76-b574-48c5-888e-68ab7a8f1711", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626842112, "uuid": "a6c1fd98-f11f-49af-9d13-0aaa48cc3dc5", "value": "c27a492b3d7cb29062b2d6f5c53851a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c055d5-e9fe-11eb-875b-42010a9c0053", "comment": "Malware payload (ServHelper)", "timestamp": 1626856435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856435, "uuid": "06c99522-46dc-4134-a7f0-d1c6d946ae89", "comment": "Malware payload (ServHelper)", "value": "eaee663dfeb2efcd9ec669f5622858e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856435, "uuid": "c671b5dc-e4db-460d-b4ba-91253f556428", "comment": "Malware payload (ServHelper)", "value": "6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856435, "uuid": "e2870cae-a004-4ca5-aa03-9c0e86efe251", "comment": "Malware payload (ServHelper)", "value": "2b96f0d568128240d0c53b2a191467fde440fd93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856435, "uuid": "fa39b52b-ae91-4d25-84cd-623592485a0e", "comment": "Malware payload (ServHelper)", "value": "086f7fbb0b26b8526163d9d164f0d08d839f3c2fe31e5fb5fefb35e01a0e4845e86ef3262053be96590f6d4bab435607", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626856435, "uuid": "8613677f-1d5f-4f5e-b202-d11bcfc582c4", "value": "T18326D012BCE204FAC57AE138845693617A723C6643327BD72E94B5692E75FE02F3E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626856435, "uuid": "e22605d6-7569-450b-ada6-96f37a9de7a2", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626856435, "uuid": "3074d41d-61ab-4171-bcb3-bf9f633a458c", "value": "49152:U8+7QhuKuy4ab57x03AFPd96gUyeBW51fN4AsYfW4sAMnB4jt40bjqkNQU1:U8puFyft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626856435, "uuid": "d073ece5-43ba-4017-907b-bf0379e88cad", "value": 4777984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626856435, "uuid": "4215f5a8-ac89-444c-80ec-7cd3ea0e64b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626856435, "uuid": "13411a0b-91f4-4e00-89f7-9b78d4676d2f", "value": "exe1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d082af89-ea08-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626860914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860914, "uuid": "dbc17bb9-6cd5-4c71-9411-3eae708369e5", "comment": "Malware payload (Mirai)", "value": "7e6959577ca2e64916748414596bea92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860914, "uuid": "6902f730-5184-4bc9-aabc-adccb57f0711", "comment": "Malware payload (Mirai)", "value": "6c752c2895ef4da4e3840bae5f4c0fe79facb382391e910623d8572a39757dc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860914, "uuid": "2835e877-c960-4443-a624-a6cabccabc98", "comment": "Malware payload (Mirai)", "value": "32fca0a188cdf5ee77fa5eca3550e672e62ef9af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860914, "uuid": "69108ae2-6cf7-4c09-b9d3-2001eccb77c1", "comment": "Malware payload (Mirai)", "value": "e9fecd484cbfa987f69d9209ca1b493c04e18c4efd29a12a0586a8988024dbb125580cd9d0b0494592387877e004733b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626860914, "uuid": "bda2c6e4-af60-429b-85d6-55c667f61566", "value": "T1ADA2CF21328DBB61D2611237917CC283F3A58BF5A2FE32B52D1492DCE4C9105977ED4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626860914, "uuid": "bc473869-2e1b-4337-bf48-8f2f86652811", "value": "384:YD5mog4c6L5i4+stIW01vhQIE2TQPTvq5bhuH77BLdcZGqFEhymdGUop5hXX:YDgoh/DxCvhdRaq5Yb7BLdcRFEs3UozR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626860914, "uuid": "df448aff-1986-4010-90e7-084be1284af9", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626860914, "uuid": "3ea58763-a46b-436a-a517-7e577795b6e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626860914, "uuid": "b926dc1b-8cb1-4f98-8e31-32adfc8b9dc6", "value": "7e6959577ca2e64916748414596bea92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897ab9f8-ea72-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626906321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906321, "uuid": "ef640b47-f947-4300-a216-8379bfdd495f", "comment": "Malware payload (Mirai)", "value": "0df2649ff26b9de298f7e4e53744462f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906321, "uuid": "ca49690c-6aa9-4a52-9882-bd8bfaeea5ad", "comment": "Malware payload (Mirai)", "value": "6c81e0dcff06914127389f5e950ac628ca1becad0d988558740dd59729d43789", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906321, "uuid": "44987f79-4df3-47f6-9f46-53e6e683a908", "comment": "Malware payload (Mirai)", "value": "ac04382086d0caf15d8a91f995db809aa95f19a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906321, "uuid": "fd816c86-c856-4036-81ec-db1dc8cb6c7e", "comment": "Malware payload (Mirai)", "value": "7449ac7f3d30804275545109817349018e9f527fc6f63bc5d0977a26f9237747633b8eee1161d4618e6dd702f601fa81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906321, "uuid": "34bbb9d4-fab6-4980-9f64-962e9c0c9cd9", "value": "T18EC2F199477B7B06C009C17EE92D8A5333A5FCB14B2C3AAB07071DDB934709A41B5D2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906321, "uuid": "b63ba1d4-38e4-4473-8714-23875956ff30", "value": "768:C2ZbtgLEUwrMsS7JfOXeD/dgSZzitQGHy7SZz:C2jHMR7x5D/dgSJYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626906321, "uuid": "27e5b0b4-382c-4164-8ec0-30c15346ac1e", "value": 28116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626906321, "uuid": "6a49d833-7b39-4c45-bd30-d7beae0ddcb3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906321, "uuid": "3a5e0abc-bf2a-439f-80eb-4f132cf9ee98", "value": "0df2649ff26b9de298f7e4e53744462f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8bb2fd-ea4c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626889900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889900, "uuid": "998918e0-1943-4a36-8447-097d0a21b98e", "comment": "Malware payload", "value": "f2f26b2aba01e5176e3126edbd32f2ad", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889900, "uuid": "ef453d6b-cfbb-4f02-8504-28314aa51898", "comment": "Malware payload", "value": "6cc2a6bebc95cf94ceef59cc64512803806865521ac270fe62c1a6babc7074bf", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889900, "uuid": "55fa2a5a-6200-40f5-9b7c-fe1afa2bef55", "comment": "Malware payload", "value": "5c18d6acbe16f4658f033a894b7e058e47b4f16c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889900, "uuid": "d66a8b32-ebae-4b12-af1e-607bd9175bed", "comment": "Malware payload", "value": "5c3dea5c58fc405b1819a5c2618132352d0eca4b5636c7daa02ea71abbd90ad9b29d7b56550dd9ef518ef0071ba9c52c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889900, "uuid": "30fec3a4-7e8c-4489-b876-026db82cf044", "value": "T1B621462B3F90540DF65E87F4E091435BA12AA455440DCA0B17043589CA25FB41F939AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889900, "uuid": "56aca5b8-efcc-4186-8e07-dcf1fd8b1a25", "value": "24:9eGt5q3IHOtBkED47sUrbgy7Aot1GB/LZYYDXQWGCxxD:9BtU3IHwKED3UPgyfQLZhDAWGCxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626889900, "uuid": "94c3eb7c-518e-4d53-93b0-4676f296f3ae", "value": 1158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626889900, "uuid": "91c84445-695f-4f2d-9d0e-e156a97b9eff", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889900, "uuid": "ec1b3107-2a6d-4932-a057-742452850c81", "value": "Order2107.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea7df82d-e9e7-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626846784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846784, "uuid": "8a91e298-b4bb-4950-9c74-7eb9517b8884", "comment": "Malware payload (SnakeKeylogger)", "value": "00c2c49da45965b0e22597e0bd9c3964", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846784, "uuid": "7f2b511e-8b58-496d-a7e9-9d949a61cba9", "comment": "Malware payload (SnakeKeylogger)", "value": "6d2acc22440a4f5c15c989e4faa896b92384c6df2eec613ee1c3e66ff449c81e", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846784, "uuid": "e4189a76-5f51-4fa0-ae94-d5c85b5580bb", "comment": "Malware payload (SnakeKeylogger)", "value": "20e9392403f0e4cbb195f0b6846581e32d7a1d2d", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846784, "uuid": "c3238727-c1e2-46da-b7a9-4be65214687f", "comment": "Malware payload (SnakeKeylogger)", "value": "9545d6f3ca2d1d3dcba65369b8d4dfbf9d8a2067c47d9be68a1f6d6c7dab7c46c2bde9df7125685ac76cc6f22237fe49", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846784, "uuid": "616af727-c04a-439e-a57d-23f58d4dba74", "value": "T16AA423541D0F2BFE429152D02EC6BE69F0C6111A46EB47381B51D807E7737E3A82ED7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846784, "uuid": "69a21e04-4e7c-4c4b-b4e6-7e5263a9776d", "value": "12288:vBhxkyg53BZcJdTAxHFh1Lz9E4F4FyNXI9V5mtG:ZhUsJd+FjtNQV5m8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846784, "uuid": "3ae4f089-edd9-4cb3-8e58-815d96cdfe23", "value": 472743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846784, "uuid": "4a83fc96-8c5f-4814-abfc-208ef29e7faa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846784, "uuid": "514354e1-3e92-465b-8c0b-4a28275d7e50", "value": "CONFIRMATION ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2b1c6e-ea60-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626898754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898754, "uuid": "70a0079f-edae-4b10-9d84-0b597ac2af8a", "comment": "Malware payload", "value": "e14a0a927e2e4f5492df393e7cb9633c", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898754, "uuid": "c44b04f3-2cce-4633-80f0-6a4bd854e1e6", "comment": "Malware payload", "value": "6d6f8b8a027c634e29a81d8790a7699507b02907583958071397297546d21641", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898754, "uuid": "d54bb4eb-b7b5-435f-a93b-381eb9c370f1", "comment": "Malware payload", "value": "4b28f4018818b7c3352dc72979b7b63fbe5ab0c6", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898754, "uuid": "36293b30-8527-42db-9695-6b9c56a8585e", "comment": "Malware payload", "value": "bbef867c985d198326939e2440150745fc7618ba7a1fd58da82972d0792d008f74f224b4cbd774a1e2ef334096789111", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898754, "uuid": "8443409c-aa8b-43de-9d8c-2cdf36e312f6", "value": "T1A7646FD5EBE1C92FEBD0E53A0C561630527CCC449A900B977255F33AB72BA3C8E851E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898754, "uuid": "061191a9-a65c-4fc6-97d0-b6e19e313914", "value": "6144:90Y35qAOJl/YrLYz+WrNhZF+E+W2RGthPjKBbA2G0VeU+fMGMCVVvtiP8hCV3V:ujwbA2EfKGi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626898754, "uuid": "3d44d9d2-33ab-4bd6-a259-7ab0d9001ffe", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626898754, "uuid": "c277f363-aa30-45bd-bb19-30bcb97d1ed2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898754, "uuid": "c6725062-64f8-46e0-9cf6-0c300bad8677", "value": "e14a0a927e2e4f5492df393e7cb9633c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c75c54-ea5a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626895955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895955, "uuid": "d6cb5bee-fa5c-4f59-9510-2f7fdb63c884", "comment": "Malware payload (Dridex)", "value": "8b16733dcb7b1477a70352b8b37893d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895955, "uuid": "93ae99cf-2373-43b2-9639-26e85afcb7d8", "comment": "Malware payload (Dridex)", "value": "6e1a19c1ead7999ac95c9a6ec469cedfdda7b513dee65cf6c3c7ebf9385eaffc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895955, "uuid": "23dcfe54-1766-40dc-b2f5-3ee5c95a7859", "comment": "Malware payload (Dridex)", "value": "0a7752872504ed87a1598f78633f940315acb558", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895955, "uuid": "edec759b-fd93-4ea6-a1c4-b511e3128bb5", "comment": "Malware payload (Dridex)", "value": "b1e119b8fd74355d36dbb337118cda15f98b09f5b42e8853245b80e023d750f4245a21250ea69f70fef7971ab4ec87bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895955, "uuid": "a3bd865b-6551-4083-808b-406244739630", "value": "T10604C0C9D2FA1786D4B1A67D1D84531BA4183C09CC39ED96C980CF5EEA3B204EB3675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895955, "uuid": "d5308ea4-724c-45c3-90c4-7aba451c636a", "value": "44b0dcdef59120fe964e77dc09a5f1e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895955, "uuid": "e2cab8df-0ad0-40a6-998c-46915a3b3126", "value": "3072:gbdeJIBwzBgXbJ26juQdZHT5K4PrsF2ATdwNBJUiG7NNNNNNNNNNNNNNNuItbXkl:gZe2Gzm1dZtK4Puhha87NNNNNNNNNNNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626895955, "uuid": "a97839b5-b2d4-4621-add7-0eb5118ad809", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626895955, "uuid": "e33a7d08-974a-492f-9388-3c601e04e911", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895955, "uuid": "266684b3-c3e5-46b8-88bd-63b8a4d6bc43", "value": "8b16733dcb7b1477a70352b8b37893d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8cfb4c5-ea73-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626906911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906911, "uuid": "f12bd6ef-01dc-4826-95e2-2c21fa948c0a", "comment": "Malware payload", "value": "cafbd1262eeb904aa078bb12299b8fe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906911, "uuid": "525c790b-e212-4601-9892-bd9d314c96f1", "comment": "Malware payload", "value": "6e821b1897010bdc39f0310603b06f967a9c8a82fe8b4f7a7582bc3e10ab34d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906911, "uuid": "3e65b3e1-8c9c-41a2-9741-a118274ec002", "comment": "Malware payload", "value": "ce0fc8e6184be895f3c1943b89697d5f6f6d772e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906911, "uuid": "7651f748-f8c3-42fd-b183-42309ed0a1c0", "comment": "Malware payload", "value": "f84645ad11a965c28be06626199134d2a340bcad5cb5adb229ccddee631567c412ab9aebd90dfd830bab01588f9ea85f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906911, "uuid": "7d4e4ad7-bf75-4edd-9df8-7054da156c85", "value": "T1B0644842AFA4521AC50F07B6AD705247D3F5DA22D1CFB7D738C4D3B918727A8A600AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906911, "uuid": "443c1b3c-6e35-4a4f-b214-f74de9999b86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906911, "uuid": "12891259-4d8d-41b2-81f4-03c8eb76e154", "value": "6144:sEloJOn/O6SSaSSRB9K9XKHBpPwz4DnI6bv:tKk/lKK9XKhpPwz43v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626906911, "uuid": "64a6157c-f10a-4d85-9195-f72d2ae17803", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626906911, "uuid": "7de5178f-0e09-4fb9-97b6-116d356d8f72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906911, "uuid": "6bc9daad-7d54-442f-8e3b-3464caf40bad", "value": "Run.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532dce5f-ea78-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626908807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908807, "uuid": "1b62894b-cc53-4ea3-ab99-1fe34d03f3e6", "comment": "Malware payload (Mirai)", "value": "07445f39203f0f2d0dda3b46b606ea2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908807, "uuid": "d8e149fb-b5e1-465b-95de-347cc668658b", "comment": "Malware payload (Mirai)", "value": "6e91debadeff4f2d49dadda3ee4202a4365d1ae0facebd8c7bcb6f0221106b25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908807, "uuid": "f4f5adce-1f8e-43a4-9cba-3b14e0d64c95", "comment": "Malware payload (Mirai)", "value": "eb1837cbebf9b6494878aeee6391fecce5761429", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908807, "uuid": "5f56e9e5-d95a-495e-b259-48da6398cf61", "comment": "Malware payload (Mirai)", "value": "47d679b02c59ca6b131712a0cfb80541eef6df5f5f6a4c106d6944e96f337055649dd55d35e0da6c03de0f4f16e24537", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908807, "uuid": "9cd03aa9-da67-46cd-9e99-7a377cb3a26e", "value": "T19A630946BC918E11C5C913BAFA2D118D331367A8E3DFB2229E146F2037CA96F0E7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908807, "uuid": "0d4a19ed-6c45-4018-8b15-700200d2ac4a", "value": "1536:TAnJuIPUzEYKfw2ucXSUrIkHaLG1WS7WgYDC7BYc5zWItizzYIml:cuIWE1DuUSvcaW7dYGmzYIml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626908807, "uuid": "24f14768-da87-41b7-b6eb-206e12dd4d00", "value": 71112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626908807, "uuid": "7b07cad3-4758-46cf-9fc6-5b423051bf42", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908807, "uuid": "10cc5990-183e-4b2f-a3e0-b6a733dcd4da", "value": "07445f39203f0f2d0dda3b46b606ea2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a11f13c-ea79-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626909114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909114, "uuid": "2cfc5d3d-cde5-4d4b-b5fc-65a3596bfe59", "comment": "Malware payload (Mirai)", "value": "6155470a01a48dd0192a084724ffd40d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909114, "uuid": "1b097485-10f2-4dfc-803c-110e947aad9e", "comment": "Malware payload (Mirai)", "value": "6f61df47775be47f94697e68e8ff02a9d05a641263cf479a5be5fe6ee251bb29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909114, "uuid": "5476fcbc-ba45-4b42-86fa-ef7f19d81f3f", "comment": "Malware payload (Mirai)", "value": "d1d8d39842b6659c9d69ec09474d5a9365ac1626", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909114, "uuid": "782c798c-cebf-4831-a6ab-a21588f34fe3", "comment": "Malware payload (Mirai)", "value": "8f51b8b8e50e7cbcacbdbb86d9799ee97ddd37829461dfb3e65890e3e2c4f990befe637da928e49e9b2e53f7567398c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909114, "uuid": "51247de4-b1a0-4e6b-aa66-4230a6fb2b75", "value": "T11B534AD6F801EE7CFC6FEABF84220909F522A61045630F3BA277FC93AC321A55956D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909114, "uuid": "9d3044b7-24ed-47a7-9e2b-cb5c4f7be2e2", "value": "1536:GDNLDnqO0ilXpHV9ZoxMXnt96WEmmtFqLn8L:ShTmx8ntk9vFyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626909114, "uuid": "2d13c740-4d93-4a08-ada9-5a765cdd803e", "value": 62104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626909114, "uuid": "053a4792-c065-44f4-83fe-6e836f732337", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909114, "uuid": "f954a028-159d-4436-b248-d18ada21f43d", "value": "6155470a01a48dd0192a084724ffd40d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfdbdef-ea67-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626901631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901631, "uuid": "d95866dc-785d-413c-9f4a-10d4ed2aeebd", "comment": "Malware payload", "value": "eaa9755979d4edeac9c48ffb1f42551c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901631, "uuid": "0b22fd0b-c0d3-4390-9e5c-e038e0c0c8b4", "comment": "Malware payload", "value": "6f6d5cffc1e927811613347c2c10f9071434fedde5780114089981e494b573a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901631, "uuid": "83c5b6e2-a090-40b5-aa6d-c7c0b177c49a", "comment": "Malware payload", "value": "0ba5fc95f551f89648e0ddae327e60ffa417712f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901631, "uuid": "68b283a9-635c-4be3-8ce2-114bf6cf26c2", "comment": "Malware payload", "value": "74d3685c14797d48c62c2413278174377a10adb4e9c2da3ff5af4f2231150050245681b536ceb795483b780022388f16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901631, "uuid": "90fb426c-d96a-4b19-b998-ae2161944cb8", "value": "T1B514BF1637F88A2FE2DE8579711205129378C2E3A9C3F3DA58E455B78F227E50A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901631, "uuid": "bd8c3b26-711d-4366-96dc-b595fa520821", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901631, "uuid": "62b08ed1-899f-426f-8ca4-528374482528", "value": "6144:wLV6Bta6dtJmakIM5EP5BqF9aK4qzdbmrcPSJ:wLV6BtpmkXBBq/aK4qzdgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626901631, "uuid": "ef6a40e4-5645-4635-b380-067fefa9a187", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626901631, "uuid": "c5826880-5626-42d4-ac52-e01995aec6b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901631, "uuid": "20b39578-179d-4916-86e6-11f09380510f", "value": "TRwrC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfc3515-ea16-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626866627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626866627, "uuid": "309bcbb7-65d9-44d5-b319-86c08fe7350c", "comment": "Malware payload", "value": "f55e9883bfdd084f8f69c0ea223344c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626866627, "uuid": "d0d4da4e-7a54-4133-b384-3cc3fb0a5209", "comment": "Malware payload", "value": "6f83140f7c4c0f30a31ec9a770ab866b781858d6d9415de212e1b40607cca577", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626866627, "uuid": "0cfbe719-fa70-4472-a552-9373424d0e88", "comment": "Malware payload", "value": "90c070436b92890d0ab4fb056ab37bca816ee264", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626866627, "uuid": "10c20212-484a-4896-8834-f674ed922a8d", "comment": "Malware payload", "value": "da42962021f2ea826ff9e054322d94881a9cec71ecb7efe3a10b8be02e9615bdf64c674719b252403bcb4cd74984b976", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626866627, "uuid": "18965a5c-a7c3-4ddd-8fcd-1e449695edbc", "value": "T1BE24AE0072E1DA72E6A5093154F7C3A52ABFBC666E3C8A47764436CF6E713C156BE302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626866627, "uuid": "00a59ef9-5728-406d-8dbc-a2b132212917", "value": "90448e8f7733b3c6bdf5b48508246f5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626866627, "uuid": "aedd2dc2-09c2-49e3-8b67-3871f12e171e", "value": "3072:38WKDHT/aRBLJDwXBD+1f6lRsQj+MFzwbEu4HGszssldPuEbL1E:wDHDELyX9A6lrFzBnmytldWCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626866627, "uuid": "d890438e-f974-419e-b65b-01430a539e6a", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626866627, "uuid": "d75571ec-5937-4dde-8979-fb4badbf2dea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626866627, "uuid": "7b2848ea-5b96-44a6-a9b5-a8bae18f32e6", "value": "f55e9883bfdd084f8f69c0ea223344c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37938c3-ea2a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626875522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626875522, "uuid": "3de27164-9b9f-42d0-b029-2dba19bbdc08", "comment": "Malware payload (Formbook)", "value": "54c6e68d889239ef978e4221f8add60f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626875522, "uuid": "90ce33a1-eb21-425f-bb65-701724838cfb", "comment": "Malware payload (Formbook)", "value": "71cb97b67ebcc50a0bef217b3ca9591cfa49f6b8c8d11ee9952c2cde0b7b6a51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626875522, "uuid": "b24fce65-78da-4587-b6cb-6464a287d06b", "comment": "Malware payload (Formbook)", "value": "500f8852aa4cf26eb57d544fa3017bbab75aafce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626875522, "uuid": "c13693d5-d017-4b50-bed6-5f94b0d5a0bd", "comment": "Malware payload (Formbook)", "value": "554e7757b657e46c325847c01fbb874903f1a1295b8c6664dacf64e931b510575ceb2e5505a5e01c06d7fa648cc11e75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626875522, "uuid": "a9084ada-5e7f-4539-b97a-6f524965f9fd", "value": "T1D914123C971D660CC392C63E28BC12BB2187F530B99F1C7BA72051E505BEAE45C25B6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626875522, "uuid": "c56d85a9-dd8b-4763-b3f4-7c482a76e754", "value": "d7cd0c2a85ac74a96a6bff797c472b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626875522, "uuid": "83f83ac6-62e6-4244-bef3-57b7264ee60b", "value": "3072:rrJfUq2HOAp1sll7rzhuwXGI3AJwC1ZGLt+5zsZ/bcm/tDhxABxVr6XBMf8n:rtct8xrEwWXwzLtHZ/byBxo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626875522, "uuid": "1b3c97b3-b9a9-4b6b-8f34-c93812b5fff1", "value": 198944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626875522, "uuid": "30f1f41a-8e8f-49ee-afeb-dd40a5707527", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626875522, "uuid": "76d47dbb-6371-4064-811e-8c0fecb4dd77", "value": "PO91206762.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794786a9-ea38-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626881383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626881383, "uuid": "8b03600a-3d2d-4dd0-9c38-88437a2a07a2", "comment": "Malware payload (AgentTesla)", "value": "dc7c594729e403ce1d87f86e3a7b19cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626881383, "uuid": "ff1f38e1-05cb-452c-80f5-55fca990ef4c", "comment": "Malware payload (AgentTesla)", "value": "723b9b35a4589438b1f7b3aa1306762c1a8bbb40e58b721bdb26248cfe5b4817", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626881383, "uuid": "ab0c6639-0e69-40ca-b646-b6bb9b734b13", "comment": "Malware payload (AgentTesla)", "value": "067371590de6f458e54bb34640ee2ef68156cc4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626881383, "uuid": "de5551e9-3065-4376-a374-0d8fe6abe683", "comment": "Malware payload (AgentTesla)", "value": "bf23b19dec3ae844c9bcb74c875a790fe10eca84ef057cc81e45bfaf68eac6812611b661eeed16924305e7372d3eebef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626881383, "uuid": "06113588-78ce-45ca-b2a9-1f71e998d2ee", "value": "T145358D224DCE4667C2644AB7D330EE02EEF15CAA2544EE151EC1F0DB9D3729A94DED0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626881383, "uuid": "38676e21-8fef-4cd8-ad52-e0190ab9fa95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626881383, "uuid": "b7656d03-f6fa-41de-a37f-375964827b92", "value": "12288:bKEH2iHOXZF50VZ3MAqriDbhLb/APMbk9oz/ruk5LqMG9jM2TvS/gQipP5n:jk7KVZ3M3riDtLb4kw94/ruOfGwipF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626881383, "uuid": "87ed418b-7e04-46ef-a7a4-cf28ca4303a6", "value": 1146368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626881383, "uuid": "b8081ed3-dd6a-4b9b-b9d7-a8a6ea185fc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626881383, "uuid": "368cb6a8-8947-4d2e-bce2-3788d0768487", "value": "AWL DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626fc73b-ea4e-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1626890794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890794, "uuid": "2261dd45-2c01-4618-94e4-80dca9b750b3", "comment": "Malware payload (DanaBot)", "value": "717fbb237f8ec5a350a1f9fe35e8dc5e", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890794, "uuid": "02951d56-633b-40e9-b99f-428d481d6e39", "comment": "Malware payload (DanaBot)", "value": "7277ba54308bcc7098ac8be7c268a99edce0dbd0b49536b36acca25ca06b5de6", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890794, "uuid": "fbc525af-0f2b-4edc-932a-e38e6a65415a", "comment": "Malware payload (DanaBot)", "value": "fb3b8701c0dfda13f56b9ad71cab59102daed5a9", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890794, "uuid": "45064400-9655-44eb-a46f-a28c23b1167c", "comment": "Malware payload (DanaBot)", "value": "61b1976596c47997f600c8fc95cb471b40ce16f35bb016d1906b5ca78cccdc57290d570155ea666d1a611488f4618c8f", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890794, "uuid": "38a023f6-47bd-4167-b0ff-a42eccfb5aaa", "value": "T19235230136E1E972D591093260F78394AAFFBCA75D789A47A1193AEF3F301C496BC316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890794, "uuid": "2c581bcf-b26f-48ed-87cb-606a1b54f8c5", "value": "266aa3b561e26e3b4d438fb26814163c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890794, "uuid": "6613a29e-0edb-4823-933e-e01a13eec482", "value": "24576:wDPYAIHIXqX2hBCoLsPdkUrHBlhnjXAEmB+31pFy+L:wDgzI6X2hBubuM31pFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890794, "uuid": "76a34454-0ade-4d1f-953c-c59bbf40ee35", "value": 1135104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890794, "uuid": "601c1d6e-517b-4bfa-8740-f50a6f5a8d35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890794, "uuid": "86fc1215-de74-4527-8eb3-da72f61a330c", "value": "717fbb237f8ec5a350a1f9fe35e8dc5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feaab439-ea2e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626877312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626877312, "uuid": "6e7bc339-49d6-4022-9e1e-37f75c5f8190", "comment": "Malware payload", "value": "a54bf8f8470245c908cc1de6063e04fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626877312, "uuid": "6fe1111c-0424-4220-9d36-939c912fd1ab", "comment": "Malware payload", "value": "738f4267728385be1d6336685338a0af96f09587218dbc6b3b88db07d1326877", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626877312, "uuid": "bcfd2504-2c06-4120-9c94-8d3454945153", "comment": "Malware payload", "value": "a02f9a05c2fb54d898b71da065e87501ab60828c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626877312, "uuid": "feff1dfc-1755-4424-9d3d-41a0c16f0e7b", "comment": "Malware payload", "value": "f8e23d93bd553b87fe7baf90fdf5e65091cb53336a79ff1aa616d12c272fe967cd708e6ced092f218aa000b2e37c9120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626877312, "uuid": "d38112a2-3b4d-410e-8ab3-d0906934ee30", "value": "T143A45CF9B2901F9FF646C6BD8520B4A4A0D55C7A3A32C580FEC7975F401ED28DAB0B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626877312, "uuid": "96abcb01-efbd-4e59-a7d1-930d61c37298", "value": "12288:OFpeEkIsPmFj2fqpjqNLJMUKSNWdC5krVTsKdLFPTxl/smqk8ymWlhJ5ZN3:Wpecb2fIjgLK6NwxThf7j75ZN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626877312, "uuid": "df074fa8-aa5c-4753-a6ae-36e2bc3bc7d7", "value": 465028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626877312, "uuid": "1b10a80e-4d76-4bc7-b9da-eaf2678dd70e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626877312, "uuid": "7e310aef-39f0-49e4-9fe4-8f0844cb5d42", "value": "boysLove.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396a1a48-ea2e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626876981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876981, "uuid": "387a674e-99ac-41e3-9ab2-8fa758290ad8", "comment": "Malware payload (Loki)", "value": "9659fa20cf8ef697ef1ab8327fe34bbc", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876981, "uuid": "e994bebe-cd57-41f8-8afa-256d3d219757", "comment": "Malware payload (Loki)", "value": "741d450b9e333f111f71bb64a12d63ebdd8d5bc0bc7bb73f2acc3017a1431b60", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876981, "uuid": "96bb10de-4f50-44aa-9a2f-4b88392e6c68", "comment": "Malware payload (Loki)", "value": "fa42bdf404d2a12fe5bfdad717f6c574c14e0aff", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876981, "uuid": "f4881a49-0feb-470a-8fc4-b322426bd9af", "comment": "Malware payload (Loki)", "value": "f4af8b625778f6bf0b67a7afd80d657df1e7a1863e1f8d8c93f79192abd61875b36643fb7ad8ed1fab1796874379b352", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876981, "uuid": "a423d09d-3581-48ca-a6bb-0a2d24e9b21e", "value": "T1C545126954EA8B57D15BA9F918F3C51903F26EF07228682F43E432C1B77D17AF64228C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876981, "uuid": "5c0494b0-abb6-416d-a522-207d1f991cfc", "value": "24576:0nk3yCpuBgqVSjbLGdMFOVs5awgoJ0tjw2JQM+Kd777gA77777777Ga777777s7/:e/78O6w+gaujwL2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626876981, "uuid": "46961962-17af-4462-9ed4-88b8261ec9aa", "value": 1180672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626876981, "uuid": "2d2589b4-f7e4-4de7-be0c-03c5cbe20fb6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876981, "uuid": "1fea1943-825c-4bcb-a1df-76399953e155", "value": "SPARE PARTS Provision List.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a7368f-ea44-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626886394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886394, "uuid": "a983db61-000f-4f01-8a76-77de6d3bb0ea", "comment": "Malware payload", "value": "55eecedf8b662653b65ba780ebdf7fe0", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886394, "uuid": "4b8e4c9c-2e99-4a8f-80da-71704b602b5e", "comment": "Malware payload", "value": "7573729345f787a51f7918f2047f2cddc6f68e3b07eb6a09b373b966b3703385", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886394, "uuid": "807ee395-7bb1-4f45-8892-5a1a14600185", "comment": "Malware payload", "value": "fd5864bfceebe809c986ba1fa87f0059c2943f43", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886394, "uuid": "cc15ddfb-a4ec-432b-b343-fc2b39aff975", "comment": "Malware payload", "value": "a00c5741234a2653b777a527dfbdae95e50c27d7208428753cb89ee399ad8988b4019989842277c75b06079c6f4d9225", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626886394, "uuid": "17b3d66a-58e3-4162-9c30-7af172512fab", "value": "T15503F848B291C617F26156798DD7C7EB3339BC0AAE01832B33947F0EBC796749A06764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626886394, "uuid": "615eacaa-45d6-45f8-bd9e-dbff489d4a22", "value": "384:3Wf8yGcSdW+wRsCBkX/l+JVA8p1r/zYVB6MeUogrUr3QAl9ethuZAp:GJKCBcEVA8pt/AB6MI2Ur/lVAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626886394, "uuid": "f9250701-5214-4300-bfda-b2ec4c51516a", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626886394, "uuid": "01660845-213d-4d20-a2ac-5b1f74f18cf8", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626886394, "uuid": "340b2667-841e-4120-a244-75cb75969d1e", "value": "SecuriteInfo.com.VBA.Heur.ObfDldr.13.217245C7.Gen.1850.6570", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd38d16-ea1f-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1626870867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870867, "uuid": "fd623abb-9a38-4180-9968-d70ed1e8360b", "comment": "Malware payload (CobaltStrike)", "value": "527d04ffacf0f16bcaa05403c9c5cd69", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870867, "uuid": "db8ed803-110f-42db-8c21-1ec0c99e2051", "comment": "Malware payload (CobaltStrike)", "value": "7608d92da7de2b284264bf62c82d0070a328cb70a068a5232f10c849f19b96ac", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870867, "uuid": "074f4043-ec37-4fc4-b0d8-814b03708457", "comment": "Malware payload (CobaltStrike)", "value": "12191562e5bf3513c2db3ec6dcbb2eb8e673de16", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870867, "uuid": "86790122-0b44-4d05-ba82-d4bf41b4ad7a", "comment": "Malware payload (CobaltStrike)", "value": "850e234b3e2d85789e4d2b4cf22add7b09abe352d01fad7bf284cce5ed331c816ad4ca8f34287d15cf8978b01b5b8c3c", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870867, "uuid": "45195c3a-f6c0-4f08-8255-c283ab7814ae", "value": "T1AA3612B86190365CC42EC5349033AD05F3F5555F1BE9E9EAB2CF7A806BB7920E606F09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870867, "uuid": "abecf2cf-7000-4141-89d1-ec0e036577b8", "value": "76f527df5d6b94eef04c1125edf5a4e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870867, "uuid": "92305125-7330-4bb0-8df6-4a072a10070d", "value": "98304:G/AEf3VA5PfjKL75Jhj2oHO+QX8ob3S2bPI:tEtqGf5xHhQXFb3S2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626870867, "uuid": "f7903c59-cb48-4817-9ab5-9ad4c4a9bcd1", "value": 4964352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626870867, "uuid": "3a30931b-4016-486c-acb0-1824182ed681", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870867, "uuid": "b3387d28-6e5f-4791-b792-2da1b3552c99", "value": "gof.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756d78cf-ea64-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626900275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900275, "uuid": "c01955f3-8d7e-4965-80e1-122e34b5e337", "comment": "Malware payload (Mirai)", "value": "50fee0fc4f323c4e8e333a48545bb22d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900275, "uuid": "0ec7c0cd-83bf-4047-94e9-550a6afd41e2", "comment": "Malware payload (Mirai)", "value": "7692abecaa15003a759fdffe6bfcae0660ca7931a3cc0e053b72784f513162ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900275, "uuid": "20c8f769-a140-4ccd-976a-b6fdd44a8c5f", "comment": "Malware payload (Mirai)", "value": "85a5dc02a99009144e5a9b8ed437623751cb083c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900275, "uuid": "b63291a3-94aa-4609-bc9e-9bb91da0d697", "comment": "Malware payload (Mirai)", "value": "a03916cc3e349ef8b93c970f19192d0cf10f69fbeb3ed906f25a1c8330e9e5f43b1469a777c60f1853e37b13d7659c86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900275, "uuid": "94eb3525-5c99-4ea3-bb0b-60d5c6e9cab3", "value": "T125B2E1C5D6FF27C3D252C332E0BC9A0DD2761AC1074A841A1109725EA39774E9BFB3A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900275, "uuid": "6e2ead5a-4246-4444-b084-d301a67c87ae", "value": "384:MVDKKQOcRpmYLdn6RBOFRFt5rUF81uiSSlCo3AnupVFNqnrrd1NEZgO8UXWozPLJ:w/QOC0Yhn6ROHWF09cwNPFCnNBxc9ocr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626900275, "uuid": "5fefacb3-f5d7-43cd-96c6-791acd5eec99", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626900275, "uuid": "0d5dcebe-2e55-41ee-aa13-c0adddfea681", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900275, "uuid": "11879495-75a7-48f4-b4cd-572aa4275bf7", "value": "50fee0fc4f323c4e8e333a48545bb22d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d8289d-ea34-11eb-875b-42010a9c0053", "comment": "Malware payload (RevCodeRAT)", "timestamp": 1626879735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879735, "uuid": "034901fd-e56b-44a0-875d-833ad3c694b4", "comment": "Malware payload (RevCodeRAT)", "value": "1372b32848411ad39f19abe9d74b052f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879735, "uuid": "cda14e33-d6e1-41af-871f-5074768b01fe", "comment": "Malware payload (RevCodeRAT)", "value": "7696274f6270b793b2dffc5b283a104be475d79b440500478780e24f6436fd5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879735, "uuid": "92fdcc34-1249-4008-81bc-6c14aecae4ab", "comment": "Malware payload (RevCodeRAT)", "value": "b47548451a323c3ae62b25ee6b65f1fe76837639", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879735, "uuid": "9ba90637-f621-4c10-9e9b-5f5d0403be27", "comment": "Malware payload (RevCodeRAT)", "value": "7a0bc42d659ea6477f569da56e80b83f881862f38144335d46aa05bf836bb3d77062a1d7f4b5ddf8506e5cc3dbe083e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879735, "uuid": "cc8c40b7-c5fc-4719-a143-2d7c3683cc1f", "value": "T1AB95DF61F307EA94EC2213B8D87AD8F12263BD5DD525892F358E7E2DB9B338150E1907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879735, "uuid": "c37b68b0-20c0-43f1-9e3c-712c96c2e5af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879735, "uuid": "e11c3228-f76d-4eb4-9dab-fc030a787093", "value": "24576:rGC8DSdkJw0prtxjVn6UbQW3x+ZyaWhQqZo6Ox7mwQMKbCXqFMGjJJGahp:rXdP0prXdPQWQ/xiMKb6qFMGdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626879735, "uuid": "c566258d-937e-4960-9a4b-ed1e139c18b3", "value": 1943552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626879735, "uuid": "149601cc-6226-4d83-ae60-9376ccee2558", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879735, "uuid": "36ab7a0c-85ab-4d6e-a8ca-84ffaed1144d", "value": "FILE_2932NH_9923.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ddea26f-ea6c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626903618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903618, "uuid": "72201b59-f1a1-4f66-ad68-8d6a13b58598", "comment": "Malware payload (Dridex)", "value": "145c6b9290b6cf598f4995a8a70da916", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903618, "uuid": "2657b19b-2dce-408a-bdfd-a551d5eb146a", "comment": "Malware payload (Dridex)", "value": "770cb2aa5ea76f90e27bc72110b531fa3985ab4352d25362926971285408f148", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903618, "uuid": "bcc27e2d-29e5-493d-a66d-eae9167fc660", "comment": "Malware payload (Dridex)", "value": "11186a014fadd68d32a7cd76615c088c1adde213", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903618, "uuid": "4bee5a91-2cdd-4e1a-b5f4-af45905b7e13", "comment": "Malware payload (Dridex)", "value": "734fbc3dcb17b8ad854621d3c09ba1300c1bc3b08dd84f71993983b4e6ca2b39c20390f5b4e09dbe76956bf9afb46e7f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903618, "uuid": "5007021d-990c-45fc-8603-7e924b5608f4", "value": "T1EB04C077AEDFC0B9F2A39470107437AB26F57A032419F452DA60C8DBF83D994A8A4753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903618, "uuid": "cbdf11ce-3000-4300-af16-f063bafe0a8b", "value": "458d7355fbf070054838e3593829db8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903618, "uuid": "0c4d054c-6b03-49bc-8376-637c9dde90a0", "value": "3072:lVadvfvemTEtQ9yoZPW/k/nklVtu77wBeZUCEQZRpMBDp57WQhdIif4:qDTyJWPd/nkdqw4/HMB77WQhdIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626903618, "uuid": "3beff6db-7421-44f4-ad89-5c9039039680", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626903618, "uuid": "a89ecc81-87a6-410d-ab0d-d3ba4216031f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903618, "uuid": "a48a3117-8e46-4d59-a542-7d54bceae384", "value": "SecuriteInfo.com.W32.AIDetect.malware2.15668.10350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0cda83b-e9c1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626830366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830366, "uuid": "89d64e08-7d41-49b5-a315-ea3f711000c4", "comment": "Malware payload (Mirai)", "value": "dafa599109e805fab97b5c489fe0dab2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830366, "uuid": "a74d363b-74fe-4d63-9838-abe980f40de9", "comment": "Malware payload (Mirai)", "value": "77ba3a41943a3e0806f0a631e8656fe9f429f3ef785f6d69d8f18bed3d55eef9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830366, "uuid": "b142d99a-9e7d-4f69-ba02-7e0b1f218d84", "comment": "Malware payload (Mirai)", "value": "9b0b69b8ab1298ffcf3e00292bd170c9a739f279", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830366, "uuid": "5e6b4de4-efc0-48de-9f05-7eec660588c3", "comment": "Malware payload (Mirai)", "value": "0ef33cd8c3ac1e9607438897e6ba13dbcc3d2305cee6844822ea86fb3ae613c0b988f8ff7e60c05f768248669d32af74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830366, "uuid": "7de7299c-1e24-4e66-b0e7-523d9aa53de4", "value": "T1D083B41ABF714FF7E86BCC3745A91705188C661A22B93B75B930D918F64B24F1AE3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830366, "uuid": "08f7cc1a-44bb-4e4e-baea-6da81f3207ee", "value": "1536:zw89E5hhZ7EdqHyxOkReedaXWojgFLrMdZ4olZXb:v9ExZ6qS8UbIkMdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626830366, "uuid": "369433ba-19eb-42cd-970c-3fab9eb20046", "value": 85308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626830366, "uuid": "e0305e96-b12c-4ca6-b18c-1828d5b0ac1e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830366, "uuid": "467e0088-bdca-46fc-8c71-bc750744eb04", "value": "dafa599109e805fab97b5c489fe0dab2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561215c6-e9e8-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626846965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846965, "uuid": "472f56f7-9d1b-4635-878f-4baa83102844", "comment": "Malware payload (Formbook)", "value": "98f96d0a617b4fc387011474681b6d9d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846965, "uuid": "4376a776-4a0e-467e-b2ca-3b80542289a6", "comment": "Malware payload (Formbook)", "value": "791c59d9b13a96c15e17baf22d85ffd8e8f783909c246043ba600f9c5f36181b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846965, "uuid": "373cc254-6282-4c12-82cc-a4b643f0e249", "comment": "Malware payload (Formbook)", "value": "8314c6660c6627a6f19acfd1d5e9d4627c70d37c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846965, "uuid": "3df615bc-7264-4f65-93c5-93c699b5af5d", "comment": "Malware payload (Formbook)", "value": "73a172da5b6fd76b09953ed7233e3da77358fff67fe4d45960536bab014556d576937b5e734177e2d408f8926e8347b3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846965, "uuid": "ce7e52c0-bbdc-4898-a6a5-2137a7a9c2a0", "value": "T130E423786DE847765A42F9C13CFD417312F26A7B91703E94D98685A1C1BC2F1FE2BA80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846965, "uuid": "574ea911-dc63-4ba9-a5b3-172b09df1b51", "value": "12288:6MWYM2aJ7+TvhRpwvWBVoVqbi+I31mz+YYnXNfkWPN820BE5EDaWQl:6GM1hG9rAV2U4Shn9fjl8RE5A+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846965, "uuid": "70ebccab-e3f2-46bc-8bc9-bcf908281dd6", "value": 682190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846965, "uuid": "4da38330-1c3b-497e-8217-d06b3ff2bc38", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846965, "uuid": "408852f8-b86b-4439-ab87-0e7fbb54d6d2", "value": "Payment Receipt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9829a560-e9fe-11eb-875b-42010a9c0053", "comment": "Malware payload (ServHelper)", "timestamp": 1626856524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856524, "uuid": "8a81144c-98cb-499a-ac6c-cec69e990e09", "comment": "Malware payload (ServHelper)", "value": "5e12e56a643c71b913ea60f48f28726d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "mainsample", "colour": "#451468", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856524, "uuid": "9643dc40-94f7-4ff2-8119-e47bdc6435cd", "comment": "Malware payload (ServHelper)", "value": "79745c2263c8abe5b916e39e577652c029b5b586e7ccb39ee63ed0fc1568c39d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "mainsample", "colour": "#451468", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856524, "uuid": "ae8da6e3-2dda-436f-8b6e-1eef7f798b14", "comment": "Malware payload (ServHelper)", "value": "8fd9ef3e15b545335c9cf8a16e7d49bdedc7b6fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "mainsample", "colour": "#451468", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856524, "uuid": "ece13bcc-1e67-4a8a-9f23-0854629a8ad6", "comment": "Malware payload (ServHelper)", "value": "896b078d4821f44a91502069129ccadac0bde92a8ce43a0fe6c50cea8d306452063f6a44d0b65242f24d140f07e64001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "mainsample", "colour": "#451468", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626856524, "uuid": "e46addb0-53a8-4d04-acc5-9cd2729d45b2", "value": "T1E1A60114547FCC59C4E3EA717BDCB5BAEB9959A3240C74330264A32BCB23794DA0B4E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626856524, "uuid": "ffed8898-f399-4690-8a1a-7d56a8611fcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626856524, "uuid": "6da5013d-5488-45c2-b37a-c3c512bdda6f", "value": "196608:+T59AS1bGaVQMnWs30hr5cnoegwYFtu0mrbuYVgJaP70Z:Cf1dGaN30hrWopwYv1CuYBP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626856524, "uuid": "336b729c-0643-4992-8ba4-7dead4c70105", "value": 9638000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626856524, "uuid": "01534e08-6d9f-4069-87f5-6a82573df368", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626856524, "uuid": "43eb39c1-2eb8-4c1f-b4b3-7fe446f81e8c", "value": "Filmora-Wondershare-Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8980b32c-e9fc-11eb-875b-42010a9c0053", "comment": "Malware payload (LodaRAT)", "timestamp": 1626855641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855641, "uuid": "aabf296d-c4a4-41c6-bfcd-3679f75a6c11", "comment": "Malware payload (LodaRAT)", "value": "fc495bfdbabdd22ea020b6c615bfee66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855641, "uuid": "c68e03d7-d9c3-4230-bd2d-f00f73d9f13e", "comment": "Malware payload (LodaRAT)", "value": "79d3666b7a0fa6f7497eb4675b1ca9c550f8cdbf932f4410f1b8feb8d1e31d49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855641, "uuid": "48269aa6-71a3-4062-97c4-b697bca2d831", "comment": "Malware payload (LodaRAT)", "value": "421bb6711c7381ca74c28b377121da02a06d5724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855641, "uuid": "db34e4b1-6626-4901-b386-0b3ad069e977", "comment": "Malware payload (LodaRAT)", "value": "c7f1c3d327dbf5035cb8f0251be408cd1536dab0a0febcfb1a48cee6146e32a1fed91fa84b007be330c48cb5f143a449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855641, "uuid": "159e94c0-bb3e-468e-8e3c-cf5ba6f664a7", "value": "T12135E122F9C69036C2B327B15E7EF76A963D79360336D29727C81D315EA04816B39723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855641, "uuid": "54cb263f-54a1-4fc5-bf6b-31251b6bd885", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855641, "uuid": "a8d3cd26-1028-4d1b-ac65-e7a759cab5eb", "value": "24576:0RmJkcoQricOIQxiZY1ia/AGh1M9q7I0dMZIDLz:RJZoQrbTFZY1ia/AwMshgIDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626855641, "uuid": "c75e6c10-3a23-4bf7-b237-670a653b67c7", "value": 1135971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626855641, "uuid": "8c1deaa7-7d4a-471d-b891-9230f4901142", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855641, "uuid": "584f5a79-1ec0-4ede-84fd-f30f73914c62", "value": "CGDIFN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eea2349-ea6c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626903619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903619, "uuid": "7b93a716-7fe0-4ef4-bef4-bcb5078a01af", "comment": "Malware payload (Dridex)", "value": "e92d48a038b4208fafd89f2ed6c630fb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903619, "uuid": "9531cc67-1392-4000-9254-266feb63e8f8", "comment": "Malware payload (Dridex)", "value": "7a64e750e4ffda0b1731bf0449d335d2e23d0b76bb3d66830f5fb740fdc0ca4a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903619, "uuid": "b85f3f1c-8882-4c5c-a84c-f4a18cca8daa", "comment": "Malware payload (Dridex)", "value": "058d63533e5794a82f173246197584361c644115", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903619, "uuid": "fa6ddcda-c249-40f7-8f57-1113cedca977", "comment": "Malware payload (Dridex)", "value": "129ce4ee376413ededa3c8c8a43f66b84b526495b37009175741bebcc4b30cde2de83dbe9b45a5177db6748e8db410f0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903619, "uuid": "081b92a4-bd33-4027-91ad-9007231b034f", "value": "T14704D0C9E2FA1786D4B1967D1D84531BA4183C09CC39ED96C980CF5EEA3B204EB3675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903619, "uuid": "6686486c-b2f9-4d09-a580-6999e4173d1f", "value": "44b0dcdef59120fe964e77dc09a5f1e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903619, "uuid": "7eb59b44-3662-4ae9-87a0-67d6ab0bbf79", "value": "3072:8bveJIBwzBgXbJ26juQdZHT5K4PrsF2ATdwNBJUiG7NNNNNNNNNNNNNNNuxtbXkl:87e2Gzm1dZtK4Puhha87NNNNNNNNNNNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626903619, "uuid": "e23b7ebb-f150-45e9-9dbb-5134adefc044", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626903619, "uuid": "4ed23b12-d791-4ac9-81db-fb6ff14cd49b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903619, "uuid": "d3bf955a-7c0b-45da-9f5b-8de81dbf1107", "value": "SecuriteInfo.com.W32.AIDetect.malware2.32255.10988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66ec518-ea23-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626872520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872520, "uuid": "d9c5bc59-cd8e-4808-a1bd-4401ba8e37f9", "comment": "Malware payload (TrickBot)", "value": "ea252a83f501a1fd293d4a649cce274a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872520, "uuid": "1e0702d5-8838-4a02-a900-38beefef9195", "comment": "Malware payload (TrickBot)", "value": "7bc0a27df5b8420ca23081fb973bb68729bab7b6229513c81019f7be76deb8e1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872520, "uuid": "01f0760b-2852-41d0-a272-e3fe09576b72", "comment": "Malware payload (TrickBot)", "value": "1a2803c5804ca9d68f6b59546493db6f95680d61", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872520, "uuid": "884d15d4-89c4-4831-adff-0946c61a8019", "comment": "Malware payload (TrickBot)", "value": "7eedf80408c7795aa66a5f4f296142adb974bf672dbf1a3cd8baccef2c9c8e05907ff9f45e71c721d07461b77a2fdeee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872520, "uuid": "fc44d74a-d4f1-46d3-9483-ddb9a6c55f3c", "value": "T1BDC4CF2235E08577C4EF16345E667778A3FBBD942BF2C147679A890D6D339028B22327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872520, "uuid": "ac737ef6-aa21-481a-a631-a8a99647fe0d", "value": "f3deb6209dc9c95daaecc9f849af840f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872520, "uuid": "2ea47503-a11b-4700-900a-fe69f98b2279", "value": "6144:6nhWubOStZ6AbgmgwLp3gUhWeGthOPc/woVPHma1MXohuPATdTpNSTrbkYW412ph:6nTltgBNwxgUXy/DGaXhu45pI3rep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626872520, "uuid": "fc7341e3-a55d-4368-bac5-629ab8aa39cd", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626872520, "uuid": "611854ff-c75d-4828-bc51-31e5b277b783", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872520, "uuid": "09b52d27-0697-4ffb-af01-385b5b23119a", "value": "lovemetertok.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b45e7c-ea79-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626909103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909103, "uuid": "45e3ce7d-1345-421e-9cfd-452bd8ecb803", "comment": "Malware payload (Mirai)", "value": "ade0e236791909ad2ef8b641d23b05bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909103, "uuid": "f3aa9a22-0e49-4d0b-8463-fc2dbcbd597b", "comment": "Malware payload (Mirai)", "value": "7d1dcc4ed1f8472531dbc1ba0737d842c239f25b871d526a3ba9539c9b4eb53b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909103, "uuid": "0eff8393-7f05-4fc9-b277-b9621047cb57", "comment": "Malware payload (Mirai)", "value": "4fc47f83ad63dbebd8a71c9dcf5274358ba5afba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909103, "uuid": "98bc264f-951f-48ab-a0f4-76db61963e3f", "comment": "Malware payload (Mirai)", "value": "6fc290ef64a6f8bd6cb07b3f67ecda310f14f4a19130f64fddb75144c20c096b42c1db74af776f2514aa90b58476cecd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909103, "uuid": "2429bd7b-4a29-4fef-ab45-74ae0578e932", "value": "T13A431846BC95CA16C9C453BBBA2E009D332523D8E1EE33079D216F1077CA91F0E776A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909103, "uuid": "b552c6ae-e6df-47cc-ae38-e7093d4f43fc", "value": "768:uxdL51+UaQMuNwyFmSwMeYERSKdhtLB7y2shTIB7Pbvfe167kN2y2NFWV6vBNOGr:sdLnaFuNjiYElh9B7HspIBbbf17JFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626909103, "uuid": "151bd450-6587-43ee-a597-c26855571617", "value": 60068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626909103, "uuid": "0c3ab394-df62-4afa-bee1-8a60afb7c796", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909103, "uuid": "6573aa58-2237-4741-873c-9832c80bd702", "value": "ade0e236791909ad2ef8b641d23b05bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6daff6-ea5b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626896263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896263, "uuid": "9eb60d11-2c95-4855-91ab-7296d3ee8786", "comment": "Malware payload (Dridex)", "value": "5bf25769cb1ab4da9253eb56473168a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896263, "uuid": "0281435a-c54e-45b0-8597-6b6a45ad87fa", "comment": "Malware payload (Dridex)", "value": "80012d65f11c6481e6e98a03016f5a69ed2ae210af24d810b7ce562318a9b116", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896263, "uuid": "d2527d06-81d1-4498-9a2b-e4744bb7bf72", "comment": "Malware payload (Dridex)", "value": "9c2f7691fd672eb44e56232769cd8efaf2f2631a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896263, "uuid": "3c7df7ab-2ae3-40fb-b07a-cb7e3d81fcc2", "comment": "Malware payload (Dridex)", "value": "8b39eacff14ca01b050a1bede71d5f1368ee41af919512259d26894686a374c75d5a4f2a54e43503c4604f3d86139970", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896263, "uuid": "3e606934-80c9-470f-a577-59cda27b43a4", "value": "T1D204D0C9D2FA1786D4B1A67D1D84531BA4183C09CC39ED96C980CF5EEA3B204EB3675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896263, "uuid": "006b9d61-af17-4a05-8b7e-52eb1002fd15", "value": "44b0dcdef59120fe964e77dc09a5f1e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896263, "uuid": "8f3cc0dd-af39-4b91-9e17-e2e70929fa1f", "value": "3072:rbIQeJIBwzBgXbJ26juQdZHT5K4PrsF2ATdwNBJUiG7NNNNNNNNNNNNNNNuRtbX4:rLe2Gzm1dZtK4Puhha87NNNNNNNNNNNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626896263, "uuid": "611386db-5d96-412c-bea3-ca8d59df38ac", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626896263, "uuid": "0caa0661-0034-40c9-9f53-2b762a23c686", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896263, "uuid": "9e789fc6-10ed-48a6-98f2-45b1ff4798fc", "value": "5bf25769cb1ab4da9253eb56473168a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e75c20-ea5a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626896160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896160, "uuid": "c705a6f9-74f5-4c88-88d4-e6585ced0e70", "comment": "Malware payload (Loki)", "value": "97902789babf5acb6b2e1a2bf34f026d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896160, "uuid": "0d5c555d-0925-40e4-9b84-e95d55dffa6e", "comment": "Malware payload (Loki)", "value": "80dbbe2c5ad64fb800afeafa013939c7d13cafb0568b64750b4048a51700110b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896160, "uuid": "03bf15b2-d75b-41ca-a4ce-f09459cb30cb", "comment": "Malware payload (Loki)", "value": "9d51d7393bfd5eb16a81b2d304267267d25a24c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896160, "uuid": "44900f68-14af-4812-bb30-d20a236f6888", "comment": "Malware payload (Loki)", "value": "fd06a9854530592fb5b8e454245f46d93b4e020592f322fc1745dbb3866c33fc6ba2dc7842be9d106b0d2b115fa3599b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896160, "uuid": "366586a4-e462-4fdc-aca2-7b53689d3c6a", "value": "T192157A6494540663CA69A773D635DB30EEF22DAA6530DC0C15CAFC9B3EB6283508ED1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896160, "uuid": "4543a6d4-ee82-4d80-a34f-ee3827b498e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896160, "uuid": "966950cd-08ff-4e03-8efb-5fcad3f0fbab", "value": "12288:uKEJ1+28SK3C76L81i23U6pYltEilmw2p1C943ZbWa9VETaToti5P7r9r/+ppppS:K8SK3R81cEilmlNJvVYax1q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626896160, "uuid": "fa14408b-7465-44b7-b56b-8ab767bdc299", "value": 937472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626896160, "uuid": "76cf6a25-cd76-4225-a462-a8ecc5cf1e09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896160, "uuid": "f73f9512-470b-4349-936a-43fa5619e421", "value": "FATURA DHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cc30fc-ea2c-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1626876390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876390, "uuid": "2c1c4119-329f-4b3f-a710-b4963117cf34", "comment": "Malware payload (CryptBot)", "value": "3717c11773a246152805edc12e5d769f", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876390, "uuid": "196ffc37-c9c8-438c-9c27-27e5de285bff", "comment": "Malware payload (CryptBot)", "value": "819f04aad6e5928860bc28b2c02bd3661d8a5e91baa2b37dc069e90d9da9ecaa", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876390, "uuid": "2d99bc9b-63a8-4820-a1f5-5f0b8f1e053c", "comment": "Malware payload (CryptBot)", "value": "19059dc24f2fe1241f8f0d26f5350ac2fafe404b", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876390, "uuid": "c699671b-433a-48f0-973d-5da0f0553fa5", "comment": "Malware payload (CryptBot)", "value": "99ca37971f5b3a90bc886729430337b92b8f6256c8d981ca9618b3e161de06268085dea6a1465224f624615b6d84fa68", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876390, "uuid": "194f0c05-45cb-4799-bba6-d96925c53925", "value": "T1BEF412517AD2D836D162093280E7838567BFBC63AE7C9613269077CF5E702D2936DB83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876390, "uuid": "5f0991a7-cf74-4978-82c0-97e2e8f888a1", "value": "90448e8f7733b3c6bdf5b48508246f5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876390, "uuid": "ef8777d5-905b-4140-aca0-2add0609c020", "value": "12288:pzxC6fI+DC8aMEJ+3UuEyk3TN5qyud+77n7KHXtc6vy1SyTlLhm2ld:dxtC5wUuExx3KHaQycyZLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626876390, "uuid": "5d4d0c87-5c0b-4063-ab21-2552985389bc", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626876390, "uuid": "ca2ba661-5c8e-4970-9107-5fc512f9a3ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876390, "uuid": "bec0fb64-6920-4f0c-8a4c-ce96bbd3cf1e", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.24649.32545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6f488e-e9ec-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1626848745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848745, "uuid": "3771c5e2-4a86-4c29-941b-ea51b59ba672", "comment": "Malware payload (GuLoader)", "value": "25f7735ff71a70abf4bb508d2711f50b", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848745, "uuid": "53c416e9-c14f-4ce8-bd25-109b11c7e951", "comment": "Malware payload (GuLoader)", "value": "821f2880a8218afc0d30711b46f7d28e9adb2cd6c3db88b881de91090e72337f", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848745, "uuid": "132a6f0f-9a3d-426c-bb94-4b6e248592ee", "comment": "Malware payload (GuLoader)", "value": "7f40fff223019a3e399ca0ae0990afaf2695e93b", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848745, "uuid": "26116037-fe81-4fb9-b5d0-2636f4db1713", "comment": "Malware payload (GuLoader)", "value": "ac6b2c5a493a6f4cb1e2921becbb11dae408a652d9a1af10ece1e17a8b2d86cf849fb79520b8bbc9f3f627415eb38bbd", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848745, "uuid": "5245a947-11e8-49e7-a2c2-286651999ec9", "value": "T1A54512318DD0A506F281177465633EB233AC9C3D86188872FB2975C7D8B97FE854BE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848745, "uuid": "59fa8b0d-3c67-41ec-aa17-2eb77447fb93", "value": "24576:0V3MqFeVaaE5+qrvwVJ/x9O+w7qqbxWKAJsxhqR90CPYFZz1qvC:VeeV1Hxkf7pbx9AJohqRezZz1EC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626848745, "uuid": "b43fd16c-0d68-4daf-b4ff-55498f1e59af", "value": 1242112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626848745, "uuid": "b694b779-9bad-44b2-95cd-3c3c4bd0febc", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848745, "uuid": "6211df0e-d422-45a8-9378-bf326468e107", "value": "new order requirment-21 July.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3d5a20-e9e7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626846550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846550, "uuid": "5f3d9be8-aeb4-4b0e-9f40-61c3d12324d3", "comment": "Malware payload (AgentTesla)", "value": "f8efaa5826c602395a6317abb2905a25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846550, "uuid": "078c7740-17fc-40b7-b683-02745177c167", "comment": "Malware payload (AgentTesla)", "value": "8332eb6852a0315f3a9ce681c0ad78c03566bbd6d51bad68d487b33e02c7fa95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846550, "uuid": "9a8dc32c-dfd2-458f-8c71-5566c75ebaa8", "comment": "Malware payload (AgentTesla)", "value": "5fbd7d7acf4f0df39088fb4b64d0852b0fc8b310", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846550, "uuid": "7b87ae1a-7cdb-4164-86a0-f3421a5f0056", "comment": "Malware payload (AgentTesla)", "value": "3e927eab011e5214024ce3a297b5ba93e6f93f6ae152a01a4e806d6f2e9b0facd9141da4f55cd0ab09a7e67258ecbfe2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846550, "uuid": "1e4b0c8c-f8a8-415e-b442-02dc8250f13b", "value": "T1A925C02113EBA294ED3D57BC8838C042A7BB7017C67FE72D2D8440AD2E73751AA97356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846550, "uuid": "615980ce-c0ed-4f1e-88c5-72fb6fae0d05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846550, "uuid": "258f0b98-61d3-4919-87ad-6e94f7ce80fb", "value": "24576:mfnB3xXFYlHgxzEevDB1w1RWE3NzXj1LLZHrW3VS4Z:mfnB3xXFYlcTGRWKzT1Llry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846550, "uuid": "bdea6f62-f587-40f3-adbe-6a7f99720de4", "value": 985088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846550, "uuid": "89514730-5fdf-42cd-a1ba-6b8dc756cc4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846550, "uuid": "5482c7d0-408e-4bef-bd81-89db8811d4fb", "value": "Supply of Aggregate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdc1c84-e9dd-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626842122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626842122, "uuid": "434a7d9f-2b19-4f90-90fe-3d839f19f1ad", "comment": "Malware payload (Mirai)", "value": "fb04ec4c1713dbd1cd19a6762dfc1f0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626842122, "uuid": "d13b68b0-e0c0-4461-80bf-3775b0e0baa1", "comment": "Malware payload (Mirai)", "value": "833a96995bbdf63cd98a57e4031a16d8d118bf5ce0ccbb4e038158998e31e1ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626842122, "uuid": "b3a27d8b-147f-4a4a-9d31-a844ceac9a45", "comment": "Malware payload (Mirai)", "value": "07f1d549c59a30bd0efcdc3e17b5dc40c483ba25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626842122, "uuid": "7ffc1ced-8338-4f61-b378-7521e59067eb", "comment": "Malware payload (Mirai)", "value": "eba3ff5b9e071c03c4179a9cbf8cfcd353a82207bbd866daa31aefae6b0e7f097485f582864d0e73da7377ac5872c639", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626842122, "uuid": "00b761f0-f4be-4b5f-9f2a-c1f6804840b4", "value": "T12F134CC4E543EAF5EC1502B43037EF365F76F03A602ED9C7C39995236892642E9472AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626842122, "uuid": "af4fbb95-0763-452c-b60e-bf0417b347af", "value": "768:Ms1yfBjf74x6DhdZMddQmJTy5GDFxgYEu0plod4M4KU9n:py5jf74x6DB8mmJTyGgY4plodX4KUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626842122, "uuid": "b17286f0-f072-4bc2-9be9-2ea6aac6399f", "value": 41744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626842122, "uuid": "613340a3-6b0a-473d-ab8a-82c7645153ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626842122, "uuid": "fe930e3d-6c57-430c-9c9e-639ccb53e95a", "value": "fb04ec4c1713dbd1cd19a6762dfc1f0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7300a853-ea5c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626896835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896835, "uuid": "23a95cf1-4c8d-4c12-96fd-eb1cb83522fb", "comment": "Malware payload", "value": "86a93f39f3390d3c284b99e81e8b1a7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896835, "uuid": "b53959c4-4df7-463d-8195-0d68ed736442", "comment": "Malware payload", "value": "84c54cd76f3ac50f2f2e4afa57802d576bc5dd3c92cde50850feb04e02461ba3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896835, "uuid": "6d8c3626-aaea-4168-8188-756f282f0664", "comment": "Malware payload", "value": "7e534c2819b1ce06380afb1bd3a4ee6841fe5878", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896835, "uuid": "9491a33e-35b5-41f4-ae00-3842879488c1", "comment": "Malware payload", "value": "4fec965e9972362a5504e075b7e5b8962840b7f1b65fe02264e0148faaef1a78c9740bf9af82a3aa02f0852949f2289b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896835, "uuid": "ae176c9b-0105-4314-ae98-6087993d7bb5", "value": "T1F604C077AEDFC0B9F2A39470107437AB26F57A032419F492D660C8DBF83D994A8A4353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896835, "uuid": "00703dbb-6065-4f1f-a305-de87fe9b165e", "value": "458d7355fbf070054838e3593829db8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896835, "uuid": "4fa5c645-7956-489c-9565-73a486e142a4", "value": "3072:QVadvfvemTEtQ9yoZPW/k/nklVtu77wBeZUCEQZRprBDp57WQhdIif4:xDTyJWPd/nkdqw4/HrB77WQhdIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626896835, "uuid": "86220b43-7131-4c12-987c-c578db5d3bc0", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626896835, "uuid": "a57031af-e565-456f-93ee-b5bd1fd1c1f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896835, "uuid": "9cfaee19-2296-4bc7-a025-5f4df486c4ad", "value": "86a93f39f3390d3c284b99e81e8b1a7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809dc3b9-ea72-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626906306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906306, "uuid": "559c4f3e-1a61-49ed-ae39-d04d5535c886", "comment": "Malware payload (Mirai)", "value": "34a483820a6fb1969c2fbdff76b1f38e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906306, "uuid": "f7f38979-c0e7-48f5-a13f-d862bfbc2e29", "comment": "Malware payload (Mirai)", "value": "85a85f1989015384c560c27b6e8f1a2c7dfaa0fdcb943e02f276dcaf900ccfb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906306, "uuid": "10b44d81-b4ba-4bd8-a0e5-b3b0b8b3e8ae", "comment": "Malware payload (Mirai)", "value": "1b9d9bce2a1b45b4e705f98535344abfe701dd8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906306, "uuid": "b37d483d-4ccd-4fdc-bf23-91628530157c", "comment": "Malware payload (Mirai)", "value": "78545ffa748fc4109deaa6ce25b2e6ea094184e28f7fe369e7d43e4bbb752be49c7c4f9acfe19c754ef6331676dd4f6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906306, "uuid": "68307e99-9896-491f-8226-245ac3766461", "value": "T19CC2F26132879102E68255BEFB1CDAD202E49925D7F77A2B10784F31AA3360F39EDD43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906306, "uuid": "af96eb38-ce97-4ff9-9165-4d4abec9cf65", "value": "768:zKljnjQtM6rniBSPHtXc/ze3IzwfoQteiIKys3Uoz1:zKljjQu4PHtmS4ziLhz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626906306, "uuid": "a4733766-23a2-4151-abf0-f6c32cec7a22", "value": 27688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626906306, "uuid": "a00d3db5-20b1-44cb-b3da-f7cd0f26dc0f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906306, "uuid": "9744a600-83ae-4fdc-bd61-efb31086b752", "value": "34a483820a6fb1969c2fbdff76b1f38e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e2241f-e9c2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626830642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830642, "uuid": "4e4063a6-c5df-4349-b46f-3104484e5607", "comment": "Malware payload (Mirai)", "value": "2647d384b0d1fd9b0e8c6acf7c16a7f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830642, "uuid": "6443ae92-e14e-4b8d-bfdc-81946ff0dbfe", "comment": "Malware payload (Mirai)", "value": "85a920e3b0e0b675611506c6ac3961f86e20512854fdf6a1ab98e2ab915d518b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830642, "uuid": "de682c08-16fd-4d05-948e-23e01b3451ef", "comment": "Malware payload (Mirai)", "value": "ae27e0ae3c7d6c497779c500cac69e9b0bc07d41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830642, "uuid": "cd09f404-6a42-4f7f-a2fb-d416211c4411", "comment": "Malware payload (Mirai)", "value": "a7425b345ec95d88bba136d9cc82dd443129ed4566fcbb77f3af6e31b37d97ad01b95e3bcdf0b39cd34bd56b71c1c1c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830642, "uuid": "7beb311d-7842-4647-89fe-5411c6e30d23", "value": "T123533C42731C0A57E5970EB4393F1BD053BFEA9020F0B684694F9A0A4276E772586FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830642, "uuid": "e4b96292-08f4-488d-93fe-c062050898c1", "value": "768:zHhE6Kkd9GaEC318V5EKMRI45nZfdQTfF6XZUisNY9HnjwtMBLlxp+Nb/2HK/rlv:zHh5NEC318V2feb1KDEOKTl9EIEP43v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626830642, "uuid": "4f50a7cb-c766-468a-87dd-bbda022ebaeb", "value": 62624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626830642, "uuid": "2e29d5ba-1f6c-46be-b9e2-662e73c4c0e8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830642, "uuid": "a64dbfbb-a50c-42ab-8541-c99659b5f4a7", "value": "2647d384b0d1fd9b0e8c6acf7c16a7f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ea0a61-ea40-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626884725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626884725, "uuid": "d4824208-28b3-44fb-b8c7-c71e9c64ff04", "comment": "Malware payload (Dridex)", "value": "5d7e91a055573a70c596b58c5c7506d9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626884725, "uuid": "23c78ad5-711c-4ca9-990b-37693a6e90ef", "comment": "Malware payload (Dridex)", "value": "8683b69471ec7531228b1c48d2b362a5c6c9f0fb5e8fb0e3480797caa9a41d58", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626884725, "uuid": "567eba3c-e9d1-4b8b-a3a6-82f853684660", "comment": "Malware payload (Dridex)", "value": "fdae3503f37866112dbe969d5bf204924ba0f3e1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626884725, "uuid": "9ac82ec1-c1cf-44a0-8259-ad95fc624b23", "comment": "Malware payload (Dridex)", "value": "66883519fee96ef90e032c58fdc204ecfac1f59b902a4e5bab9bf26ae688849f41804bc3e32a06314e9d2eb1830f77fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626884725, "uuid": "f9043e12-0807-4d59-9a6e-4549ba06cccd", "value": "T105644DD0EBE1C92FEBD0A53A0C565634527CCC4499900B977359F33AB72BA3C8E852D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626884725, "uuid": "2bc33dff-ac32-4b2e-adc7-8f9e61bcacda", "value": "6144:h0Y35qAOJl/YrLYz+WrNhZF+E+W2RGtePjKBbA2G0VeU+fMGMzizLVJwOzf1UI1:vjwbA2EfKmdSOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626884725, "uuid": "8d65c24f-c6ff-4f69-b562-add45fc5c150", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626884725, "uuid": "d83696ab-c7c4-40bb-9cc9-0c05dd1877c6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626884725, "uuid": "d1bb150b-8283-4d1e-850c-142a85a3a2ce", "value": "5d7e91a055573a70c596b58c5c7506d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97105951-e9d0-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1626836766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626836766, "uuid": "26d4b32a-22d5-4318-9ed2-d39537691e1f", "comment": "Malware payload (FickerStealer)", "value": "96a1b2af40343e118e8eab30c9dc5c14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626836766, "uuid": "35e4ce5e-2654-4551-956f-828b3164bc7b", "comment": "Malware payload (FickerStealer)", "value": "87be6f628553d89007fd8f7d0758d42906f2ee7d84ca18e961cb463921061a42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626836766, "uuid": "252fe586-7af8-418d-8625-87c4499e5c6d", "comment": "Malware payload (FickerStealer)", "value": "3f3a3d8335da174a3fa64cd60a72696d925b3818", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626836766, "uuid": "9fde285e-cb1f-4dc7-98f5-51de326ad9d6", "comment": "Malware payload (FickerStealer)", "value": "764c212d70fc97b23f16416efa77f003fce37c855f7e5960466821b6cab74d2cd793a5b1f70ae919f68a845686ca8c1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626836766, "uuid": "85afab2d-3664-4766-b41b-e3a45230e74d", "value": "T185F53301BDC09572D5A11C3946759724ACBD7D302F248B8FE3E85E6E8A351C1EB31BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626836766, "uuid": "65cb625d-a785-4514-9423-a4253033dcbe", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626836766, "uuid": "d13dbabc-6ab7-4b4e-9fb7-67a0e922dc48", "value": "98304:UbADpNv9UyFximtuWtnL4iZ1Xxqsvk3upL/J5:UyxHtugLn38svkuLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626836766, "uuid": "62a73a84-2572-48a7-a218-e1e8f2fa295a", "value": 3373841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626836766, "uuid": "849bf200-efe3-4a91-b6d5-c1816b5fe481", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626836766, "uuid": "41928443-432c-4d35-b822-bf9835560d3b", "value": "96A1B2AF40343E118E8EAB30C9DC5C14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1163e561-ea4e-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626890658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890658, "uuid": "9b5cdd71-e958-4e53-b76c-75bfd4d64b12", "comment": "Malware payload (AveMariaRAT)", "value": "60bb544289cfeb878cf212268ad90d9b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890658, "uuid": "fc305d7b-8e38-4b1e-bea6-5ed20bfdebe8", "comment": "Malware payload (AveMariaRAT)", "value": "88172a45ab45c79f77b1a560dea8fcbb0ca7db792ca3d77e513e190dffc2a7f0", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890658, "uuid": "6af155b2-5a1f-4a6b-8ddb-977baaf8474e", "comment": "Malware payload (AveMariaRAT)", "value": "894de031e4cd521c10739650d56d8527c66b6655", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890658, "uuid": "bbf177fc-c9bd-436e-aa44-3ab743de6626", "comment": "Malware payload (AveMariaRAT)", "value": "3b3e0622b063e5f1513d18e46b5c476b5134c7cb6873746398e292a80ed8a9b5d579256fb207840c24734f358a4e2ddd", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890658, "uuid": "7a8f4afb-d283-4ae6-88dd-3923ecb0bf15", "value": "T179B39E13F7E54835F3B201B01ABD7E7ACBEDF9700628849FA394858A2D31946E925397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890658, "uuid": "c2970838-f89b-4d60-9563-a0057eb311c8", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890658, "uuid": "b6f09389-a12b-4594-b64a-ca55327c86f5", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890658, "uuid": "dc21d795-db75-4bf4-b3cb-0c0746ee685e", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890658, "uuid": "10f686a4-edb9-49e4-b7da-ef97aed69519", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890658, "uuid": "af44ed2a-bd76-497a-9149-a83559f02b10", "value": "60bb544289cfeb878cf212268ad90d9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67193014-e9eb-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1626848282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848282, "uuid": "471a2d97-ef8e-49bb-b4f9-f1b8bd56d7c8", "comment": "Malware payload (CryptBot)", "value": "b6c970046cdf3da19838d0114c993372", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848282, "uuid": "295e40dc-c127-4500-b96a-090aab4a29ad", "comment": "Malware payload (CryptBot)", "value": "88a2e91597137f9a64ccf66c89390c533d1a85d09f8310b658f73bf6ad45db2a", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848282, "uuid": "17ea376e-3b16-4423-8942-c055b659edb3", "comment": "Malware payload (CryptBot)", "value": "780fd038bb466c60140ecce80740c17850e95423", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848282, "uuid": "cf8f39a5-f8ce-40aa-b138-92e9f7ba19b4", "comment": "Malware payload (CryptBot)", "value": "735a2da5e58e5d23410c9e403e31cd03e4fa07ba4e03d4d408e50d5bbecfb9405d3f0affc0cf97f74c2d5c349a6b18c5", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848282, "uuid": "222238c2-67f3-4e2d-aff0-c125afb87c66", "value": "T16F95AB12E987836AD493F7F9350DF6744825AC7F07241AC377B4FEC26AE1E858928271", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848282, "uuid": "da0c1aac-3af6-4be0-8378-04c57eb4ca7d", "value": "2b914b6fd04316572d777593dc737715", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848282, "uuid": "6d904ca2-cac8-401c-b513-4fa1df4ff8d2", "value": "49152:q2dYgG58KfbXkV0qnOzioH+UL/8gPUjQgX+QwrhS:qWYgGmKfza0qnObLUWFr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626848282, "uuid": "3740e458-c486-4927-b130-d7916ccd4832", "value": 1934958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626848282, "uuid": "134bd047-5003-41d3-b999-73e24d2cc8c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848282, "uuid": "55eb2036-f5eb-4a8a-a244-1a78d6216228", "value": "b6c970046cdf3da19838d0114c993372.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d6939d-ea4d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626890506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890506, "uuid": "0d545034-1bb4-43a7-8b83-67b93b9999d0", "comment": "Malware payload", "value": "2dcb0750dd72d9be99b1f0d42b20b673", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890506, "uuid": "d5cec8a2-509d-4e2c-9b43-491d8f4a9062", "comment": "Malware payload", "value": "89b4067a98c617d7d81350f7b5f5e7d5c2530a766cd42c7d1cb46efac3e9d7ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890506, "uuid": "9562a43a-83c6-48d3-b21c-04de4a330d6c", "comment": "Malware payload", "value": "db0ae37505432923aa6e00ce404212216e6f3121", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890506, "uuid": "1b72a12f-279f-4961-8011-e8bd632cbccf", "comment": "Malware payload", "value": "d65c7b3943067a71acd7d7de86487ddecb49216ed8bad5d48efa7bf0f1216617ac159ceca4d99fb75799ed60f4942cb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890506, "uuid": "09f76e45-4be4-42d2-9b3d-ff088461e8f9", "value": "T1CB459D61F307EA98DC2203F8D87AD8F12263BD5DD525892B359E7E2DB9B334150E2907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890506, "uuid": "8df36751-3c52-4468-8ffa-05b5c4951ac3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890506, "uuid": "15631e30-b9f1-40a4-b7b8-21cdfa373550", "value": "24576:5KwSdkmGrf9nsKm5dnaCMlnk2mAeb4ep90Rzdahp:5ed2rf9sKydaCMwAw9XcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890506, "uuid": "9bb502be-4355-4b27-9c23-b6892e12d76b", "value": 1250304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890506, "uuid": "a7d84fc7-4e28-4df5-af02-3c6cfb126662", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890506, "uuid": "655ba30c-2525-46b2-abd4-9617ec49f0c4", "value": "2dcb0750dd72d9be99b1f0d42b20b673.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c878ca0-e9dc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626841821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841821, "uuid": "f96e6b7f-ddf1-4d75-a6aa-db04e6eb7420", "comment": "Malware payload (Mirai)", "value": "78e563f06b1fcf509a3da092645b5f59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841821, "uuid": "ef67fd15-5e39-4b18-bebd-592be8a7c117", "comment": "Malware payload (Mirai)", "value": "8aa0689ab0886d8ea1fe3fbc44d4cd296d9209ee07ee2b2fe8ce69dc1032820d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841821, "uuid": "46061138-e1dd-4abd-a9b5-16269e772d31", "comment": "Malware payload (Mirai)", "value": "ea82df043d705240e598247ef693460f607ee179", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626841821, "uuid": "813de2d3-37f4-4f47-8fa9-25bdc1bc0598", "comment": "Malware payload (Mirai)", "value": "0a55c104b7efa0dd9462347a0989da248636128635418c864c4b05b67f1bee0859ea8a8f9fd68f152615d29a7e59cdee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626841821, "uuid": "db2cfac3-1c9a-4bfe-b7a2-34f4a2e8bb07", "value": "T1E553A70E6E61DFFCFB99863587B38E21964833D626E1C684E15CDA001E7434E645FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626841821, "uuid": "688e7838-7bda-4e87-82c3-996f99375c04", "value": "1536:WCZFLheUX4CpN9XqykzezC7oUvFe1R0avR:WC3Lo+5V+s6Fe1map", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626841821, "uuid": "2d926e37-7f5d-473d-bcd7-515034c03958", "value": 64588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626841821, "uuid": "bca8466d-82cd-4f6b-afe7-742cf1e38336", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626841821, "uuid": "e64d4a81-9a8a-463d-89b7-c7cee2815390", "value": "78e563f06b1fcf509a3da092645b5f59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fe5694-e9c2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626830649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830649, "uuid": "7c1df1fa-557d-4046-96ba-d8521b25d7f1", "comment": "Malware payload (Mirai)", "value": "f4aa98d02b38eda00ad61bf44ea0a66c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830649, "uuid": "6574e11a-7b7c-4e2c-b989-e42732210f10", "comment": "Malware payload (Mirai)", "value": "8b56ce59fe00293dd2fe9bf6a135d9bf664911adbfe15383a0b738651ce8578c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830649, "uuid": "b071f3a1-030c-422f-90a5-9c8a1fb976ff", "comment": "Malware payload (Mirai)", "value": "22738ba0e8a290ed7561271e4e47e4e473a5b6e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830649, "uuid": "b02e20d4-7da8-4fe5-81d7-f6f4a07acb1f", "comment": "Malware payload (Mirai)", "value": "4b3273ab1afc3873041454f8618d27c753447fdce7b062a59c6203b29471708dee6fce54cb7a37718a7bcb1c72601f16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830649, "uuid": "5668df81-000d-45dd-885f-9b5ba3c877fd", "value": "T1DA532A41B8918A22C5D4237BFA2E51CC332663E8E1EF32079D256F5477CA92F0E7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830649, "uuid": "35d9262b-4570-44e8-ad9a-8139423748e1", "value": "1536:xK9nzE3Yzd6x2P53Rj5W47d8mIj5VxOMLih5XQ2J87:4zEozBhjzZajbx3mh5Agk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626830649, "uuid": "1852a38f-11ab-480a-8d71-995270eb5afc", "value": 66624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626830649, "uuid": "bbf39a7d-d763-46fe-af41-403121c2e1c0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830649, "uuid": "c70b8af1-55dc-4209-b6ba-14604115ca38", "value": "f4aa98d02b38eda00ad61bf44ea0a66c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976bbbcf-e9e8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626847074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847074, "uuid": "099e18bc-edca-4423-86fe-603a8a8a7146", "comment": "Malware payload (AgentTesla)", "value": "5364961cf95f94c23988ec567ca7466a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847074, "uuid": "6868b93c-e795-4b7d-8369-27334e96087e", "comment": "Malware payload (AgentTesla)", "value": "8b82e033dd3ab1e4b2d827e7b5627b4d2a937246e4c53e5400ea94f02f5e82ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847074, "uuid": "9a005bc4-8180-41a2-8c62-2c44924c28d6", "comment": "Malware payload (AgentTesla)", "value": "c38cc01d0831beb3b6218edc8ffd40acfefd12e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847074, "uuid": "197344f9-881f-4395-a7d4-6ed27e731b7f", "comment": "Malware payload (AgentTesla)", "value": "6457972221a9b1e4c939446498797d6678e60dbd5f0f7402d74b41c51786435928836655dd0d93440f93b6b2a4d1336c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847074, "uuid": "cb13586b-90f8-4db1-bde5-02df03111e0d", "value": "T1F8E4335FE42133AA6F6BA63E55A524B7C562B0FF13C20F4C400EB609F94065D272A78F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847074, "uuid": "74ea390d-2fcb-4510-9ce1-7770e7052af7", "value": "12288:FAxYPK6QYJmLc2ce9el8BZEXae8dW528cFv15z342QNtblBO04Q2:CGH/c9eiBZy98g52Nv7zuxU04Q2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626847074, "uuid": "630a79fe-cfcf-4ec9-9ed8-6d4fece4e84b", "value": 721797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626847074, "uuid": "e0b776e8-73c8-4cf7-8eba-d6fea7fb8e80", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847074, "uuid": "296d1a75-7eba-41be-b1c4-758ff611dfea", "value": "Released Order.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e55771-ea1b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626868848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626868848, "uuid": "f13b9012-233b-44bb-b66d-c34ec1401486", "comment": "Malware payload (AgentTesla)", "value": "804e57daab03cd25a9733df39ef099b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626868848, "uuid": "ba659456-b530-49db-8de3-b17e7ea64a4a", "comment": "Malware payload (AgentTesla)", "value": "8bf1fcc1eb1d892741e1651e50c125548dd45272d568987db84932d7937b197c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626868848, "uuid": "071ef9e4-c80b-4a5c-b00e-35da5b068de9", "comment": "Malware payload (AgentTesla)", "value": "d024bd4c7a11059b2295d635eb88f0f54e516f2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626868848, "uuid": "991176cb-77c5-41e6-82a0-44cc8b771427", "comment": "Malware payload (AgentTesla)", "value": "0ed026082338ec0e0aaffef679171e83c2df1c4aa27d2fd407736a5f177b8a97ab081f0dac7b3dde0af2fed2ff0e002f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626868848, "uuid": "7df85003-9691-4f79-a616-d9c589b8c98f", "value": "T153E4E1797227A348DC74CBF91C79E1E26BBEA029256DC63C1E84D07DBD727781AC0942", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626868848, "uuid": "05dc6c2a-2eb0-4021-8f1f-b66d8efa70cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626868848, "uuid": "4cf806dc-18b1-4d98-96cd-7edf45d7cac3", "value": "12288:yE/KwyvUIZbVuzp8EQwNXoWne83l8g37k9FQ:XK/vDBuzprrNXoWeI8g373", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626868848, "uuid": "6b84880b-fc32-468a-889e-d6ba7396b0f6", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626868848, "uuid": "d19798f2-d741-49ff-9ce9-f371a782f5f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626868848, "uuid": "b0fb187e-18bc-4761-bc95-c4ebb66ac27b", "value": "TT - EUR 56124, EUR 123543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51715168-e9bb-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626827629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626827629, "uuid": "51cf1da4-ec9e-490d-8ca8-546669b73406", "comment": "Malware payload (Smoke Loader)", "value": "3eef52f6fbd66e5349726b0650276a38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626827629, "uuid": "52ad333c-b877-429a-9ac9-cb9a76cb533c", "comment": "Malware payload (Smoke Loader)", "value": "8f27a981e44cc3595009f7e78dde8ed1a13f1404b266d8277dab71237384d2a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626827629, "uuid": "7e9ae72b-a4ea-4a21-85a1-803bff7f72e2", "comment": "Malware payload (Smoke Loader)", "value": "6d3229bdc650789a7f1959a0a7dc5d0fa3be81f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626827629, "uuid": "b197236c-1517-4244-bda9-6563ea1d8f25", "comment": "Malware payload (Smoke Loader)", "value": "24551beebb8c63958da5d54eca6ef07fc24f537ce8db407dcd76000be0a3af188d5cd8df88f5452f1f98f3f022a7948c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626827629, "uuid": "83d27658-9650-49a7-86ea-852277a6da62", "value": "T1D7149D5075E1C832E7A60A31D8F6D2E5263EBC625D28444B72803BDF6E713D299BE353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626827629, "uuid": "59dcd129-b47f-4015-8c78-d03e1f1c668e", "value": "b0fe27671bb60a5d31189716fdcf7690", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626827629, "uuid": "b38b467c-25b9-4424-8ddf-b7be977e5127", "value": "3072:rQHXGjTYyTtzrSWvRLJDwXvgDylRsubL1u:SGtLyX4DylRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626827629, "uuid": "d14e5441-f7f5-4329-a0d5-718d98bddbc7", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626827629, "uuid": "d1a2153d-e238-4f49-95be-8a792ca24764", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626827629, "uuid": "7cb869d0-8c37-40cc-b237-082ac7e53361", "value": "3eef52f6fbd66e5349726b0650276a38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05c008c-ea0b-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626862256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626862256, "uuid": "e6f743ab-4cd1-4cee-98e6-1048737db1c5", "comment": "Malware payload (NanoCore)", "value": "a854bd1a3ff6d359a5e2e76154892444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626862256, "uuid": "b99d7183-b5e4-4af8-9e7f-67142c0d06d9", "comment": "Malware payload (NanoCore)", "value": "8fb35304f24a6348adbd96f2ece69cdc23aa2442cfe28ca910ee31b48fd43632", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626862256, "uuid": "3d005fbd-1d41-457e-a15e-1cc5e24ab3d0", "comment": "Malware payload (NanoCore)", "value": "b8de8cb81adbb8cc5456a2100ffd3502548b0c2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626862256, "uuid": "f2139dcd-1e0d-4e0f-832f-4c9eff6376c5", "comment": "Malware payload (NanoCore)", "value": "1dadc3de09979f6f241b7265d4393e117a4695930e0611785f8e5c6148f02ccf02856f36271342b530fa54ca615da4bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626862256, "uuid": "05fb270b-2fbf-4fdc-ad9c-36e883d71e63", "value": "T1A1F3CF587FC98621DBFF1AFC5865224947B4F263EA03E35F48A420BB18627D18B153E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626862256, "uuid": "e2d263fe-9407-4203-9199-f5f01fa0ce2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626862256, "uuid": "21f7943f-518c-42cb-8385-1677a493de61", "value": "3072:2JEZzJZ5WY+apEbTmFxjpcJslEjqZ4UHtbrObVeHCtEGMyVuz5rMRyJJG+pXSPLE:HZT5TbjiJslEjqZ4UHtbYVehjauz5+Ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626862256, "uuid": "6512c92d-50d6-4880-969c-8394de690b71", "value": 160768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626862256, "uuid": "5081c867-20e6-4294-98b8-eecc48989ba8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626862256, "uuid": "ff1c1c40-9989-499d-9646-a928a8388dc9", "value": "a854bd1a3ff6d359a5e2e76154892444.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc6cb26-ea34-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626879643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879643, "uuid": "c1515490-a0ac-4fed-88e6-24fc1c046a2a", "comment": "Malware payload (Dridex)", "value": "b24e46b73441f06294548c8dcfea1b9a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879643, "uuid": "dde88ee3-342e-4fc9-a0ec-e4cfecdc6996", "comment": "Malware payload (Dridex)", "value": "8fffaedc7f8f3a6c84be5cd0e21ea9a3bc9c4b0700937f6b529a1d861f326710", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879643, "uuid": "567e5617-f6d7-4c60-af86-746f0563ebf2", "comment": "Malware payload (Dridex)", "value": "9a1324e66fd2a6927fad5ca60d6fb87de3ccfd20", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879643, "uuid": "6b61d293-6477-4c89-8896-ef19cca0b000", "comment": "Malware payload (Dridex)", "value": "f9023c01160dd21244b35f8e5041151bc89ecfceadd0d1199b56635d8dd399c42969ee72b66644eeef377325ea625f49", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879643, "uuid": "5d3573c9-c000-48f0-93bc-4e0104d29544", "value": "T1F3E449C5EBE1C92FFBD1957A0C564630227CCC4056804B973256F33AB72B97C8E9A2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879643, "uuid": "4ce34fa9-5e87-4010-baf3-8dea71357413", "value": "12288:dGDH3roxGMC/mc4bl3q5uaFsvCgdz2l5MjavMmIf+Gn4:dGDXEUH/4EnsvJZ2lKjavMm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626879643, "uuid": "26c98d2f-efb3-4475-88e6-d41cead7e38b", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626879643, "uuid": "7404afdf-3bb1-4671-be67-86e4cab104f3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879643, "uuid": "420ff384-35f3-4a9a-8038-b0daacfecb54", "value": "b24e46b73441f06294548c8dcfea1b9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85cf438-ea59-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626895743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895743, "uuid": "efc4acdd-59cf-4705-a87d-1f168d576367", "comment": "Malware payload", "value": "774c9db0d6227c94806074555e42db67", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895743, "uuid": "e4a1610d-87c1-4883-9c3b-e7df7de4e929", "comment": "Malware payload", "value": "9173221a937cf1ef14a7fcb5ee89c87162aaf60b6b901405827f43b1871d693b", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895743, "uuid": "462aa458-7afb-424f-a861-516943af717e", "comment": "Malware payload", "value": "071a3ce6e2fc5e2088bed0ad8bacb6ba71ab31ce", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895743, "uuid": "69339f5a-f96d-46b7-8e52-a49f77933f7a", "comment": "Malware payload", "value": "cd804dfb21002e430520067285f66c3a55993fa8687ac3a12ba78ef6f1ad24b4088d1158f8a771956b961c7f4e21b842", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895743, "uuid": "e80dab69-88fd-43d7-bfeb-4faa434fa6a9", "value": "T15F83D84789059F93E468D3B8BF035AAD5B593E1CE4823AFF15560E9B3B713221D8E02D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895743, "uuid": "4c49bbb4-c0ba-46e9-bebf-79d426a66149", "value": "1536:6JxWDP0pUnHyVPoDTQbQmZ+/ohZlgO348NgltL6v6hCbP+:OUoU0QmZMalBoRNC6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626895743, "uuid": "296f610b-0a69-44af-a1da-7be9763b3bfa", "value": 87309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626895743, "uuid": "9ed529d3-bfa6-4a3c-aec3-a58849ac6f73", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895743, "uuid": "b81acdb0-ed8a-4118-898f-5c94c454565d", "value": "9173221a937cf1ef14a7fcb5ee89c87162aaf60b6b901405827f43b1871d693b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140e923c-ea66-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626900970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900970, "uuid": "ee0ae4bc-ff0f-4449-8c1e-7cd612dafcca", "comment": "Malware payload (RedLineStealer)", "value": "7ed02ca6683bae4874c4c904866f2e96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900970, "uuid": "899e18d6-650b-4df8-a375-d8a9b7ce0c88", "comment": "Malware payload (RedLineStealer)", "value": "926d1980fcca74794210a126faebacadeeb1b81a328f1d382531945b703f8aae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900970, "uuid": "7063fa18-afb3-4c55-ae34-ec7eef83a351", "comment": "Malware payload (RedLineStealer)", "value": "b3ab594e008a7507a3b5b103de156c27e1ecdbbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900970, "uuid": "c9cebd24-b025-47b6-a88b-473a7c5eaca6", "comment": "Malware payload (RedLineStealer)", "value": "2166c15a8c2e55003cd0e3cfd8ec4276a49120c717c56c665e67d6f9457c1379f158fcab5632b0f59f3d551b43daadee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900970, "uuid": "db79be3a-c265-4f8b-84fa-b714b228f94a", "value": "T15C453397264E8101C65C76F364DDE89A2F24F750ADD53BB0934309ADCF8C686F9B270A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900970, "uuid": "efda6630-c8e7-4c8d-ad09-64fd117b92c0", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900970, "uuid": "799193a4-165e-4b82-a5fc-a0f0640a207e", "value": "24576:pXulNHDOADSqdlwLiI/Jr//VnY8IZPECKC0EQFbH3tNzvL3tHiDGYberXkk:pGjbXdlwZ/1/ZWNWh3tNzvL3/Nr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626900970, "uuid": "ffa40fb4-ac12-43b6-b9db-2c8c35044eda", "value": 1186304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626900970, "uuid": "9916b8e1-6a31-489d-8a12-42f11687a98f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900970, "uuid": "acfb7feb-0a95-473c-aab2-d2b2f4b23e15", "value": "7ED02CA6683BAE4874C4C904866F2E96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780680f3-e9e1-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626844015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626844015, "uuid": "afd25383-6b7d-41cb-a403-85c8934e7fdb", "comment": "Malware payload (RaccoonStealer)", "value": "a370aa7a71e6b5c129ba1dc32a6ca286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626844015, "uuid": "b3befe4d-f5e0-42f9-953c-7ecc1bfc501e", "comment": "Malware payload (RaccoonStealer)", "value": "9410954bb76886dada322d042c540ae8bd49dbd398e2449464bd0cc55cfde7af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626844015, "uuid": "f2e2c981-197a-4e76-afbc-14a4476d271b", "comment": "Malware payload (RaccoonStealer)", "value": "1c3b6e1d1a1edbaafbb7545ebb450ec6fc651cf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626844015, "uuid": "ea39b125-4900-4a0d-9b88-dffc97142a9c", "comment": "Malware payload (RaccoonStealer)", "value": "bf6a980cc09c224f18b669eede99c5e42edc4669e05763e764ba2508bf432bb2c0448fb03dc850c216fd4faacb30c6d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626844015, "uuid": "29be5794-e49b-460e-9e0e-d9ac392073fe", "value": "T1FFA40240B5D1C432D6A6093268F7D695663FFCA22E38524F7A8037CF6A712D298BD313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626844015, "uuid": "7038eca8-12de-4cb4-8271-29ea950ff5dc", "value": "213ce6a72c39868a010970b448621618", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626844015, "uuid": "2fed42be-bc9b-40ee-8c55-4ff8622a26d9", "value": "6144:KHHztSOG7qLUfpGrPd7/k4gfa2f8LWP8iNQkjpjWstpLyXYplmo:gHIOqqLUfpGBzknfa2fIsNdW0yu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626844015, "uuid": "a2702b5b-33bd-4efb-8bfd-267b86acc988", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626844015, "uuid": "442d0445-bf4a-4d44-9cd3-5a1d4ae799ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626844015, "uuid": "dc8f98e8-f375-490e-9494-82c0c3b6efae", "value": "a370aa7a71e6b5c129ba1dc32a6ca286.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534b96aa-e9fe-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626856409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856409, "uuid": "ca600cf4-13c4-4821-84b9-d59c9ae1e819", "comment": "Malware payload", "value": "3447df88de7128bdc34942334b2fab98", "object_relation": "md5", "Tag": [ { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856409, "uuid": "311e5483-c986-4bd5-9599-51f9701fe8a6", "comment": "Malware payload", "value": "9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9", "object_relation": "sha256", "Tag": [ { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856409, "uuid": "0c088cd8-0409-41aa-a8a7-f109c462aeb6", "comment": "Malware payload", "value": "519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb", "object_relation": "sha1", "Tag": [ { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626856409, "uuid": "0e22db5e-a4ec-4dbd-960d-c6a83d38251e", "comment": "Malware payload", "value": "4800d01ab6786a0a28f6d07d0fded5ccefe327bb03f78576d7afa7a9cb6b5f48e05c25f694db13ccf4c59764ae7f07c1", "object_relation": "sha3-384", "Tag": [ { "name": "FilmoraWondershare", "colour": "#DCC975", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626856409, "uuid": "7f1d637b-de28-4bf7-9048-cb71b5c2f4f3", "value": "T1E841B516BA02D9C807030E834F4B39EE736DEB67257120691909BAC945A7269605F3EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626856409, "uuid": "3dd13dad-fe8c-401c-b774-23eeef36d61d", "value": "48:Nm9KncuG64du5pH6cagzU/CxzjTJfpKps7+k1P3V:vnkzGqYxzpf8pmPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626856409, "uuid": "90546eb5-e007-4590-a2b1-da26e9e67b7c", "value": 2034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626856409, "uuid": "c5687b83-5cd2-4183-bbd8-8471a826232f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626856409, "uuid": "f626fb9c-c537-42d1-9996-7643b95b9048", "value": "ready.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29d8002-ea2d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626876782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876782, "uuid": "5df32363-a4d8-4c45-bcd6-511a15cc6776", "comment": "Malware payload (AgentTesla)", "value": "eaa1f4efd2a0edbcc41ab0b9e4a99840", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876782, "uuid": "2e3343c1-e6e6-48ac-9a6d-0faefd112d94", "comment": "Malware payload (AgentTesla)", "value": "953cab6c980f9bc3659f02ed151114b9f9e2e7de186b45ef441c5687d62a142f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876782, "uuid": "e94770c2-c055-4fbe-b2c0-830d7cbea62b", "comment": "Malware payload (AgentTesla)", "value": "ebc1aab04b764dc1c8645d43df6e43d40e3cc37c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876782, "uuid": "d949a27c-af05-44eb-a4ea-5fa245e96fe1", "comment": "Malware payload (AgentTesla)", "value": "6ac61fafca0ee9bf35fb1e99deb1e2b3b6fee04f9c9e41e36928a091a7bdf9107301b66d71df145cd5d295fff7794770", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876782, "uuid": "ad960fca-dd91-422a-9175-b8539e4c3586", "value": "T1855512549B986E62F445D0B41C0F8C9A8FA05E9EBD6DC0BA1623F9E4753C6F28D4B370", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876782, "uuid": "fb56d83c-ba5a-4551-9aab-af44ad5921b6", "value": "24576:R1E8Si0GDZ+4bNVKOFVr8Kbuw502EpZN3MHdkihtU9XKqTTDpsZ:YQfZNbrhVY2Z02oZ96dk4U5KqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626876782, "uuid": "c84d716c-0e93-45e3-b9f1-1e7fa70f33d7", "value": 1313792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626876782, "uuid": "a65b17ce-31e9-42f4-82b1-46143633461b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876782, "uuid": "4be41c5a-e42f-4470-96a1-88e103dfec5c", "value": "Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a644d43c-ea54-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626893485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893485, "uuid": "03d4c888-ac15-43a6-b4da-c07bff9068c4", "comment": "Malware payload", "value": "cfe548dc022491004aca46e514179479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893485, "uuid": "641f1e06-0f5a-4c8a-9876-74e936a23e48", "comment": "Malware payload", "value": "960646ac3782c54649f7feabd562676d2c7ba0ccf76e6bb868f0570d1e42876e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893485, "uuid": "82b9102c-f06a-4e40-ad34-e74226de21d4", "comment": "Malware payload", "value": "127b938474e65a18cee4d0ec2c19ed175affa4d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893485, "uuid": "3099e8fc-881e-4f82-bfc9-70f2c71403f3", "comment": "Malware payload", "value": "4ea4a2f4ae267a3e7f8db83eafe9badd9949f4920c552c66e0d41733982a8f8518eadb8bc9fbc7df5f8317ec9d8e4adf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893485, "uuid": "3f42697d-41d5-4c46-8cd5-396ca8ea1672", "value": "T1AFA4E02C3480F4F6E0230179C9999665CAADB8247B2378E7E7C45EFA7F655C09A3431E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893485, "uuid": "de8a88be-3056-448c-8462-dee5bca1fd82", "value": "13012c7764c22db0eea00ae6b1458d85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893485, "uuid": "054fefd0-428d-462d-827f-cbf95bed6989", "value": "6144:ybRfnjXFr2KpL3bbHHjYXWOZcy8QGd37ci/fW6/gNXtlTF5yVNU5JhJDCyFE:UZr2oHHmjMd1W6/gNXtrkVQhJDrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626893485, "uuid": "fb345760-901e-41a3-8135-dfcd95e0c1cf", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626893485, "uuid": "065a6222-633f-42e3-b050-fce784880abe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893485, "uuid": "0bf9e7d6-84e5-4fdc-b524-4b512f98bccd", "value": "suntogether.png.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d7dd58-e9ec-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626848758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848758, "uuid": "961b1c28-77fb-40bd-bc64-bd556e1ee465", "comment": "Malware payload (AgentTesla)", "value": "faac549cb964350c5bb2ea12baa99976", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848758, "uuid": "e2b3e378-fe23-4538-9942-6a1044d4adae", "comment": "Malware payload (AgentTesla)", "value": "97edc538295883c8961dfe634c2ca52526197e0ecbdb1a3646ae6d7f4a52e37c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848758, "uuid": "256de4ca-248e-48ad-8d71-0e7cac891aa9", "comment": "Malware payload (AgentTesla)", "value": "5755b5bedc21f31113459f63270a5ac15a409621", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848758, "uuid": "eab3a658-7264-43b8-933f-78a0dbcf0f67", "comment": "Malware payload (AgentTesla)", "value": "412eafc1c42aa6ca541bc18b60809d90642df23a2cb3e1e3f1bb0e9aed4ec89c2fcf7e5cc987d22aae3ff2b4cbcc03be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848758, "uuid": "cfdfa564-20ff-420e-bcb3-c96edd4a1cca", "value": "T1EE4512D8FEB82779E9FA15F81A8F823220235E811141D622755E37EE1C762B447163BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848758, "uuid": "0075ebd2-7311-4fea-9aaf-6aed26996640", "value": "24576:CEqTPf0StOnSKDhnD8vW0QVr/439IqtDs1+XNt6+0cHIvSRd9iZ:Ch30StOnSqhn0Wr/mPq0++0cHI6RbiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626848758, "uuid": "37766014-063c-4825-8f33-525226b18baf", "value": 1244160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626848758, "uuid": "1a264b67-00b3-4cc6-aed2-dce48dcf977a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848758, "uuid": "dac58516-4920-4438-aadd-d22adb698ea0", "value": "BANKINV19072021LIMCA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b355cdf7-e9ba-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626827364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626827364, "uuid": "e6a5fc83-3843-40cd-bca5-f93a39832a72", "comment": "Malware payload (RedLineStealer)", "value": "4c8b20479e35b380a034faf7238f9ea2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626827364, "uuid": "420935fa-b90e-4e5f-bd59-3b56a747f830", "comment": "Malware payload (RedLineStealer)", "value": "9946d190d1959c1528763ea9d0c8bd9f3b8bb9af65078035609527e81e742302", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626827364, "uuid": "3df9c77c-04a5-4279-91b9-5073303638b5", "comment": "Malware payload (RedLineStealer)", "value": "4be4822b98e1a3cd339ec08625e4c8c33e08c114", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626827364, "uuid": "0930aa43-e773-47e8-a69e-c45c3018321f", "comment": "Malware payload (RedLineStealer)", "value": "5cdd92e3c6b5ec89b70c01a334eecbb49053790a1e7a6c5854c79b9c5ab7d5a3de51a6e5fb3b8527265b80c6bcd49534", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626827364, "uuid": "2eafe679-c2dd-47c2-8cbb-e2125fa66b0a", "value": "T1D535DF4238E03469D002DEBBA49516FB34911E433676B66D3FD432635A3DD83FDAC92A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626827364, "uuid": "9e00016b-4dbd-4281-8c39-3ba61fadddc7", "value": "a011f8d93026fd9f5e9442faeeff606d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626827364, "uuid": "db43a6f5-d556-4809-92ff-ad926dee65c7", "value": "24576:x7W7ob8mwnePfjhxyiUkLkjzfsFI+H9CW8:pqEPdnFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626827364, "uuid": "73226749-1259-4c9a-8d9d-54adab23238a", "value": 1089922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626827364, "uuid": "6d196b6a-5f23-458f-ba43-7d636339dd18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626827364, "uuid": "dc6bed70-8cde-4d01-ae26-0b2b83214a96", "value": "4c8b20479e35b380a034faf7238f9ea2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ff1e12-ea2d-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1626876630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876630, "uuid": "22848a87-781c-4266-bb1b-f200743d72f8", "comment": "Malware payload (FickerStealer)", "value": "24190cd699631d16521dfb588b2571a3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876630, "uuid": "7164d50c-9ce3-4061-83a1-867d25941aee", "comment": "Malware payload (FickerStealer)", "value": "99c4b9083ed613bc38904eec3e37d24d3ca092067ee54e373cc3c8d6339857a6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876630, "uuid": "92a09038-f741-4cd7-a9d1-dfadf1097411", "comment": "Malware payload (FickerStealer)", "value": "546a86929e82babd0ee6f970d7729e3bf6a14698", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876630, "uuid": "7a9c61bd-e6a4-4b0d-a979-4888130691e0", "comment": "Malware payload (FickerStealer)", "value": "715c62710fa3060ef0d7f7f80ddaddf8870a921eda36ed8a4fbcdb67dd0924957fe32651a915d868ea83047a99d4e2e0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876630, "uuid": "efbd1ec1-14a1-46a7-a4b9-1fad4cf0b0cd", "value": "T1AE34AE003286E872D6E712395F12E798579AB4701B3495CF7BE87A8F5F361E35A39302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876630, "uuid": "ad8134e5-0d1d-488f-b1e4-e124db5fe4eb", "value": "e0d44bd119699680e81a3d044dac2e46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876630, "uuid": "bc379a22-0ff5-4799-a718-9ba9e47e87b6", "value": "3072:NaB6VAs0MHXGRjH4a/aULqLJKy7ZzUTTzhKseYjgWK/WKLPJ+OY65D:NU6ZXshyfJKy9QDh7+hYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626876630, "uuid": "99148651-ecb2-4cc2-aaaf-1003d8f4ab32", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626876630, "uuid": "ab0fec7a-9db7-475b-84a1-8032b083ccb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876630, "uuid": "62ef7ad6-6f21-4804-82ad-53b60453bc20", "value": "123.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9608398-ea3d-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626883665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626883665, "uuid": "be27396a-2985-4976-a0ab-dcae01cea563", "comment": "Malware payload (NanoCore)", "value": "39121091956f8934b1c73041ee1cc90f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626883665, "uuid": "31ee9310-a059-4679-916f-655bf4ebac0e", "comment": "Malware payload (NanoCore)", "value": "9a2247160056d9a5de43a34672b7e1650402a8ec6f435f1ef0d07a5347907404", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626883665, "uuid": "19fb9011-504a-4bd2-9b03-e0735769bb66", "comment": "Malware payload (NanoCore)", "value": "2d63ef96343bd4636ced243f81ce9cc361b28f74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626883665, "uuid": "0cefa374-b49b-4baf-98e1-a50efa969792", "comment": "Malware payload (NanoCore)", "value": "392f7055c2dba58dae8d7b74dfa3f7871cd2a004a58a595fae59bb1e476b0bec9f06f37787e8160e29a648fd2f4373df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626883665, "uuid": "1aa098f2-e8f8-4630-a925-7161dfb51a91", "value": "T139A402563BB9492FE1EE81BC61120242873AC2E7A8D3F7CE48D454B78E5B7E10A471D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626883665, "uuid": "4fc97854-1df2-4f78-818c-f37744ab9d66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626883665, "uuid": "7c1c29e1-aaa1-42a5-a2c2-0108dc9ca4a0", "value": "12288:MLV6BtpmkSYu1kSk63qiwi1kdENzqCm1zTZsiqx60HidcAEx43y:+ApfSYu+r6YSkdE5mFTZ+Hq243y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626883665, "uuid": "71d7cbf6-a224-4abf-90ad-15d3817888be", "value": 486400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626883665, "uuid": "c18e0cac-1366-46d5-a81e-e1b1e6383559", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626883665, "uuid": "f80f40b5-8ca5-4e46-965f-32f041d26b51", "value": "yMI7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abdbf70d-e9f5-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1626852692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626852692, "uuid": "ccd1dc81-4eb0-462d-ac09-007d3ab8f684", "comment": "Malware payload (NetWire)", "value": "587f6655380282c9fb7997fa2225438e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626852692, "uuid": "0754fac9-3739-4f16-863c-bdf3b78cbea6", "comment": "Malware payload (NetWire)", "value": "9add495b9373ca17ea4f158da84a200f3d5a52ce81bc535a575a5eac31bd76bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626852692, "uuid": "a4f15ca1-1b0b-4acb-b12a-cb46ffe0c421", "comment": "Malware payload (NetWire)", "value": "5b45eb58ef1d1cd93df0ecfc7b4124644515e93c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626852692, "uuid": "3233dbed-73bb-400f-ad80-c62e8aae7988", "comment": "Malware payload (NetWire)", "value": "4f545bcc145eeb8289a6b7919581942e48a9d8a1f1ce78cae69dd2ab6ebc80ad15eeeb82f232883abf9fb89fa35d1a61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626852692, "uuid": "ce99f52e-3dd0-4c79-8f75-63ba7eaa56bd", "value": "T17505AC3810A84BA7D67AA3B3C165A354EFF05D527250ED1A0ED3F9C32E22742198ED5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626852692, "uuid": "7709c151-2aa6-4a92-92db-961dcd0a97df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626852692, "uuid": "d8431896-c064-4c05-ae5d-1ab28c60d518", "value": "24576:4rtm2RrO4+yOBmHXDVRj7PDUnnj2iMhLsFhfp2+:4I2iyZHzVRDUnrkOhfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626852692, "uuid": "8d4b87d2-8416-4743-96c5-f45c5963d115", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626852692, "uuid": "b0241230-0860-4b30-8832-5e34e611fe8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626852692, "uuid": "860db60b-88f0-4721-b6b6-b8a4a10a23a4", "value": "order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a26b11-ea60-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626898745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898745, "uuid": "14c149f6-3485-4f4e-9ffd-2f3b93c58ae5", "comment": "Malware payload", "value": "0b2f7083ce53cfa4fdd59ebeb6cc52a7", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898745, "uuid": "908a89ec-3ca3-4858-802d-5ebc61d01cb8", "comment": "Malware payload", "value": "9af4d082d528b08891e09cce9fb40a66f8414f6e2a71bf2e90a721262584b169", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898745, "uuid": "3a6e39f8-8282-4387-bd4e-e05feaacd60f", "comment": "Malware payload", "value": "07a8b1eaf77b6b4b77cca8933678b3bd807d6d4b", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898745, "uuid": "0b95389e-10b9-4709-9da0-8296a3f18880", "comment": "Malware payload", "value": "651f97dbfa8fd4f42f050c5a8eed1bb7bdb0f16ca53b79e83e54e95ec6001a74c170ee8cfc41ba5fa1834ce2177d8136", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898745, "uuid": "05f8a44a-c806-4656-b0b6-dd93af339d2a", "value": "T1A1E459C1EBE1C92FEBD1957A0C564630127CCC4456804B973356F33AB72BA7C8E9A2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898745, "uuid": "220ec3b8-ac15-48da-8ea0-b149c3b4d0c5", "value": "12288:DGDH3roxGMC/mc4bl3q5uaFsvCgdz2l5MjavMmIf+Rj6UZj:DGDXEUH/4EnsvJZ2lKjavMm/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626898745, "uuid": "1ba069cd-f5b3-4a05-8244-a59a1f861e5d", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626898745, "uuid": "73f6579a-16eb-4bda-b66e-6db217fb3e9d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898745, "uuid": "387c22cb-ccca-4725-9cce-31c54bddc542", "value": "0b2f7083ce53cfa4fdd59ebeb6cc52a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "572a2ec6-ea4b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626889487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889487, "uuid": "627443b4-2987-450b-8111-ccd05e6248a7", "comment": "Malware payload (AgentTesla)", "value": "f744296570d39e6ddddbe45030d989f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889487, "uuid": "c1c9d746-1dd7-4b11-9b6d-a0bd69cd9581", "comment": "Malware payload (AgentTesla)", "value": "9b0fd69ae3566f372e59db7964a9186d570aebf499d89294be290bfba0248fa4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889487, "uuid": "ecc9b525-7cf9-4ab2-bf80-0b8c98b1bc48", "comment": "Malware payload (AgentTesla)", "value": "3c1caa09abe1c23ac8e4ee426bee7ab4b76a6c31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626889487, "uuid": "93e2dd95-56e9-4be5-8d14-f137b688aa9c", "comment": "Malware payload (AgentTesla)", "value": "cfd5c17b980b23e553f9812b4df45d153468c65917ee2531269414e470b6eb96a2ae019f88a02bc1d121f2214c933ee5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889487, "uuid": "4fa84024-d07d-4623-8472-ed383b92d7e0", "value": "T1E8355C91F1138999DC6AC6F36C2A953025A7BDDC7464830C5A99B7EA35B333120DFF0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889487, "uuid": "97ad9322-9ccc-4617-a095-9e91b5485727", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889487, "uuid": "9542fa43-44b7-4195-9bb6-0fd8437c6c36", "value": "24576:7mR5hdOBUEE1O72wfcYJy/5BX+OdeBKq8U+ahp:+UE1Oqw0t5BX+yeBK5UB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626889487, "uuid": "06044a91-b85d-4090-9bff-f0cfdcb3ae69", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626889487, "uuid": "7b6ba323-7032-4c89-b4fc-9818cc85a977", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626889487, "uuid": "7cbc7571-3de4-4e25-a529-1584ab35b9d9", "value": "f744296570d39e6ddddbe45030d989f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054c8ceb-ea23-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626872169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872169, "uuid": "d2d8d12f-fe0d-471e-bc86-b3be0a77e108", "comment": "Malware payload (RaccoonStealer)", "value": "7cb082ea00471e30b676fa9a8877967e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872169, "uuid": "52d4a840-16e1-4b0d-9a9c-07e1af72c0d4", "comment": "Malware payload (RaccoonStealer)", "value": "9c26a73079daf216cff436925d647e992acafff5ccc644d97424e1bf05797e44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872169, "uuid": "ff0af20d-4db6-499a-a5e1-4154ca6933b7", "comment": "Malware payload (RaccoonStealer)", "value": "7fd54e1f83e74a7ee3f62a73edb019d00b935d7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872169, "uuid": "1544d0e5-e974-40f7-b70e-ba0fc62ea605", "comment": "Malware payload (RaccoonStealer)", "value": "f9b25a5edac902342a68c8e80368ca3707acad99e24efa5d3821c799a999c00d25d2520bde8c9ade80920f08dcc4abb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872169, "uuid": "1a92792a-8141-4044-a7fd-58b40ae959e4", "value": "T14CB40180F6D0CD32D2B3083148F78795267FBC66697C8A4B66543ACF2E716C1A27E746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872169, "uuid": "1785caf4-a08e-495c-80a6-2bc075667076", "value": "90448e8f7733b3c6bdf5b48508246f5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872169, "uuid": "16e88767-3463-43bf-b386-dd8ae580a944", "value": "12288:wBdE11xr1VqNjDJf5k+MojUfzFDuOBdUEQRlyA6Lhm2ld:OdETx3wj1f++NjuzFZdfcy7Lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626872169, "uuid": "86b3a154-5fed-4d4e-bd9d-075bb3ddb35e", "value": 524800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626872169, "uuid": "606913ea-b322-484a-8831-65efd1f6d342", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872169, "uuid": "3ea7300e-17b7-4bee-91dc-e1242a2b5bb3", "value": "7cb082ea00471e30b676fa9a8877967e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5abccfe-ea2d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626876760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876760, "uuid": "4ffca67e-d7a4-46d2-901e-6b889c18faa5", "comment": "Malware payload (AgentTesla)", "value": "d51db0f037f97835cb334b38b4ce772f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876760, "uuid": "dd32cd57-0700-400e-a4e6-d413bd91e42d", "comment": "Malware payload (AgentTesla)", "value": "9eb87a2416b79b100ca24fa57d1bfa15fcce90a44f5cbb10353ed7e873394753", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876760, "uuid": "e94b5f68-6372-4b53-ad24-3d7559dae5e6", "comment": "Malware payload (AgentTesla)", "value": "ebdd88a747493385c96da530271e214df874f0ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876760, "uuid": "d68afaf7-ad0e-434e-9647-2b05941ca5ce", "comment": "Malware payload (AgentTesla)", "value": "b29ed4eb8f81e11a8698c194f6a78856baa83e1741ec6b29c4a6fbb1dc863d50240ee12e03cb36b1f1387d342f315c2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876760, "uuid": "b9b3ccf4-668e-45be-837b-c1b28bf16df3", "value": "T160813B31DB800841EEB90DF6F165FC14858BF1A14ADBA8C275BCF5F1177E3530996945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876760, "uuid": "6ebc8d32-0b89-41cd-82a5-cf0617203849", "value": "96:P3fL2G6FFBrDQhPtkIL71Sv742klvSxMRbWJM93t:ff6G6rBrDa6I3sTSQkWJM9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626876760, "uuid": "01ce83d0-2008-4164-bb24-3437870622b4", "value": 4178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626876760, "uuid": "96815a29-b83e-4107-9d3d-c43987ecdca6", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876760, "uuid": "fc092a01-25b0-4edb-bfba-6fa9b23e3bef", "value": "RFQ Ranger Neo.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83df75a5-ea62-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626899440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899440, "uuid": "3945565f-b5f4-4add-94f8-10fb37563b19", "comment": "Malware payload", "value": "0340ceae3de84b3968aee6c555fda030", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899440, "uuid": "cf970e25-c840-41a1-bd60-ce9c036b2744", "comment": "Malware payload", "value": "9f1ca49e69173b3b5df37bbb48f17ce6ad857f4acbb0261f3306c9b1d2232d19", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899440, "uuid": "c86fce8d-6ef6-407a-80a0-1509314e34de", "comment": "Malware payload", "value": "4949b8bcd99410bd26c3a2daef7284c39491fe66", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899440, "uuid": "66d8da9a-debd-4fcb-86e3-93410b9f2e0c", "comment": "Malware payload", "value": "2d27ccebc9aa133e76481a7ed770fd1041707d2eaf0171a8fc721528270a2cf28478e43ce0105b51ce1ad3a3868d0e69", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626899440, "uuid": "53f7f380-180b-4a55-8e8e-f17542d5f2bb", "value": "T1A1645ED5EBE1C92FEBD0D53A0C561630527CCC449A900B977259F33AB72BA3C8E851E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626899440, "uuid": "575f5a58-3d63-4fa4-bb01-4c1ffd4751dc", "value": "6144:90Y35qAOJl/YrLYz+WrNhZF+E+W2RGt8PjKBbA2G0VeU+fMGM1CB6iNmykZ3:VjwbA2EfK15Y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626899440, "uuid": "feb40d28-2719-4cfa-b3da-c6953add465a", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626899440, "uuid": "45dd1d22-0ba7-4d64-887e-413bf3497d5e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626899440, "uuid": "7b74165b-1f93-419b-abb6-470ee3d93eb9", "value": "0340ceae3de84b3968aee6c555fda030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98524cc3-ea34-11eb-875b-42010a9c0053", "comment": "Malware payload (RevCodeRAT)", "timestamp": 1626879717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879717, "uuid": "afd0fc5c-7665-4452-87e6-8ccd780dd7d9", "comment": "Malware payload (RevCodeRAT)", "value": "5a8d1d3a2b27e6564c18c7698a28ffe1", "object_relation": "md5", "Tag": [ { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879717, "uuid": "fff67524-5949-4129-b64a-6db7024f2b16", "comment": "Malware payload (RevCodeRAT)", "value": "9f5ced3aea0eb492bcff76b6ef9bf24f08dd17690e243c4c5afdb35b80ecc101", "object_relation": "sha256", "Tag": [ { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879717, "uuid": "7f566b40-01a9-4a48-8291-cd3f8047d73e", "comment": "Malware payload (RevCodeRAT)", "value": "9aa247845733b7679336a7e99bf547b36be8098f", "object_relation": "sha1", "Tag": [ { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879717, "uuid": "021f56c2-b524-4ac8-8368-eae2fd3078a8", "comment": "Malware payload (RevCodeRAT)", "value": "3b822413780db680a02dd9c1037840499daf53e796e71d6926d6ca0f7c7e1ade47485f2f6c5d6a47e7dd9b7ad1586c7a", "object_relation": "sha3-384", "Tag": [ { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879717, "uuid": "fe76145d-5837-48c5-aaa3-421ad570e3bd", "value": "T19E65331F7A0FD67C309522382817A1F9E2CB9CEF21886C797ABC9C973124514685DEF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879717, "uuid": "0111f4dc-9769-4bff-9af2-693f37e52783", "value": "24576:Q78wmRnyrx4nI25Pz2UkqbJSUb2Pcv5WcKnKF/QZRaDdvME1QdTgsWx7i:g8SranI8PlJX8n6YmdkMmmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626879717, "uuid": "5499c433-5cb9-4e50-b21a-ec3a74d4f96d", "value": 1429596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626879717, "uuid": "00e7abc0-32ec-4ab5-8ab2-65c2e03e001a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879717, "uuid": "0f705fda-65bc-4a5d-8803-e0a80751b385", "value": "FILE_2932NH_9923.UUE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868d6fc9-ea72-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626906316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906316, "uuid": "9c9fd93e-cac9-4129-ae3f-7e1bd0046d94", "comment": "Malware payload (Mirai)", "value": "2b3142a11e34f73366c399a6d273f943", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906316, "uuid": "49c4c7d8-779e-416e-9c47-8a82af9d526d", "comment": "Malware payload (Mirai)", "value": "9f850acfe26e19b4db99baf684a1f0c567d1e781193711072c9625f1ac0fef77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906316, "uuid": "44c7e2f6-f26f-436b-8f32-7b7b6a0de665", "comment": "Malware payload (Mirai)", "value": "ab3de42342dc7913d2dde23dfd2481cc3dbf8604", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906316, "uuid": "e84e1d17-6c86-46e7-98ec-5cd077d1a416", "comment": "Malware payload (Mirai)", "value": "e966fe54b0c973656c6ed9d6e732398e6c1fadfb5d35c5837193f4204b2acd287e56ed96499b1de799148c95370f570b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906316, "uuid": "40bb15c2-1b27-4410-8dc4-d91470461575", "value": "T19F6318C9BC128E3EF48AD67D40150E06B920A2D259C30F26AAABFDF37D32154BD97D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906316, "uuid": "cbbb6a03-0d80-49fb-ad7d-49a9e19e2428", "value": "1536:FPdSMiahSP3AF4WguXp8B2sUD5fxhjZmx:FPdSMH8bkJJxZ8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626906316, "uuid": "4f5acab6-7af3-44f8-aa36-0243f801a49d", "value": 67056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626906316, "uuid": "ba148235-8b1f-48cb-aa9d-2a575a581683", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906316, "uuid": "60684649-2fa7-4afd-98cc-73419f47edfa", "value": "2b3142a11e34f73366c399a6d273f943", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77eb815a-ea5c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626896843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896843, "uuid": "0714deb4-74b4-4b0f-a65c-3e986ed1c73e", "comment": "Malware payload (Mirai)", "value": "915940330455692aa921a68037131a4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896843, "uuid": "8d738711-e667-4558-8815-751425d2b5e2", "comment": "Malware payload (Mirai)", "value": "a046e3001d75a2230085d472032b8a86525451bc9bdb4d4cdf1efc748d4e24e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896843, "uuid": "9296c794-d6a7-473b-89ad-151c4b01b815", "comment": "Malware payload (Mirai)", "value": "43665959b48a49caf07e2fb1f70b09c205fe227f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896843, "uuid": "1c389912-69a3-401e-a6ab-cb09bf20a87b", "comment": "Malware payload (Mirai)", "value": "d8614c6bd4431e02f9db902931a226324348ca31a0812c6854517eee809a40e158d98de718650471a1dc48d6304f5917", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896843, "uuid": "f871966b-1c3b-45bf-95aa-c7938d7c2b9d", "value": "T1CC337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896843, "uuid": "07084650-d8f0-4150-b3c0-073728b19f1f", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCv3:jaQFwtOGBvQXxfs3kgCJt/qMF/RCv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626896843, "uuid": "76803cf7-80c4-494f-9c2f-f93afdcb7421", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626896843, "uuid": "5b087d27-c834-46e7-b59f-7bfca19b339c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896843, "uuid": "b43d3032-b480-4fa6-89ba-402d0297e0da", "value": "915940330455692aa921a68037131a4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380f02b1-ea25-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626873114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873114, "uuid": "fd65c8b4-ae25-4145-82cc-70b18cc77c5e", "comment": "Malware payload (AgentTesla)", "value": "6393d967302f542e074c717e44aa0650", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873114, "uuid": "46502c9b-4dda-4e96-87ac-0da227dee1ad", "comment": "Malware payload (AgentTesla)", "value": "a2f08d29bb884b329c3d0379d8c700622a913cefb97608ffee6e5dfd4513ede1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873114, "uuid": "19f4fd43-d445-4728-b6b7-430733eff5cd", "comment": "Malware payload (AgentTesla)", "value": "9d414bbf84e7c8d670f16e58cfeafa15a539b2bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873114, "uuid": "4184bee7-83e1-4af7-8c93-a0ba6f8f912d", "comment": "Malware payload (AgentTesla)", "value": "589c5e6ca42093108a8e284f6922848781aaa8615b072544c9d07fc9a69a52d2a13716e029d90afe65897ba8b000b084", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873114, "uuid": "cf55a7f7-21a6-44e0-b237-775e9f9541de", "value": "T12C15BD3814694B67D63996B3C564A301EFF05DA6B280DE4A8EC3F8C72E12743298DD1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873114, "uuid": "62bd343e-4ead-44e9-b503-77d4ba0cb898", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873114, "uuid": "cdf8afc3-49ee-400b-ba39-aca039861fdf", "value": "24576:3s2mdO4+y/weYfRORgseE0AMkBtFDjPAwxyq:3s2hyCfMese5AMkvFXAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626873114, "uuid": "7b60c5c6-c57e-43b3-9ac9-d0df801b5abb", "value": 910336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626873114, "uuid": "ba3998b0-3c5c-4999-ada7-2810b686d7d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873114, "uuid": "e0385cd2-fdc0-4870-8852-f6b8c70ba621", "value": "DEE Shah Sunil.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975d08c1-ea14-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626865972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626865972, "uuid": "e704a93e-71a1-4cf0-8900-1e14457e64fb", "comment": "Malware payload", "value": "b20bb7b590bf074dd359ae7c68e59f9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626865972, "uuid": "d978831b-bc4f-4ffe-9f52-bcf82b300f9f", "comment": "Malware payload", "value": "a35187b85ba3f94732f7ef554b0cd1cac6c4a143c14919d4f15d32584e2e619d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626865972, "uuid": "25a9ec9d-9e5f-41fe-b8f3-7d48566fd021", "comment": "Malware payload", "value": "222fd97745491168ddf0ad7a4b3e7be8fee5f203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626865972, "uuid": "18ba2b32-986d-4fef-bdfa-4ae94c8ecf19", "comment": "Malware payload", "value": "6231a8174498df6c30b8b09c81419078721023ae3e59f9721781b4bf6ef08fe96a1f51d66c9ecfeafbda130e40cd56ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626865972, "uuid": "7ad125b3-f20b-44d2-9370-fbdd98f0d21f", "value": "T10985330737105539E2434172EE79C25C4E3BFA643A34C41872ADB62EEF7A225DC8F699", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626865972, "uuid": "75bbfa27-4664-4fe4-9827-f37e93e7fb94", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626865972, "uuid": "1e9baadf-44a2-45d2-96e6-14496cea4ab6", "value": "49152:R9bKxz5eM8JvooqXrFzYA8hVU2AGm63yjpGIcLJjmbGpfcX:Pbm5eMOooqhomhjrcLNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626865972, "uuid": "8f5ecf55-2825-4e2d-92bc-72cb8aa606f4", "value": 1826776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626865972, "uuid": "7855a4a3-84dd-43fd-9e4e-63752df17d21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626865972, "uuid": "6ae78020-1c77-4c19-8f30-025b72b4e3b0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4812a694-e9d8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626840069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626840069, "uuid": "bbd557ba-aeb2-4f3c-9dcc-036887e8d8da", "comment": "Malware payload", "value": "6a97942ab346ee5bc24f391d5a97403d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626840069, "uuid": "35d1a728-6c28-4a5b-8b25-9409a86439cf", "comment": "Malware payload", "value": "a443699ca3ba8b1d592ff0dbd8ded80c160b37eaef9d0c92f8a6e1a252fcbb1b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626840069, "uuid": "6dacdfe6-a683-4841-98c9-f4d9d5c6e35b", "comment": "Malware payload", "value": "f2a22b58d0e37c09465c0ae49656387c2547e0da", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626840069, "uuid": "e1ab4c57-1838-4aa8-a2ce-ba836efb9c6d", "comment": "Malware payload", "value": "a250b25642f203c359ba1e3ccead15b56d5796d9512a23805cae45eef79db968e097c6fb86a8b15868c6bdcdd1bf4ce8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626840069, "uuid": "0b32957e-dd49-4f0c-9770-e8ed51fbe3dd", "value": "T1E7330685BC82865689D413BFF97D81CD331273B8D2DF7112CD145F18B6CA94F0E6AA92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626840069, "uuid": "e7bb8255-5183-4d41-b433-ffdec73ee985", "value": "1536:CMn12A//SrRftY97WARbIcbboW+zLsYtJ913Dhre:T2s/ITo7WCkybotgsJ913Dhre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626840069, "uuid": "d6a4929a-eedc-4e66-bdb6-5ed876f86228", "value": 52540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626840069, "uuid": "78c99eab-e5f4-4b51-99ab-dd7cbe6a7617", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626840069, "uuid": "d565fe8c-1f9a-4268-a35f-f7e4d2446b4f", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6d36f4-ea5a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626895965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895965, "uuid": "bd7bc801-9bf2-4783-b0d1-be95dd8892b2", "comment": "Malware payload (Dridex)", "value": "0b1a2653ee163b6138a01b38b8f6d22a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895965, "uuid": "80f318e2-0b76-41b1-ae91-4585875ecad6", "comment": "Malware payload (Dridex)", "value": "a51b5bab04a5b0f549dd27851e83550a47cd38abd109ee24bc1d96aae089d25c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895965, "uuid": "32e61342-d7b6-49c0-badb-e9ec25c3b063", "comment": "Malware payload (Dridex)", "value": "944b6ac504caed72bf2228b43830ac38ffec0221", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895965, "uuid": "8972601b-2fd4-4152-99ac-0a0db5709976", "comment": "Malware payload (Dridex)", "value": "1e143826bf113f8016a32a357adeca1a437beb79a878c4a03247dd9578376c76fd4ac497f8e96156c898edb31a35cc2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895965, "uuid": "d8e69c2e-f646-4445-addf-ceee635e093e", "value": "T1D204C0C9D2FA1786D4B1A67D1D84532BA4183C09CC35ED96C980CF5EEA3B204EB3675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895965, "uuid": "475fa72e-52d8-4ffc-9928-f5db7d6f1d97", "value": "44b0dcdef59120fe964e77dc09a5f1e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895965, "uuid": "c00edea9-4826-4873-bba9-36da14222dbd", "value": "3072:0bLeJIBwzBgXbJ26juQdZHT5K4PrsF2ATdwNBJUiG7NNNNNNNNNNNNNNNuTtbXkl:0/e2Gzm1dZtK4Puhha87NNNNNNNNNNNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626895965, "uuid": "cb8b7030-732e-4786-8e60-cdc9e226297f", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626895965, "uuid": "2bc35ea2-cefd-483c-b707-1151c65b4ece", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895965, "uuid": "74c5de7f-0dc3-4f87-ba0a-99d18585997f", "value": "0b1a2653ee163b6138a01b38b8f6d22a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b63f05-ea0f-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626863773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626863773, "uuid": "4173566e-95be-469b-a03f-49ce06868d2e", "comment": "Malware payload (NanoCore)", "value": "fb87d692632732ce29ecc8c5ae64f5cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626863773, "uuid": "2a2edded-e8ac-4f38-a438-4457d7b6ebc0", "comment": "Malware payload (NanoCore)", "value": "a5a3b625c48719d4e593435c16795b64d61d25bfeaf20fead77c6cac57241ba4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626863773, "uuid": "13f98960-d937-472c-bde3-b331d7ca8e58", "comment": "Malware payload (NanoCore)", "value": "f636d1dba447fd4f579fd4a85a3cc88062759a99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626863773, "uuid": "903c554b-a674-42b2-a529-3541fb1855f3", "comment": "Malware payload (NanoCore)", "value": "9866fe12297887efb5afdb2eed19bea5c9d3db2c796fe75642df38d3e7a76c6800cf49b3b999d0a7d7d80978d68c01cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626863773, "uuid": "84964f56-3c37-48bd-bd87-5fbbd9062359", "value": "T11615BD3844644B77D63997B3C664A301EFF05DA67640DE0A4E93F8C72E12B43298EE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626863773, "uuid": "663b6447-0799-4120-86df-9b78a2880cfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626863773, "uuid": "24d56017-7c98-4b68-af2f-c54440053965", "value": "24576:mT82zdO4+ysx5W8EtKQaa4Jx4NYDup307r:mY2WyCW8IdadS6o3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626863773, "uuid": "62b2b855-760b-42d8-b747-e40c762418d5", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626863773, "uuid": "3f1b00ce-f9ec-42de-8e39-3de213ff73dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626863773, "uuid": "6ac48921-ac9f-4461-bf01-0eb2d0736cea", "value": "Contact00212399490.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4571249-ea60-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626898770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898770, "uuid": "076589b3-0da8-47ee-900f-dd2baca0c599", "comment": "Malware payload (Mirai)", "value": "212b1ca90a0abc2383f2341524d91ca1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898770, "uuid": "5b36cbe0-ddc5-41fd-96a3-7252db200828", "comment": "Malware payload (Mirai)", "value": "a6da0d7b104efcf3fb09982606e07e35cb2246eb55be0a2e4c776fb85ab5dbe2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898770, "uuid": "28d64e72-7e76-4584-943d-a2ba5f71e973", "comment": "Malware payload (Mirai)", "value": "bba8f277ef7e7bae183c56622b3c5a10df235f3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898770, "uuid": "9eb18cb6-b91f-4f95-90e7-b220a808d81b", "comment": "Malware payload (Mirai)", "value": "33279d6f6be0766d1bd35c2bd15b1dac90f53c45ad0b909f07a2459ba9d4825755ddb934178a040d19182a0b1d77c0d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898770, "uuid": "3faecb45-6c5b-47d5-8414-ce60daf7c1ea", "value": "T1DEB2D019C0AE7EB4FEE77D355941E2C17B619FDF3A618DC05AC05A110622D282F98AE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898770, "uuid": "2895b6ed-efb9-43aa-b3bd-31d17e9340ce", "value": "384:2OA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIoRM4uVcqgw05VxJD:2AApCdvwJr69VJoA8FZtxCo8H4uVcqgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626898770, "uuid": "5dc07a9e-8c54-4281-af3d-14097ebb0c04", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626898770, "uuid": "515382bb-8f2f-4bc3-b2dc-de9f701d6221", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898770, "uuid": "47327527-543b-41c6-95ca-6af0866f07a8", "value": "212b1ca90a0abc2383f2341524d91ca1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785918cc-ea43-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626886106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886106, "uuid": "b7132a52-f0ee-4795-affc-a78dad63fbef", "comment": "Malware payload (AgentTesla)", "value": "55c3536c77824ed3bc196cbfac0cf9e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886106, "uuid": "cf8ea975-a5d5-4833-ae71-ef4bd2db8973", "comment": "Malware payload (AgentTesla)", "value": "a81929ab8bb97be21f16e196fece9dd7acec0d7104694af7fef823cb581df96f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886106, "uuid": "c8a4aaa4-e076-4709-9f8b-5e59c5aa126b", "comment": "Malware payload (AgentTesla)", "value": "776c9e482cc05f04c588e734241037ca702d2324", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886106, "uuid": "72d6da03-e1be-4360-a84e-dedc7af7ac26", "comment": "Malware payload (AgentTesla)", "value": "55c0e5d463ad100711557df6b0c1784b2b3f2c2c63a1113aea0b3ffcd90deaf62c72ec2fee56466bdf43befd7cf595a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626886106, "uuid": "c73303ff-801a-4273-a813-f097c23d45f4", "value": "T1D4E42316C1FD2718D744921318F2E3127D3E8BB2A55D67E1A0A1F20D6F64247F22E5EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626886106, "uuid": "c53db0a1-a11d-4081-a05a-4006cd7cf7b7", "value": "12288:VaEiTifhaKPB65fJrIDw6PyhfdYuHC4Ip0ndRQvFq13SM92EyZmra7pZl9etLmLb:nKifQKJ65RIDMh9Hw4dRAq13ZYEybXzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626886106, "uuid": "1767c4d6-fe52-478a-9b1a-3047a5c40720", "value": 700667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626886106, "uuid": "68c50700-25a9-49a5-a2fc-57a0fa57473c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626886106, "uuid": "6038c7dd-f4e4-4f32-8550-795e24345625", "value": "PAYMENT SLIP-6374484GD68.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3159bb53-ea68-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626901879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901879, "uuid": "04f4db24-ab5e-4e9b-90d4-8f7a6a0899ea", "comment": "Malware payload", "value": "0dd3173feb2aad3ff8ea4ec119a88640", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901879, "uuid": "95f6e5fe-bdcd-42e8-9a54-530ca3d4fea7", "comment": "Malware payload", "value": "a965c7ee5e32a7763ef8e666f12b96699cad180fdd1b8313afaf7177d61d2527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901879, "uuid": "243741a2-e0e4-40a5-99b9-7199aac3ae88", "comment": "Malware payload", "value": "a032af45d2222e34f19728207b7411a443eb8f72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901879, "uuid": "5b533f73-be13-4a0f-b4a5-2194661d96f9", "comment": "Malware payload", "value": "e274b5f5a5fd67c63a8d6de551df36dfc133ac51050528ea151d8d949ea96943840a9bdd618a7532b2118f9d5eb58197", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901879, "uuid": "2040ae53-a1d6-447c-ade4-13fffe886486", "value": "T1BDA29DAA99D1C82DD546AE3CC3305DF8134FBC39D72212AB085DBD85BEBE7938911918", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901879, "uuid": "a49a146a-fc36-486e-89e4-96d036efff7e", "value": "c713f802ddde9d556a486e8ee8e110bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901879, "uuid": "4e93fc94-8527-4a65-a838-64a3b0f1479a", "value": "384:o2FtAp1/TBoboMcZG4H8djUOoSOPxjs+9Xyyt:pF6SnPM8djUOoTP59b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626901879, "uuid": "35e05282-5af6-43d4-ac35-7793e6c54152", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626901879, "uuid": "531bb456-2db8-48c3-b4bf-5af618471ad0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901879, "uuid": "b106ba8d-ddcd-49fd-81bc-b1520f237558", "value": "skin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406922bf-ea34-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626879570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879570, "uuid": "3b180f74-42fa-4994-9bf8-cc2a6e3ecf00", "comment": "Malware payload (Loki)", "value": "c3412fee75b0f8758ea9905930ec2f34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879570, "uuid": "fbc8d427-8cf2-4b10-84cd-66a43be499ac", "comment": "Malware payload (Loki)", "value": "a978c99ada8c0272b0670865cdecc324d883304d54f2e90ea829891183b3aaa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879570, "uuid": "0a667a40-b04d-4c21-9b62-d619a846e999", "comment": "Malware payload (Loki)", "value": "e9245aba2ee62a7baffbccb725bca4bc0fd0302e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879570, "uuid": "ae1dbc93-7120-4310-a5df-3867e5429340", "comment": "Malware payload (Loki)", "value": "91b5eae57b447ad4a63fa89543afb62858fbbcb0fbfbc77626b517cee47e17d24d0073dcc895b6d30ef91e619e882f14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879570, "uuid": "40401742-f53c-4028-9db5-b29f94929c43", "value": "T197358D224DCE4667C2644AB7D330EE01DEF14DAA2544EE152EC2F0DB9D3729A94DED0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879570, "uuid": "3abbfbd6-6a32-452d-83bd-3aaad70e6260", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879570, "uuid": "7217d19b-6f9f-415d-8751-b8f164ab1356", "value": "12288:UKEH2DIJaP/GBvpov6pCoRlMRWO9fYOiXrDEr3aNhE58ZqTuwMpELFasSAFQipPG:89Bvpov6zsbfVi3E8+KfgFsip+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626879570, "uuid": "28d2189b-c88d-44e1-a1a0-fc65d68ccddb", "value": 1104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626879570, "uuid": "a4f72443-46d8-4600-8288-00bce60c4fe1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879570, "uuid": "65fe65fc-f18b-47c8-8270-439badac9186", "value": "Cotizaci\u00f3n.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924d5010-ea5f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626898176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898176, "uuid": "7131348c-de32-4b2e-b0d3-70e85ce8da03", "comment": "Malware payload (Mirai)", "value": "c3ddaeddfecb5da92f819e3d2fd1af80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898176, "uuid": "539f2854-3f2f-4cef-ba9b-1be5436a5def", "comment": "Malware payload (Mirai)", "value": "aa4de333656911405b2006678262a974abdeaabb06bf10228279e3bed0791c46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898176, "uuid": "32ea6ce9-de1f-4b24-b54e-125398bb6399", "comment": "Malware payload (Mirai)", "value": "1ab09e28c4dc8bf4acff8ef54476a8f00d906549", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898176, "uuid": "5d2a3de5-3842-437a-bbbb-41a127f7766e", "comment": "Malware payload (Mirai)", "value": "10cb67e85e52769dabdf754db8383517bcbfd9c937e93c11dc9b0ec1aba2c7c137796d3e3f1a17db537ac9521ab898a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898176, "uuid": "0f9957f3-81ba-49a7-aa2c-e27af98d01a8", "value": "T1A4332ADAB902AD7CF98BEABE80160E0AB23123541053073777EBFDD37E321549956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898176, "uuid": "d0ae0e4c-73a7-470a-8d7b-e5666562ad46", "value": "768:mLGOe2kf9e9X9nbermI7vc59QPQs5gFHviPuzWeHXpi2UJTpDnH638gY:mL/4f8F1ef0YgFvimzpZi2UJJnHY8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626898176, "uuid": "4bad5d84-af6e-473e-88dc-dc0a251b687f", "value": 53056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626898176, "uuid": "c8c3d832-bf95-475b-adb4-faac859d16a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898176, "uuid": "d4d4cff4-26da-499e-96c7-2837285cdb0b", "value": "c3ddaeddfecb5da92f819e3d2fd1af80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01321c29-ea53-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626892778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626892778, "uuid": "84e88a71-7c67-4411-aa95-5b9f4775c001", "comment": "Malware payload", "value": "8939f905920f2c23d01ae9dfd3ac653a", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626892778, "uuid": "afecf614-c27f-4b68-9e1e-4b7184754e00", "comment": "Malware payload", "value": "ac3cc428096079fe4572b77a4382eb28b48f7d30279adce3ba69a51f42fe1bd4", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626892778, "uuid": "069ccc16-2966-4a83-a6f6-1b18d361607a", "comment": "Malware payload", "value": "335533861fce1313371a79e8ff142dca7be77981", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626892778, "uuid": "e1882e19-1bf9-45e7-9016-749a4dd2de1e", "comment": "Malware payload", "value": "c08b67904567b2a61eea5a63e8ba6efc3cab4c1e678decd1e69dca9028696623ed27513458b8a59ad0658f139e962f44", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626892778, "uuid": "f0e21dd7-df86-4d93-a02f-e8dd0c861e57", "value": "T1CC646FD5EBE1C92FEBD0D53A0C564630527CCC4499900B977259F33AB72BA3C8E852E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626892778, "uuid": "84f80ce2-d80a-48d0-8ed7-2d556a3d5dd7", "value": "6144:c0Y35qAOJl/YrLYz+WrNhZF+E+W2RGtfPjKBbA2G0VeU+fMGMsrAFGQP:bjwbA2EfKEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626892778, "uuid": "85a8a320-0839-424d-9886-e9d659335b2e", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626892778, "uuid": "1daa3146-3db3-43ec-87ba-1678f660e5a8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626892778, "uuid": "b1894e02-7f6b-479a-b7a5-f5a70681d3d8", "value": "8939f905920f2c23d01ae9dfd3ac653a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f20c8d-ea2c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626876328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876328, "uuid": "001541da-3325-4cae-9050-db8fe0f44914", "comment": "Malware payload", "value": "8d4f45dd9a5b28f07fd1e3b1067de4b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876328, "uuid": "009d4f68-9f6d-45dd-b018-aa02c229d0a1", "comment": "Malware payload", "value": "ac4c2057efb4137e73e07b5f2706abbec548ba6c526d8fe12645e35c29345ad0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876328, "uuid": "ddfc4eff-b91b-48f8-9858-689eb0e6d543", "comment": "Malware payload", "value": "a26b4056669b0866d248e6c5a6a29de4f41314ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626876328, "uuid": "644cad4d-1f12-46e9-ae12-82571824afd8", "comment": "Malware payload", "value": "32940e16dda1fe42725d4c9b8a9748d70f403f26ae7516c4eb41f2a346bf5c3de9a0b13faa099b95d0608b636600fd90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876328, "uuid": "7d888583-1337-4c24-a531-41e0d051a549", "value": "T1B155BD75E4058C13CA2F993FC06A9310AFF45D523519CD8A16A7F5EB2E32792284DE8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876328, "uuid": "5608aa77-cf74-4001-b804-2c7ee8c500a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876328, "uuid": "96bd7193-f32e-48a8-a466-0f8c0267fca9", "value": "24576:uxKCe/hyO4+ytZAi8VF6/4QxJi8/8rCfbcTzGCEnWI4sgeZerKS:RhByUi8V0/FrkrCfbIdwDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626876328, "uuid": "0009a3c3-e5ce-4f3f-ba3e-e6fd2d81d2da", "value": 1399296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626876328, "uuid": "d05af378-6807-4262-9dde-f401b306f6bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626876328, "uuid": "310fde82-5a35-42ad-bd0f-2fe4ba60bbfa", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.EWM.genEldorado.30775.5137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3f64ee-e9e8-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626846973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846973, "uuid": "f32155ee-215b-45ff-ac5c-70f1b5724ab6", "comment": "Malware payload (Formbook)", "value": "4a179194869d7ac448630667c9d01307", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846973, "uuid": "0f0191b7-3623-4557-ae1e-e28e364714c6", "comment": "Malware payload (Formbook)", "value": "ac569d0ffa88503800f67906ffba34f7824578a486bc5b5a6538ab25126c4875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846973, "uuid": "45a96401-c4a5-4346-9be0-bf9fcb3edc7c", "comment": "Malware payload (Formbook)", "value": "c83a3dd1cb02458604fc58cfb10faf9005b4cbde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846973, "uuid": "ca97d9b8-0a0a-4ed5-b185-9fb4f168f8c3", "comment": "Malware payload (Formbook)", "value": "4e1c302f0ee0c43ed883a2895639d20cc9761daa5745e3b8e4578246c5bdfa0094a3f517950a589307a24d9d8c5c8f7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846973, "uuid": "e0acdbae-ebce-4982-adc0-ce85465ea4ef", "value": "T1CE357C61F307EA58EC2213B8D87AD8F12263BD5DD525892F358D7E2DB9B334190E2907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846973, "uuid": "afc39358-7e5a-4a82-b302-9c01a51c44c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846973, "uuid": "a5813ab1-3a44-4154-8643-543053595653", "value": "12288:yiKuA6tZwuKkZSteJwXmttolobe+c3XmV+YYnjZVk8tNM2gBa5m4wyaUVKnp:NTtSdk8tizIlM8GAhnFVn/MDa5pahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846973, "uuid": "b7360952-d58f-4b51-888c-efc596bb1671", "value": 1154560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846973, "uuid": "79c41de6-e67d-4cb0-b22f-729c69f602e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846973, "uuid": "6fc851e9-5c8e-4381-a2fc-a0589ea8ec06", "value": "Payment Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa94490d-e9f3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626851965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626851965, "uuid": "7fdc7e28-5aa9-46ed-a277-14f399908478", "comment": "Malware payload (AgentTesla)", "value": "44628cce21af0d4412f73b6462ba3b41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626851965, "uuid": "230cf3e2-2980-4402-9e6f-02a3740da9b5", "comment": "Malware payload (AgentTesla)", "value": "ac71d3b09be0391f9c8914777bc1d1e825f95850d5606cf19de05610f600068a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626851965, "uuid": "8a47e8e5-ca87-4d4a-9944-b017b6e6524f", "comment": "Malware payload (AgentTesla)", "value": "9bae9285c3e1f4e507dbc9126984a781ca160227", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626851965, "uuid": "cbc2a39c-d02a-4be6-a06d-8716f6ef7cf1", "comment": "Malware payload (AgentTesla)", "value": "bb2b49bfee54cc8bbe3bec6cec6db89958c5716372b1108efff8db292a9252fdd9ed0d717665ddf54e96e50f0de3e5a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626851965, "uuid": "ab4599df-9019-4369-a730-7fece077c859", "value": "T122C42313BB93689910E4EF7ABEF9510D6E5C761464968C4432EC0942C3B8E56FF2CE87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626851965, "uuid": "e6835340-f058-4f09-bdbf-0a3ea8bf0e48", "value": "12288:sXfWbtiF7YoYezMadgarwhT8m6kmfDKAyTOfACz06DSxNoP:SfWbtiFAezMGrwvdmfDKAyFCzF2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626851965, "uuid": "6efea2e9-f2d7-4f61-af5d-3d1c40359fb6", "value": 591899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626851965, "uuid": "619ce52c-0551-4544-9611-3eed9bf4ab58", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626851965, "uuid": "868a9477-6e2f-40d3-a68b-465ba6af0bdb", "value": "DHL SHIPPING INVOICE.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92d6041-e9ec-11eb-875b-42010a9c0053", "comment": "Malware payload (Loda)", "timestamp": 1626848849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848849, "uuid": "3a53ce7f-7096-4659-acb4-244c62f45cb8", "comment": "Malware payload (Loda)", "value": "dc14cd48169a1ab64074a09521fdcf1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848849, "uuid": "cdf6597d-f018-421d-93c0-e91e8269c12f", "comment": "Malware payload (Loda)", "value": "af842257a5720b2a587284626867caed0bbc03fbaf8163258eb52d36b053a428", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848849, "uuid": "ef439495-aa90-4295-8e29-b68612d7c518", "comment": "Malware payload (Loda)", "value": "fa0ba8699fde5e84c5295feeb8240fd31054f026", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848849, "uuid": "ed855256-06e7-46df-ab30-757765a2c98d", "comment": "Malware payload (Loda)", "value": "98d0273b6d021abd1d895be6a6847052ff2c19ae74ae525b2b5db0e34c0175584e040dddf5a1a5eabe1386b19cd649d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848849, "uuid": "24c37843-b64d-46d2-afeb-4d6a6a530b46", "value": "T12B35E121F5C68036C2B327B19E7EF7A99A3D69370336D19727C82D325EA05416B29733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848849, "uuid": "6f996d9b-ab21-4066-8035-74b81e1bae9a", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848849, "uuid": "ab25cda9-116b-46bf-abad-cf805d2148e4", "value": "24576:5RmJkcoQricOIQxiZY1iaqoBlHOWD3EKMFmihl5N1lC8R:WJZoQrbTFZY1iaqAOWrYTN1M8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626848849, "uuid": "e778af77-cd38-425d-8b44-6b71fd9415bb", "value": 1151847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626848849, "uuid": "7e67bac1-7d29-4462-9bdf-be90fb6dfd20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848849, "uuid": "568b59ba-c691-4364-ae6b-700f7fdc6379", "value": "2 ( P-O DRAWINGS ) SUPPLY PRODUCT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db18f57-ea62-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626899430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899430, "uuid": "d6807bb1-c3df-47b7-a1d5-30324ea20a58", "comment": "Malware payload", "value": "4ccde33da5102adc2990f49331e84b56", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899430, "uuid": "932b9709-f468-4d34-b741-f129390d4074", "comment": "Malware payload", "value": "af931881445f375b740f42f182c797e8267c576e36f3093b10a935744154df60", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899430, "uuid": "cf0624cc-d923-487b-8f34-ddebbd774712", "comment": "Malware payload", "value": "e7332faff1e87f6e0a939472b729b4fa23b08df1", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626899430, "uuid": "76c301c1-58aa-43f5-a556-f25d2bb91305", "comment": "Malware payload", "value": "c8d5dae7b0e9ef7ac88d2980b24348538c2b6bb8e6ed40dbd77647f3056e84c3a6f0bf33e5a70be952e352b9c2b2d9a5", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626899430, "uuid": "00bf6188-c0f7-48d7-84aa-0dd9ad85754c", "value": "T1F0E449C5EBE1C92FEBD1D57A0C564630227CCC4455804B973246F33AB72BA7C8E9A2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626899430, "uuid": "c6a4a47e-0d24-4909-bfa9-e844875d0c39", "value": "12288:CGDH3roxGMC/mc4bl3q5uaFsvCgdz2l5MjavMmIf+oM/z:CGDXEUH/4EnsvJZ2lKjavMm/oe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626899430, "uuid": "6f2eca59-96f5-4b3a-97f6-dd3d2221bd3f", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626899430, "uuid": "e8a721a0-57d6-4e2f-85f8-409c204c62cc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626899430, "uuid": "16bfe1b5-03c4-47c9-aba7-0dd895daea97", "value": "4ccde33da5102adc2990f49331e84b56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c760c62-ea5f-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626898166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898166, "uuid": "8de6c5c2-55d6-46eb-8acb-d55da2ebd277", "comment": "Malware payload (Dridex)", "value": "94b5a8d78982670fe04dfb37a9cdb81d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898166, "uuid": "b7ce2e52-03ca-40fc-8620-43712d55b0b1", "comment": "Malware payload (Dridex)", "value": "b09882743ed13b041f6b2693943533e4be1e9a5d7e17b701d978d3f4178b76a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898166, "uuid": "d78a8f91-3b49-4189-a304-b812c2850875", "comment": "Malware payload (Dridex)", "value": "62135e3f8d0cf8e09522c2f740920032767bf8fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898166, "uuid": "def8602d-4d06-466b-912d-6ae9a78b7d91", "comment": "Malware payload (Dridex)", "value": "a6f7dbf9923a26082bbe285038f4c9997f6552426c46c0a02965272233fa6977f7f86da00cd865491e686f5951c08487", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898166, "uuid": "ba3cd93f-e717-4bbc-9b2a-db65c84f121c", "value": "T14104C077AEDFC0B9F2A39470107437AB26F57A032419F491DA60C8DBF83D994A8A4753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898166, "uuid": "fd2412d4-2b5e-4166-8878-14846956f8ca", "value": "458d7355fbf070054838e3593829db8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898166, "uuid": "1785ea72-0b50-43fa-b5e3-2040331e5468", "value": "3072:jVadvfvemTEtQ9yoZPW/k/nklVtu77wBeZUCEQZRp3BDp57WQhdIif4:oDTyJWPd/nkdqw4/H3B77WQhdIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626898166, "uuid": "6ec1e8ba-9536-4512-8e58-9b4e02248b2f", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626898166, "uuid": "082d2faa-b888-4887-ab64-2e520a48a296", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898166, "uuid": "e04e7197-b86e-45e0-bdc4-283646c97fe8", "value": "94b5a8d78982670fe04dfb37a9cdb81d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf46384-ea52-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626892770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626892770, "uuid": "2b775218-51c9-41a6-9c7f-99f7330a7c4d", "comment": "Malware payload", "value": "f70c0885e76e57f37399d54b10f183ad", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626892770, "uuid": "8896964c-5e18-4d31-8eae-573a86a4b5fc", "comment": "Malware payload", "value": "b11c33ee5fd193e6548d14c2bde4865d30d6d5fd25135bc258cfd8595ae3695c", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626892770, "uuid": "c7c6f485-b92f-4745-a913-fef26e3870b4", "comment": "Malware payload", "value": "20548e3304d242789766edfe7c8c7d4e9ccd5b25", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626892770, "uuid": "4215632b-d6b8-4ffa-8da2-295a0aeccf44", "comment": "Malware payload", "value": "1fe7dc272623e0d51e68a7b811635afc021b38ac24085d280fdd466f2d45dd466f13d96cc898f489d3e3874220a026ca", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626892770, "uuid": "5f6f6fa3-fb7f-49e0-bfed-689e465c5104", "value": "T180645ED5EBE1C92FEBD0A53A0C564730527CCC4499900B977259F33AB72BA3C8E851E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626892770, "uuid": "c97b5580-617a-4e33-8b29-ea1ccddab720", "value": "6144:+0Y35qAOJl/YrLYz+WrNhZF+E+W2RGtXPjKBbA2G0VeU+fMGMf0ziEbMjy:1jwbA2EfKAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626892770, "uuid": "6d5f6147-285e-4464-a910-1c76408fe0a5", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626892770, "uuid": "339575dd-4d33-40d4-b77a-937083ec8d19", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626892770, "uuid": "33b6685f-54c7-4255-97f7-ae87a7fecc39", "value": "f70c0885e76e57f37399d54b10f183ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078fb8ae-ea79-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626909110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909110, "uuid": "2d9bbf3e-3732-4164-a2bc-647250659bf7", "comment": "Malware payload (Mirai)", "value": "8dfdc1b49125153c1bed6570796917c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909110, "uuid": "7a0ffb74-7c8c-4adc-a4e9-a572c0f286ca", "comment": "Malware payload (Mirai)", "value": "b23fdc8d6e654e106a2fc5db06ff12651818802a7ddcf59eebe07e6613bc152c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909110, "uuid": "797116d2-e6e4-4847-a742-e2aae83448a6", "comment": "Malware payload (Mirai)", "value": "8ca7cb862b313c7e64408c84b01c8204de504e4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909110, "uuid": "9e0dd204-e8b2-4d50-be15-4776f7d892eb", "comment": "Malware payload (Mirai)", "value": "4777bff13ebf08cb69df385f2af792ca257f2c781550913660d26e83eaa1503d25ecd581bda203f23f33f6b15bc90c03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909110, "uuid": "fa895407-1b4f-4a4f-8b69-81a684583f90", "value": "T1DB332956BCD19A2AC9D423BBBA2F10AD331173D8D2DF3617CC141B147ACA90E4EB7691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909110, "uuid": "8b4b2ef8-d157-4f5d-9013-1d47e53687d8", "value": "1536:yHZoYnknpldueZwoPRCaIWBb4l3uKaBG:y5oYHJoJCaI6U4KkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626909110, "uuid": "f03f7c4c-fd5f-4e55-8c6a-0695e670df79", "value": 50568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626909110, "uuid": "7a39757a-df68-4263-bda8-1fc038e4b4bb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909110, "uuid": "ea3f3bd4-9e7f-4236-aaf6-57cc6c54d160", "value": "8dfdc1b49125153c1bed6570796917c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa2a9d6-ea13-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626865602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626865602, "uuid": "297ef8f2-e6b4-4cd7-a954-3abb8ac8c27f", "comment": "Malware payload (Mirai)", "value": "5162b60cdf13c512ca847590cd44f880", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626865602, "uuid": "8f6660bb-6b96-4daf-92fd-1e8acdc1d915", "comment": "Malware payload (Mirai)", "value": "b378c1837eafb81d9c1d073f0ce7de5178a261a5046560be1159a2fb3b249620", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626865602, "uuid": "bb75d3b1-93f5-4327-9bc0-75bc84fdd62d", "comment": "Malware payload (Mirai)", "value": "d282ce06af2b117682667f0f92c32a2e4071d89e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626865602, "uuid": "1ed23e07-1828-4b51-bd86-29e782677904", "comment": "Malware payload (Mirai)", "value": "b1456e486c4440512cfa5ee58d61d08266f0426a7fe0768874a86eb17473e7353a3fe759800fffed7059b32c8fc4c1a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626865602, "uuid": "cadefc2d-4bb7-424c-b4ac-cc4492089547", "value": "T1A5430852BC818A16C6E0527AF92E85CE3B2123E8E2DF73079D211F6176CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626865602, "uuid": "6d07a929-4ce6-47c9-9c52-ca6f625b30fb", "value": "1536:Q64i29YzaK1r5mTPAzHcEe7A1suV27cChMDHs:Q6ia7dr1b27Jhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626865602, "uuid": "c22db704-90c8-4cdb-a846-012a7d4c0b57", "value": 60444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626865602, "uuid": "2cce58bf-0e08-4a47-96aa-62799ce9ca82", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626865602, "uuid": "94648a65-a2d3-41f4-8f61-f051536511cc", "value": "5162b60cdf13c512ca847590cd44f880", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a35500-e9e8-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1626846878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846878, "uuid": "c8c1cd9e-2447-4cf0-87ff-ad132cef02ff", "comment": "Malware payload (AsyncRAT)", "value": "37e88912d78796f79a431506384fda91", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846878, "uuid": "9c97b087-4f83-4757-8d1d-fdbf700d6331", "comment": "Malware payload (AsyncRAT)", "value": "b39e715fcfeac819e6d5d0707d02f10250b5029a78935ea1c34dd416f989e506", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846878, "uuid": "1beef066-12b4-4e2c-ab9a-429a51f17683", "comment": "Malware payload (AsyncRAT)", "value": "5cfbdfb2b4230eda5f210ff94bad58880a3a35b4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846878, "uuid": "78be4e77-6037-4dfb-8223-c3b839fc4f75", "comment": "Malware payload (AsyncRAT)", "value": "85bc071baab06ea69ee50348af273d2f8625a6d24ee80145853c9686e2bb044fb10528fb6b91c8135047d6d5ed27d682", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846878, "uuid": "324e6fd6-18db-4d02-b0cb-5924797c853b", "value": "T1CA255B61F307EA98EC2213F8D87AD8F12263BD59D525892F358D7E2DB9B334150E2907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846878, "uuid": "09af9a34-2575-4168-80a4-1e43ca312f34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846878, "uuid": "d8afca6b-556e-4d3c-91e7-ee791ced2235", "value": "12288:K+UfpoZwuKkZNTGe0ryHriHyyRUIV+f9eLK5aIn5yaUVKnp:apoSdkPTPHrTyL49laInUahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846878, "uuid": "eec72410-f726-4ee2-a2e9-84c6d95fadaf", "value": 999424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846878, "uuid": "79638b29-94a2-40e7-b468-53413d223803", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846878, "uuid": "71b40592-6998-4a20-8562-c65c5f8750f8", "value": "\u9600\u95e8\u548c\u6cf5\u53ca\u914d\u4ef6\u89c4\u683c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8af85d-ea34-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626879641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879641, "uuid": "9e71d6ad-befe-4df9-b6aa-9f1a0b9e5b3a", "comment": "Malware payload (AgentTesla)", "value": "13d3d8d9c655b799acce27ab6091847b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879641, "uuid": "34725c7c-214f-4d71-9335-38029738d95d", "comment": "Malware payload (AgentTesla)", "value": "b42810cd608efd9b6058c018518048874d453ed62663f8a1ac2a2c6f2227b0c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879641, "uuid": "4d0f4b9c-2f33-4ba6-aaa0-5f0df0f2aa44", "comment": "Malware payload (AgentTesla)", "value": "a6e4e5363591c59bd99986e71a668f6d9c4b8550", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879641, "uuid": "ec750fd2-a301-4d3a-8895-160d5a72b7e5", "comment": "Malware payload (AgentTesla)", "value": "20350f6a236db82aefc8ea0a8c8c071b23985c61c9b5b468ced39adf269f78cc86e0547400f3ab0022fd4107271efba9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879641, "uuid": "db59be9c-50cc-4a6f-8dc9-9ce1638429c5", "value": "T1EA459D264DCE4667C2644AB7D330EE01DEF11CAA2544EE152EC2F0EB9D3729694DED0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879641, "uuid": "65366827-4034-4453-8429-15f5c0a5a55c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879641, "uuid": "283bbc26-b6c5-4f49-82e6-f5248e4c1735", "value": "24576:+thxEbddNXjIZfYGAYFOZcT0lCuMUipM:+tINTAfbFgcYwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626879641, "uuid": "be0f5f0e-038f-4515-962c-e3f89f6f7753", "value": 1208832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626879641, "uuid": "e4afb23f-1a4d-4e60-a96b-8f5004d1b68b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879641, "uuid": "0c3135bd-4f56-4efb-a719-3c2ab93e8e3a", "value": "Released Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412ca347-ea0b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626861962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861962, "uuid": "fec60a26-880d-4551-bdb7-2f5db984107c", "comment": "Malware payload (Mirai)", "value": "71fda8f31ff85d490ecf06ec4b6591c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861962, "uuid": "466aebb9-172f-4dcd-a667-41fb41193914", "comment": "Malware payload (Mirai)", "value": "b448ffb4851ebc935fcca4b6738fd5d73c3bc5e2ecabe1697a40129389ee5858", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861962, "uuid": "2461156f-4ae8-4ebc-b9be-bc1f3d357ae7", "comment": "Malware payload (Mirai)", "value": "f8d6e3938af094e9591daf09a8c8086b00b0b687", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626861962, "uuid": "ccb54248-a535-4fb4-9553-73d8b8f2a4d9", "comment": "Malware payload (Mirai)", "value": "c2086b6b679dffd94a1ff14441f386c80f2030a5c7d892211bf72e44418644519815ebb268b9e84392f75d3bb7506d51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861962, "uuid": "03cd146a-5dba-4861-bb69-44b8983d9356", "value": "T1B0332B8968121E2CD6D358FD50729F4E9E552321A0A3070FA7ABFDC33D33269EF55988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861962, "uuid": "6c829476-9c73-459a-a9ac-c2ee2244be82", "value": "768:mYuzcClmYrJfIGh6HHaihHHeIXXdauZj0CGeWx3ytvptM7edUo+f1praznQePbL:mYqcCRrdIC6HHaiFu/eM7edJg1pmzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626861962, "uuid": "f7a63831-bca8-4680-bf75-39e97efd8c8a", "value": 54336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626861962, "uuid": "6cd4342c-83a9-4be9-98ae-9084178986a0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626861962, "uuid": "c1e08b0d-7786-4bc9-8c0d-8a13523459b3", "value": "71fda8f31ff85d490ecf06ec4b6591c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256d2292-ea77-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626908301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908301, "uuid": "d170b9eb-af90-4653-9c68-17e8c6bfbbfa", "comment": "Malware payload (RedLineStealer)", "value": "60aa3872c986eeacf55f0a0e935865a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908301, "uuid": "5017764b-ce74-4bd6-992d-a3fac08f0ef4", "comment": "Malware payload (RedLineStealer)", "value": "b61afe14307f31673f7ca5970d1bc8226dc21ef34a3f71a549025bf5babb3e86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908301, "uuid": "8f49e852-cfb3-4894-9b73-4fd37afe169a", "comment": "Malware payload (RedLineStealer)", "value": "ceef478652b613149597a55cceb44d3c3c9aadc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908301, "uuid": "50d82137-8148-4450-afc3-b4a6160e11bf", "comment": "Malware payload (RedLineStealer)", "value": "9d58952e59e429d581bfb1ce58949f8e8a691af99a28ae44bd9a2174f98916134754e434a0a360e259de9ab4dd3e2b5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908301, "uuid": "80d7a0bb-10a9-4bfc-9f8e-ea2569894398", "value": "T110E5F6D437384B4EC4B4487554CF8AA1A6B893DF19948813F7DE7D70B822EA22DDE346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908301, "uuid": "c226aacc-8e30-4042-bbd0-66f9e8b96da8", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908301, "uuid": "30d95c7f-c7d4-4517-846e-d0374b76d5ba", "value": "24576:NbkplEb2KTbzQOV9S4vSRuSv7unUCv+8Udk5JmMfzhKZLe0xOVpSegj3QgbDx2bg:RiGb5Tbz7y7xOMDOlQk2AuxBG2ea9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626908301, "uuid": "9b35c0f9-d505-4255-88cb-05a784a3275b", "value": 3158680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626908301, "uuid": "bb75eefe-8af2-41bd-8143-07bcc716eeaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908301, "uuid": "e811dd10-71f7-4bf1-ab2f-086a4861f15e", "value": "60aa3872c986eeacf55f0a0e935865a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d43c9a-e9e8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626846848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846848, "uuid": "9847ffd7-5a53-44f6-9770-e0c333db3fe8", "comment": "Malware payload (AgentTesla)", "value": "23541daadb154f1f59119952e7232d6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846848, "uuid": "7a7f2021-baeb-4d81-92b8-8d3cdddeaee2", "comment": "Malware payload (AgentTesla)", "value": "b7512e6b8e9517024afdecc9e97121319e7dad2539eb21a79428257401e5558d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846848, "uuid": "1173c1e3-98b0-4378-a920-721c5f3b4ccc", "comment": "Malware payload (AgentTesla)", "value": "c10e48ee1f802f730f41f3d11ae9d7bcc649080c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846848, "uuid": "0cf89b38-ba11-4e27-a647-373aec13496d", "comment": "Malware payload (AgentTesla)", "value": "e4b692ef4f4fb12b5dc6205a97507cae0fb1eb93f3d9cbdf18057c8171076ba955c4b067da9d33c92cf30b7cd2a3ad9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846848, "uuid": "70397b71-482b-42cd-bbff-bddbb35367ca", "value": "T11015BD2810694B63D67A97B7C124A344FFF05D937251EE1A4E93F8C72E12B43198EE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846848, "uuid": "48c633d7-702d-4518-bcbe-a248db859e28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846848, "uuid": "ded0b198-ee14-4ea8-8d87-406aa10cf237", "value": "12288:gfVH52sArO4+yg1xFSaMgO2mkHPco6dfvdV6yvrYfUbuYDI/:iVH52prO4+yg1XymrvcleyvMQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846848, "uuid": "e77024a4-f63c-4f1f-a768-adbe5b30eff8", "value": 880128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846848, "uuid": "912a2648-58ef-4839-852b-ee6008c312ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846848, "uuid": "d1bade83-4c57-4534-80da-e224e0006d81", "value": "qC99ZTP79mu70sM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0690ff6-e9be-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626829077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626829077, "uuid": "8434b41f-c950-431b-9516-26631f07e00f", "comment": "Malware payload (AgentTesla)", "value": "7a40cd9e714745a9bce60e0d701561d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626829077, "uuid": "37bcc10c-20ed-4253-a1ef-3e401651bbda", "comment": "Malware payload (AgentTesla)", "value": "b88873800d3b8f5dfc5bdf05009809efe725bbb8970cfb05cb6916452d4501a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626829077, "uuid": "b28d2a02-7910-4f1a-9e04-42fbd8b0e2e9", "comment": "Malware payload (AgentTesla)", "value": "639e8ee368923a5d965685985353474fa35ad70a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626829077, "uuid": "2aaa0157-61f6-4bd4-a732-637463a107fe", "comment": "Malware payload (AgentTesla)", "value": "9c54ae551f35ae6129772a9efb6b2760c004dbd0986135199b81f502a97c2694e52b550e8bfe20ae7ab7f202d9941e69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626829077, "uuid": "7baf62b8-c1da-4774-9919-128d82a0595b", "value": "T11A3402B9434E4397EB13A239BB2CE676DBF5983522CF82321735358980D55C6A398B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626829077, "uuid": "7e9d3a83-e70d-4dcf-9fad-a0f4bd24ebab", "value": "d7cd0c2a85ac74a96a6bff797c472b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626829077, "uuid": "d561f0c0-832a-4e07-a521-a2cbdc34da3a", "value": "6144:SdhV2L14Nr5tesU+OCVM4cn6BbRfICRcGiCZnmB1OYiHH:4h014NrH1nBSxCyGiCtM1OYin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626829077, "uuid": "c2fc595e-d938-464d-9110-333733c96961", "value": 234119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626829077, "uuid": "0e7f16fc-af65-467e-a57d-686c450eacdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626829077, "uuid": "0721ae4e-fc57-4e84-94ef-b06f06042e1c", "value": "SecuriteInfo.com.W32.AIDetect.malware1.17748.8352", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd09e94d-ea7e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626911562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626911562, "uuid": "29bc5f10-f412-48fd-9029-3540535fd4c4", "comment": "Malware payload", "value": "3ef497d32acf7ba8bcbf6281b2e7ff7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626911562, "uuid": "ca0b1957-95ad-4106-940f-9ddfd925c012", "comment": "Malware payload", "value": "b8b2077a4b818a377153b24328151956d8b13a16bda54c82c9be894fa87eed91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626911562, "uuid": "94f3c0ea-e2ae-47b3-a64c-45b198bd019e", "comment": "Malware payload", "value": "d31285994a992811cfc2a7a89756744cb16ec10d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626911562, "uuid": "52c6e8cb-df9d-47f8-a7d5-38a432f1b68c", "comment": "Malware payload", "value": "a976bcfb4c6a2d473d5a49aec268b6297e34705f2427d7a300436cfae25fc1c958f9d4d315449297f8a60b4315d80ef8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626911562, "uuid": "89d59f0a-6c74-4c2c-bb2c-fa4888707adf", "value": "T117C4021076A0C933C9E6193104F7E265197FBC672ABC05077A4477EF3E7129192BE36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626911562, "uuid": "cca23ca5-f979-408d-9d98-b93659a0259c", "value": "266aa3b561e26e3b4d438fb26814163c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626911562, "uuid": "447e8b4a-ae19-48d5-9de2-4d91ce514f51", "value": "12288:BIvq+VOh9flyd9W53GGqICKSbCPllZK3hmd1Cyt7L:Ym9yvWAxFbCPzi7yt7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626911562, "uuid": "41e5f2b8-827b-40ef-80a8-b8d5a22d845c", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626911562, "uuid": "8e0c07e8-f310-4269-baf4-3710d0c6e992", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626911562, "uuid": "632eb419-0a66-43d0-8d58-1b5a26e10bd9", "value": "3ef497d32acf7ba8bcbf6281b2e7ff7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae53dea6-ea4d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626890492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890492, "uuid": "7170fdf8-c451-4478-a74a-4f3d1aee940d", "comment": "Malware payload (AgentTesla)", "value": "ba9c98a7b7ae0c218b4b29579b6cef0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890492, "uuid": "db7fa159-00e4-4daa-99a6-05074b9eb7de", "comment": "Malware payload (AgentTesla)", "value": "b9cc4e51b1539a1e0222c25d78b79329cbcfc16c92f552f1a9627eef8738f439", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890492, "uuid": "f5d26540-0eee-4864-8336-29f9ea8d0bbb", "comment": "Malware payload (AgentTesla)", "value": "eb485b41a99ca4b38183f130b9a180bcab2f3477", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890492, "uuid": "765578f0-f226-46ea-89fe-c86a9b0284c2", "comment": "Malware payload (AgentTesla)", "value": "0e21e4401bfc760bd31445c99634e361bbb0dc0bb26d15a14331cd4a9c4a49b4b0cb9f87248653009e202b0b1d3aa290", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890492, "uuid": "e1d3ee4a-7b1b-48a5-b837-9e9b1c13a228", "value": "T10C358C61F307EA58EC2213F8D87AD8F12263BD5DD529892B358E7E2DB9B334150E1907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890492, "uuid": "df651492-a54f-4f1a-9fea-05ff22a92187", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890492, "uuid": "3ad19ea1-6479-4e12-967b-3a200115c829", "value": "24576:FqWOSdky/trOCXkUbRsotwE0h6H0wahp:FZdP92otwNg0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890492, "uuid": "989b7785-698b-490b-ae76-28dd2bb31e47", "value": 1132032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890492, "uuid": "9d992751-b104-4749-9785-a6b21130fdb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890492, "uuid": "da9743be-9e74-4584-8333-935b237c2b69", "value": "ba9c98a7b7ae0c218b4b29579b6cef0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b981908d-ea23-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626872472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872472, "uuid": "5e0abbc8-651f-4d57-8e7b-47fb2f28fc6a", "comment": "Malware payload (AgentTesla)", "value": "4665cef694a2aaefcc4036296b7bdb3b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872472, "uuid": "9ba9b9dd-3641-4091-9d81-f6ec91d384ec", "comment": "Malware payload (AgentTesla)", "value": "b9e9f771cae186309b6e5f0d4fa06a06b80d610a18804bb8e495881a4ebb459e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872472, "uuid": "114aefdc-82fe-4e3c-915f-5d6099d8184d", "comment": "Malware payload (AgentTesla)", "value": "0e3b9e4986bbd83379279300ea7b4ca94da1ca9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872472, "uuid": "8f4bc744-26f6-4444-8817-536d98a913e2", "comment": "Malware payload (AgentTesla)", "value": "8c6d8916fe30b15a20f2765e226ff458d47d976c1e864657ad43de9bbdc4779f951f1e011104453b29c1e41aa3354d3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872472, "uuid": "31db8415-03ac-4ae1-baf4-c67537cf4a52", "value": "T18515BD2814A84B67D679A7B7D125A340FFF05D927240DD0A4E93F9C72E22B43198EE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872472, "uuid": "0365fc64-c22b-487a-bcf9-1d9ad401bf86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872472, "uuid": "10315c47-1cb5-4e94-9c87-b20564b4d555", "value": "24576:fmqR2orO4+yq3fPOld8SylO3QvPG5JWtypvf9wE:+qR2tyq3fPfSy03yPGCQdwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626872472, "uuid": "6db1ae09-9697-4697-8784-f0aaad02fb01", "value": 889856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626872472, "uuid": "3fd455cc-7ce1-4771-9da8-cb13c0fe5fa5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872472, "uuid": "c1492e32-799c-45df-98e3-aee3139160a2", "value": "Order Sampes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e8bbd7-ea5d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626897479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626897479, "uuid": "054e1f38-7ffc-4d35-a7c6-b4c5ac16acea", "comment": "Malware payload (Dridex)", "value": "88453945ce19bdad841603e1b449ad30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626897479, "uuid": "e24b36ef-cb8a-4bd4-be6c-44172c8abfad", "comment": "Malware payload (Dridex)", "value": "bacdb1cfcda34da7422c74810016d80179dc453b29d0121db596fc5346d98cad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626897479, "uuid": "ad983bf4-2fed-4379-9e22-f7e3e02e1da4", "comment": "Malware payload (Dridex)", "value": "9bd3279c75d75294f56511bb890112b8266412f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626897479, "uuid": "51c478d7-0661-4c59-bb2f-d5d4773a7cb7", "comment": "Malware payload (Dridex)", "value": "290a614524432386aded4dfaa058e0a0e90a8157a248725485fae46baa03af07f5853a85d497ab0f752e3e92f8431785", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626897479, "uuid": "fcd07eaa-3594-4cd3-9d16-e154f772822e", "value": "T1D204C077AEDFC0B9F2A39470107437AB26F57A032419F491DA60C8DBF83D994A8A4753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626897479, "uuid": "9d16e80f-e8c6-4f01-ac4d-cc4eaffa45f8", "value": "458d7355fbf070054838e3593829db8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626897479, "uuid": "796bb385-e7d8-464f-a07d-2859f970f382", "value": "3072:YVadvfvemTEtQ9yoZPW/k/nklVtu77wBeZUCEQZRpgBDp57WQhdIif4:ZDTyJWPd/nkdqw4/HgB77WQhdIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626897479, "uuid": "4176f992-64bf-4ef8-b72e-aefe89142b6a", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626897479, "uuid": "49ed52a0-6cca-4120-9e6a-af30ae6743b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626897479, "uuid": "6611bdc1-c1ef-4bbc-b8ba-b258c743b64d", "value": "88453945ce19bdad841603e1b449ad30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3437aabe-ea7a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626909614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909614, "uuid": "6f374ef6-9e69-4510-bf87-fdc978de1025", "comment": "Malware payload (Mirai)", "value": "cf347600aedaf9ff58d86364b6ca2278", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909614, "uuid": "41cfe5cf-8608-41b7-89c7-30a44fe0f6d0", "comment": "Malware payload (Mirai)", "value": "bb2cc8df944df277c81b39681965c0176a6d6c916b3f68fd7d72a98eb88f9a64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909614, "uuid": "7cefcb85-da6a-429f-9a0a-45935becabb1", "comment": "Malware payload (Mirai)", "value": "494f460795e96a9c73e910cc9f09124f659036d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909614, "uuid": "1e5ff120-fd47-4f0e-821a-fcb1ae48cfdc", "comment": "Malware payload (Mirai)", "value": "6b14b4f52e9710cf4716b0c7a2bb3415e7265c17ff99583f65f02fbb7197de747c5dc6696315fbe3c4200d307cfc5de8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909614, "uuid": "3123a7e0-96b5-4df2-a8b9-fe32ef9d2442", "value": "T191535921AD7A2E17C1ECA17A52B34360B2F51B4E25B48B1E7C720F8EFF5098866531F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909614, "uuid": "0e0611a7-ba93-40b0-8b6f-1529cd10ec9e", "value": "1536:Txue6O74U4KlQI9QrVitKMSzyFaiNIIaK:Vu82KGPRik/yxxaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626909614, "uuid": "db901052-f114-4b88-8602-2cc104914629", "value": 63516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626909614, "uuid": "7aa15466-ace5-43a2-a3a0-d64eebfc6688", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909614, "uuid": "476e4230-9dee-416e-bb7f-12d78afbfd61", "value": "cf347600aedaf9ff58d86364b6ca2278", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67aefa5-ea52-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626892760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626892760, "uuid": "77476216-4b69-4ccb-adb1-75bfab7ceb92", "comment": "Malware payload", "value": "eee3566e437c8b23918daba36b7c5518", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626892760, "uuid": "e6e39566-0338-4f89-8cf4-471f45a52ecb", "comment": "Malware payload", "value": "bb54dc0cfa4ac775461547a04c989435a95653d288ff7f4bf6cd50100d8a0d49", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626892760, "uuid": "44af17c0-a794-4703-a0f9-cfae82de0708", "comment": "Malware payload", "value": "429f4c9802dd9549d4e4167cd51414ff5587822a", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626892760, "uuid": "712f9fed-1afc-4bac-8bc9-85ede73424f2", "comment": "Malware payload", "value": "608856f2fda451b9c9f838f56b3ec7e770dbf3e4996f2365be08eb6eb0a2f523916d9986e377fc38f13beba0981bd239", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626892760, "uuid": "179a9d10-4792-4c22-b89d-3a99c09b70f6", "value": "T1CCE45AC5EBE1C92FEBD1957A0C560630227CCC0456804B977356F33AB72BA7C8E962D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626892760, "uuid": "f736da90-206f-4aca-885b-68835f213e6f", "value": "12288:UGDH3roxGMC/mc4bl3q5uaFsvCgdz2l5MjavMmIf+iFj:UGDXEUH/4EnsvJZ2lKjavMm/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626892760, "uuid": "8a460d45-6101-4c3a-ae49-a14151da7837", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626892760, "uuid": "6ddc094a-86a1-4c48-a1a5-3b8f637a2461", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626892760, "uuid": "12822f79-81a2-474c-9abf-d0e2adf2e69b", "value": "eee3566e437c8b23918daba36b7c5518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3dbc838-ea04-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626859148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626859148, "uuid": "aee34462-f631-4ffa-9be4-6893a32ff09a", "comment": "Malware payload (Formbook)", "value": "0b2d200b5f2dfc4e8f23fb1e93b9073f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626859148, "uuid": "00b99a0e-f949-468e-a643-e448f4be3b4e", "comment": "Malware payload (Formbook)", "value": "bfcda678eede144bcbb62d4c257ed2e05a26a5087893f3dfb62273bace6fe872", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626859148, "uuid": "4ed30bc5-84e0-481b-ae5f-10a96520fe44", "comment": "Malware payload (Formbook)", "value": "3d13561c454507d71ff17ffd29801a5f958be255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626859148, "uuid": "6b79f66e-621c-4627-8f37-61272d754513", "comment": "Malware payload (Formbook)", "value": "41725489f2359ac0cfcf187fbc3613e0dd1fce7ca5e3f09ed06c20ad25ee4c1713b5418626f8f60406f8825e477bb97f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626859148, "uuid": "c2017fa9-f6b7-40c9-a821-2691e9fd27ba", "value": "T1A615AC2810A94B23E67996B7C165A340FFF16DA67290DE0A4ED3F8C72D12743198ED1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626859148, "uuid": "449c6237-9713-47c8-b599-d7d376486713", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626859148, "uuid": "b064f7f5-1bc2-4eb5-b56f-f88108f2bf7b", "value": "24576:1rt12+rO4+yt8x/SgG0Ii2k5Cy08CPn0dOe:932/yeK30ItJHP0dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626859148, "uuid": "74b5e6ca-eeb4-403f-a36f-2db8be071de9", "value": 910336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626859148, "uuid": "60bba20e-84c2-4d4f-a7b1-285d7181c81e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626859148, "uuid": "cdae06c2-8a75-4a2e-b5b7-d0eb128fb8fd", "value": "slip.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2b2efc-ea49-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626888851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626888851, "uuid": "3c2493ac-9bca-496b-a1db-71a89623c213", "comment": "Malware payload (Loki)", "value": "825ebfccb4c9e1b2a71f8e931d751aaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626888851, "uuid": "a556306e-4224-4d9e-943a-0e81a957c3e0", "comment": "Malware payload (Loki)", "value": "c17b37bb3f9b18f160029a7d48d3beef1a15cb3fd51033e6c6ccf4c871377c12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626888851, "uuid": "a056a38c-5cdf-49da-9413-339ba25eb6b7", "comment": "Malware payload (Loki)", "value": "9318735795acaca9794a92030492b9c2c5fc0aab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626888851, "uuid": "4b398f0a-df6e-4723-8dab-e9a3531b3827", "comment": "Malware payload (Loki)", "value": "a8032787ef16e8c92a84d32020cbec12e254002befaf19fc59b840621a64e4a163454906a7692d73ef02041424c0866d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626888851, "uuid": "9ef66b50-1646-4422-9299-c6e7aaa5c9a3", "value": "T1B3358D224DCE4667C2644AB3D330EE02DEF14DA62544EE152EC1F0EB9D3729A95DED0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626888851, "uuid": "ef60f6e3-0cd2-45a3-8884-36c6b7263b35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626888851, "uuid": "df1eda85-5200-4be9-aaac-066dbd2be97f", "value": "24576:MFJUnleD3UycFDx8kfpoFGAZlgjrpipV:MLUYD3YDpo+jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626888851, "uuid": "158dce45-2bd9-434b-91bd-9864ec35746f", "value": 1127424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626888851, "uuid": "08777f11-4db9-4ebe-bd6e-edb229cdc766", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626888851, "uuid": "fcf908e0-51a6-493f-9c03-12ee48fd18c1", "value": "0n4xyK1WyMB3UE2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaca6a18-e9e7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626846677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846677, "uuid": "777eaca9-5e8f-4866-b783-438df8038908", "comment": "Malware payload (AgentTesla)", "value": "a215603c144697cc4dad557ccc022de0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846677, "uuid": "dbea204c-0329-4728-aaa9-98cc598e6483", "comment": "Malware payload (AgentTesla)", "value": "c2f21acde289adec4dbf7163480b89064e1eb476558c9729a520303cc75b40bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846677, "uuid": "4556c7e4-36ec-47c7-a536-e7fd3042140f", "comment": "Malware payload (AgentTesla)", "value": "86ec0ece5ba86e79790dce4d70058c4173df85f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846677, "uuid": "9ac50dae-5f8b-4b25-8ba5-90b3f05ccb8c", "comment": "Malware payload (AgentTesla)", "value": "4b0ba6d843d0cca9b6c57c78177cc85fedc3031b4038bdc369d64903f9ac88fdfc6d5dc43950de030f302caae7e1efd2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846677, "uuid": "1de4e5ff-3648-455b-a19a-39cdbdc979d7", "value": "T162B24B147388C621E56E4732A3E3444867B263C33322D91FBFC9A2981D437929E56BBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846677, "uuid": "05e85ff6-e076-43ef-b5ad-5118c6cfae17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846677, "uuid": "240701aa-cc86-430b-b21d-e56e7d151ed4", "value": "384:SexPyKWREi2f6XJFrlkXidanimLy2Twh99HghwhTX+VLTmphprpD7DcJOCDM4hlo:APXJFEnBahHhTuVLTMTJncJO2PhlpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846677, "uuid": "de8ad374-120a-4adc-bb72-021615854b8c", "value": 25280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846677, "uuid": "b473b5f2-3dd0-45fc-97a4-aafdb1a8facc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846677, "uuid": "2ee47755-78ea-46fb-b1c8-835618ec8a0a", "value": "MPU702734-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0212ffe-e9e7-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626846767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846767, "uuid": "0a8555ba-6526-4427-be7e-c5ec610c17e1", "comment": "Malware payload (SnakeKeylogger)", "value": "cbb0c2728f585c50a4506ddc36418fbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846767, "uuid": "4ad3a4fc-8691-494b-a08a-1178911d8ab5", "comment": "Malware payload (SnakeKeylogger)", "value": "c305b7d9f3cf302bf11fc470c71d71aeebc35f82a517205dbd40c2245c0ead37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846767, "uuid": "08c8a18f-d644-46fd-9b1d-dfe734fb603b", "comment": "Malware payload (SnakeKeylogger)", "value": "4f32f040fe6246284c8b23ef86549fbdfd3f1b04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846767, "uuid": "e837575c-1acc-4a0a-a26b-f5ecf2fc304b", "comment": "Malware payload (SnakeKeylogger)", "value": "05820b7ccd2a5cfbd97e6a19f18c7186f1b832ab4088eb6e5c3ee2f8e922c4839ea32dc7e042eb4d0c9dd2b87c5bda36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846767, "uuid": "c29a62a5-2c89-4cc2-91f9-a8c86452a09f", "value": "T1E8C4E165632BA208ED74C7FA1C75E1A267BF603A662EC63C1E84D03CBD7277C1AD0552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846767, "uuid": "aaeb893e-1220-456d-a462-63df030d9064", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846767, "uuid": "9a09659b-88fc-4a85-ba8b-5cea20212fb4", "value": "12288:5u3yvUIZbVUNvNd2o/gZjknm/aDKqZ/Zv5MjoOdv:UivDBUNVd2UeayI/V5Mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846767, "uuid": "f33d1759-34f1-4e06-9a58-4c6cbd729618", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846767, "uuid": "2b25eca5-f931-485d-8223-1f56d9120d2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846767, "uuid": "ea3d5b1f-8937-499a-9f00-4b35c13f0e9b", "value": "ELo3NhVEFBPQ3yB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41591b9d-ea20-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1626870982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870982, "uuid": "3e6230f8-9096-49db-88bf-003fc267c8b3", "comment": "Malware payload (OskiStealer)", "value": "c7b3639ecbbe1e7d12d2082b97ac2374", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870982, "uuid": "6f95a4ba-df79-4303-9e67-2eaf644bbe04", "comment": "Malware payload (OskiStealer)", "value": "c3acca4909105b42b4bb4677a7ae314d0adff6c77b92699cfc7db651b786a440", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870982, "uuid": "6937f2f8-8b8b-429d-bad3-caa12775bbdf", "comment": "Malware payload (OskiStealer)", "value": "c1e21f15c9d3123cf2b56e787173df2d5b50db3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870982, "uuid": "4c175854-65ef-4a95-95d7-f828e4bd4b82", "comment": "Malware payload (OskiStealer)", "value": "ecbceed3fff0efc383c44ef40050a263ddf19eeb1fb0db27a82a94e7717bf78aa4f06653247ffa1e2e6c004fa763930f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870982, "uuid": "eac4d143-1700-41f3-bf12-4b8313815ce5", "value": "T1EDC23B31BAD49A33D6BF6A3695F19001EB7063C33521CE1FA98A92C44C03B526F9677D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870982, "uuid": "8ae65da3-0ded-45d8-bc62-3d7b958cb7fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870982, "uuid": "ad2b3a99-2b31-401d-9c2c-e84236740d7a", "value": "384:xOPy7u05yxKwYNeHIfE8G0wuLS1laQPhCX25REwCtdtxhyXE2PGM+yJ9U4QlYUKn:OxkqHPuL9Vthy0QoyJ9U1lbKMNhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626870982, "uuid": "581982d1-12fd-4efe-a966-a3745eafd768", "value": 27984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626870982, "uuid": "186bd1b2-1751-45d6-beb3-ffd73b72b50f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870982, "uuid": "6faef0d7-af9a-4da1-aa8a-3da770e82c2f", "value": "DOC98374933JULY2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530c1b39-ea24-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626872729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872729, "uuid": "df6f1dd1-4c11-4836-8cf5-3530616cb51e", "comment": "Malware payload (RaccoonStealer)", "value": "5df9d78d2bf166062ec012c0bee49b18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872729, "uuid": "01d1c064-359d-4acc-8bae-f13d97a81928", "comment": "Malware payload (RaccoonStealer)", "value": "c3b24fb20cb96eddd7d3cd9072bc9b690dcc07b8a69873f21efab1cc02cbab90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872729, "uuid": "ea145afd-a316-45d1-b281-2665d2acd213", "comment": "Malware payload (RaccoonStealer)", "value": "4ae3ee31c1a7393244d6beaa3932903c8a8a4b6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872729, "uuid": "717367cc-4572-4ad2-b0ba-b7b50e09e0e0", "comment": "Malware payload (RaccoonStealer)", "value": "0660ea92cf4d5d3b24e20dca9242e3dcc72e79f6fc9e113668f0b3c75e6151fcffa0b72e458821d078e84d64b1ac248f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872729, "uuid": "76369954-f441-4295-9a1a-296b060f00eb", "value": "T139B40280B6D0DD32C2F6053948FBC394667FBC627D6986076658BADF1E31282927E347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872729, "uuid": "0b88ab84-6e8f-4ce8-8dad-56da35f976e0", "value": "90448e8f7733b3c6bdf5b48508246f5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872729, "uuid": "781dcb20-fc64-4208-b8b2-17c09ef75585", "value": "12288:m71mNKM2BSu4BLap6VXspa/vrs9Kdo5JjXIuyEiLhm2ld:2mNK4g6+Evr7+5JzyRLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626872729, "uuid": "68a9f3f0-5b34-4ee7-bde6-c6b64663f627", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626872729, "uuid": "4fd7575f-bdee-4b68-a270-02e9486b2532", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872729, "uuid": "fa84367e-8579-4564-9fac-3013cf5478f4", "value": "5df9d78d2bf166062ec012c0bee49b18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab760e88-e9c1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626830357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830357, "uuid": "c04176fb-55ca-4820-9429-012dce681358", "comment": "Malware payload (Mirai)", "value": "f883a660b2199d736ae2deabaf6665d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830357, "uuid": "6ec643c9-867b-45ff-91d6-1a34e75bfd5b", "comment": "Malware payload (Mirai)", "value": "c40a26d96890dfbac585bddf439fb1b789b34074afeffabc12c5b118948ec6da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830357, "uuid": "a468036a-c2cb-40e5-8642-5eb6a355beaa", "comment": "Malware payload (Mirai)", "value": "ceecd12e20fce79cafb5bcf364c84cea3030874d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830357, "uuid": "51caa753-21a5-4cf8-aa72-5c46320f52cb", "comment": "Malware payload (Mirai)", "value": "60bd0d5f949a0581546daabc2c2aab4ef2fab29ff1bb9a3ab2c167e486d708e0f1ab33c1dc8dac41bb826df2da49ee13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830357, "uuid": "40a7cd0e-053b-4123-b246-c5c3c22f66a1", "value": "T1C3532951B8929A22C5D4237BFA6E41CC332563E8E1EF3207DD256F5437CA92F0E67242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830357, "uuid": "9cf220b6-2d55-4759-81d7-a5ccfcccc453", "value": "1536:LOFbExBG8W6tZqljS85X17xOMLa/5XdCKo7:OmBpWP9Zx32/5tDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626830357, "uuid": "ede962f9-07a6-455a-9de6-f74c865fad62", "value": 66624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626830357, "uuid": "3308a106-e258-4138-8f57-dadbbb466e97", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830357, "uuid": "b6f07895-5af4-4b6e-8179-494f08484799", "value": "f883a660b2199d736ae2deabaf6665d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac833619-ea0c-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626862571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626862571, "uuid": "4294ec9e-bf11-47bf-b63a-e94438e88701", "comment": "Malware payload (RaccoonStealer)", "value": "accf0070e9fe39d63291fc95b24bc7ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626862571, "uuid": "e4e33c08-b4d4-4790-9e7e-acc331609b90", "comment": "Malware payload (RaccoonStealer)", "value": "c45613b7ffdb689a3510eaa680613b97c0e89a22a83271a87130a6abeb55c782", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626862571, "uuid": "e6313ee3-d9c3-4b69-9a8a-9ea56404ba9b", "comment": "Malware payload (RaccoonStealer)", "value": "1cb7b01f5dd2fd6440fe691a2564357b1dad0166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626862571, "uuid": "9f77467a-1234-47e8-86b0-148ea7a3f296", "comment": "Malware payload (RaccoonStealer)", "value": "634107c51ce3b9e6f63be5fc378fd59635bb43a8993a97e8d9231e748419c1301d1437f541450a729c4cec5be8454144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626862571, "uuid": "4aef0f37-e90f-4205-b96f-e11492cc5432", "value": "T12DA40150FAA0C432E5A62A3129F7C1AD753FBD66EA34450B77443BCF2E7128258BD316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626862571, "uuid": "8d505cf0-e08f-472a-ade3-a57e63120300", "value": "b3536084cb50b2be3b69aa695eba88f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626862571, "uuid": "1a69d5dd-8583-4131-9fd9-a9a00b213cdd", "value": "12288:SEJvfs1QO5n1xa7UfFt6udZbgvOHOq2Yqyr:SucQGxa7CFt6udNgvpZyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626862571, "uuid": "6ba3c15d-22bb-430e-a2d0-1c1afbe87530", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626862571, "uuid": "9e50af6a-0ad1-45b8-a20d-ce473ca010f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626862571, "uuid": "7d5aee69-1a7a-46d7-b946-499ba7f41ec4", "value": "accf0070e9fe39d63291fc95b24bc7ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee9e05b-ea71-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626905740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626905740, "uuid": "cfb28e12-722e-4b75-8578-9507709f995d", "comment": "Malware payload (Mirai)", "value": "5422b7184965110b3651a12d43c50ba8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626905740, "uuid": "a8cf7d32-fb1c-4cae-bac3-cbb21ae11a3c", "comment": "Malware payload (Mirai)", "value": "c63df90901113b429a7ed9c62b7f09065a2c2b975569d8072f77d67a4453a1b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626905740, "uuid": "f34be809-ae8f-4783-a2bd-a8fab1358fc6", "comment": "Malware payload (Mirai)", "value": "a1edf4023c85b407bb3de1c398e69d6783cbf838", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626905740, "uuid": "10870508-1a94-4e27-a330-893691ce93a1", "comment": "Malware payload (Mirai)", "value": "2d0aefdc8fff96fc1d1e304d29d99411952d06a5c5939e24fa03a625c4425a85db44bad1a5bfba8e58e808bbf5fe8374", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626905740, "uuid": "52d8222d-02d3-4ac8-826a-f33d9bf1a14e", "value": "T164D2E1D9C307159CEA6AC0BE1AD007532E9187D9E403FC497ED1ED53CA8B9787892EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626905740, "uuid": "1d8a5ea8-892c-4357-9900-92b17e999cbf", "value": "768:+3cmMo80fbIU8hAPr4/rlDbzXPTD/JgGlzDpbuR1JVlO:Zm9MU82GTBVJuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626905740, "uuid": "cfbef4d7-6079-4ebd-bd9c-ca363e0e7718", "value": 29256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626905740, "uuid": "28a81c77-de26-47a3-b9d0-5c5d5805050b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626905740, "uuid": "640abec9-31a7-41f3-b548-e0aa67e3ec82", "value": "5422b7184965110b3651a12d43c50ba8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09a275a-ea23-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626872484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872484, "uuid": "2570d21e-8394-4b91-937f-e8fcdc746b63", "comment": "Malware payload (RedLineStealer)", "value": "352ec1261178252b95d1d66145487203", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872484, "uuid": "9fa700b4-3ca6-465f-86a6-83557447c1a2", "comment": "Malware payload (RedLineStealer)", "value": "c7399bc053ff61efe781e386a4c1fb2044307eb60bd28548477eadbb1e62c043", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872484, "uuid": "6a2b9498-f80e-4e5c-9570-2eb60ac4d81d", "comment": "Malware payload (RedLineStealer)", "value": "9d67151f841b85b410e7876db438c727076e5db1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872484, "uuid": "5007a74a-b65f-44a6-9e9f-c73e371ba448", "comment": "Malware payload (RedLineStealer)", "value": "bccadc784ca9af24afd14df4059a185aa7e448ef66a4000ed881ddbb481971eb391624f9cb0fc740ad997cdab523ec4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872484, "uuid": "e2374384-7294-431d-a841-eac4402d2470", "value": "T1502416F7106149A1C9F9123CFD150F0B3668FA2947C07688BCDFA29ADA191BC5EF8365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872484, "uuid": "51d04a85-98e4-4152-b8b7-4d019b72ede2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872484, "uuid": "2c2888b0-aa1a-4eba-9692-928147d034e4", "value": "3072:fACQrv5vMAUalqTlSCxuPlXDz2oVQPVb/dd68KAR:for5vN9lqTZx2lXGDzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626872484, "uuid": "3c98c9ab-efc9-4978-a9a4-a387e44cf5e6", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626872484, "uuid": "4a2c7328-1256-4863-bf24-52fc4d47bfc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872484, "uuid": "5ff60788-9e8a-428e-ba9a-3f2e7dad3a20", "value": "352ec1261178252b95d1d66145487203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7384cb98-ea4d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626890393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890393, "uuid": "8212b1b4-ede3-4f95-b042-f20d12fd8faa", "comment": "Malware payload (Dridex)", "value": "f70346d437f79aed8085934da8051603", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890393, "uuid": "c6a37903-d8ba-4ab1-8e5d-5ef593196b30", "comment": "Malware payload (Dridex)", "value": "c7ee52bed09b62343a0a239526ff58285cd2d67ff2b598455b32c7e8721e559d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890393, "uuid": "e36a5505-2a91-4a44-ad00-b3e3816523f4", "comment": "Malware payload (Dridex)", "value": "6293138e17910fe92b1a5094cd3c5489fd328360", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890393, "uuid": "160c5f7b-a139-486e-9b58-ed9dd0032c01", "comment": "Malware payload (Dridex)", "value": "a8650a84cde028dbfdfa7e9c389e666ca3c39e07da3f407cd7a47a7a3f3aa68dd22bda9543d5a19dd99e92263f6a4a4c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890393, "uuid": "73d526a9-5d2a-4eb4-a7ff-ffd8e920e25c", "value": "T132E449C4EBE1CD2FEBD1957A0C564630227CCC4455804B973256F33AB72BA7C8E9A2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890393, "uuid": "8dc70d08-2275-4cba-8ad0-eb5ae060a3f5", "value": "12288:1GDH3roxGMC/mc4bl3q5uaFsvCgdz2l5MjavMmIf+blqd:1GDXEUH/4EnsvJZ2lKjavMm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890393, "uuid": "c87768b6-abe1-47a8-9d71-eb92841ec6a7", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890393, "uuid": "ea5d75e8-88f6-4ecc-a178-d8a7cb05350a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890393, "uuid": "58512a24-15a7-499b-b920-e7da01ff8507", "value": "f70346d437f79aed8085934da8051603.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc54cd4-ea4e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626890756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890756, "uuid": "e6e17be1-27f9-4194-a748-cc273f096867", "comment": "Malware payload", "value": "3754f1800a8946ea1487dfd0f9dae0b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890756, "uuid": "3f02bc8d-a7a9-4c66-9d93-5ea807e42a1e", "comment": "Malware payload", "value": "c86c48057e9be95681c1a2d37f41232a2951988baa71fd415a03ba59725716b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890756, "uuid": "24f1241d-bbac-43db-903b-d13c897ac787", "comment": "Malware payload", "value": "3e21ac2b2bc9d1637ac90bf9f9889005b04bcacb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890756, "uuid": "3ad118b4-d82e-4ace-bc3d-4247e6027fc6", "comment": "Malware payload", "value": "22c521fe9aba5bbdf930398dfd029ab63714a8e87ec59d75e3974ed56c649a2a0e7b6b1d8946f497f4acd640719960d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890756, "uuid": "d6d1340e-02da-42c7-9838-f2fef2ea2428", "value": "T147E412308E33EAD2FE9F063F31BB06760C715533C8855DCC66112998055BE6D9F9D89A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890756, "uuid": "7c71eaea-06ea-496f-ab8d-1f0b80a3c0a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890756, "uuid": "f01c6667-ed7e-4c2b-9109-87525a9fb20f", "value": "12288:FC9vFWssZm5qy2FRbaX+4nzWY+8AV7vbMIFN18Y7CNi:FCpULRbk+2W3Z7v7B7Cs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890756, "uuid": "aa75f93a-244a-4936-b09a-e5879877e578", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890756, "uuid": "9e603cb8-7989-4ad3-b1cd-64cb501b0e9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890756, "uuid": "3f4922c7-cd68-4336-a513-39c2040948d3", "value": "3754f1800a8946ea1487dfd0f9dae0b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5005ee-ea4d-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626890512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890512, "uuid": "30c95ab6-ba1b-4b71-9cd4-2ca4f3a88025", "comment": "Malware payload (Smoke Loader)", "value": "773d01c3082deed6da2d5ebaf1058a5c", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890512, "uuid": "52b038ee-b5d3-471d-9fac-9c4c6472697b", "comment": "Malware payload (Smoke Loader)", "value": "c8793b903031728f6e63e0e348b844879ed7cdd073ac17031f9ebba826292033", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890512, "uuid": "f3eceac8-ce5e-4ce3-b3c8-327161ba34ab", "comment": "Malware payload (Smoke Loader)", "value": "95770848c54265e58e406b122b9d5a76b12c742f", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890512, "uuid": "cc511e2d-ec16-4945-9b3a-58164db50fae", "comment": "Malware payload (Smoke Loader)", "value": "d294f73a55ed26ad07631ca9d509b7370396e6bbe5b4e33673535fe773e47539ed563941648c2a6a6e2c159488e21477", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890512, "uuid": "fddddf9f-467f-4ff5-bff0-5bd8491bf4a3", "value": "T1CC445920E5D1F867DE8E30FAC9A9C7F77C6C69308F6421DB93586E4C62BA2D060B54D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890512, "uuid": "9a00b7ff-f6df-4d38-a6c4-9ef66b56af6c", "value": "b59594dfc068d58636c83d19481c521f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890512, "uuid": "fe988485-9189-4942-8682-018bff97d57e", "value": "3072:eox4jEdYFKL0TYK6j7h7bLlwXkFy3iSP2eiLe8/Gq2CeY:eCd30TNAt7b83iSP2Re8J2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890512, "uuid": "0abfe43b-4299-4fc5-b6fa-583dcdf5096a", "value": 278532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890512, "uuid": "e4c976e0-45be-4c7b-b6bb-0b70506836bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890512, "uuid": "dff66050-6980-4af1-877f-8084f06ecdfe", "value": "773d01c3082deed6da2d5ebaf1058a5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51072e4-ea06-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626860116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860116, "uuid": "e076a88b-8e28-445b-8cbc-8bbbde9e262d", "comment": "Malware payload (Gafgyt)", "value": "62d60e5db3ea476b22b58c44eabb298b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860116, "uuid": "850a559b-cf4c-46bf-8390-1019fc919f4f", "comment": "Malware payload (Gafgyt)", "value": "c8c7f855d4683f27096ddad1599b622ad37b7e8d0611e279ac6d99455ca650e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860116, "uuid": "8e6d2ff5-6529-4426-96fe-8c94883cbccf", "comment": "Malware payload (Gafgyt)", "value": "f8a8a25d561e9aa92041af860004a99b6d338128", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860116, "uuid": "23df55b3-cf7f-443d-bec9-b8a523b820f8", "comment": "Malware payload (Gafgyt)", "value": "206e4fd5d97a94272c9637d29e036c0203ed513cabfcb145f19f12a304c2a97c382f84c71a1ca6b84a46faf0f40b2999", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626860116, "uuid": "068d931e-914b-4aef-8b2a-5f075379d084", "value": "T1335301F15D43B2EFD41ACC34E275094CAAF39A3AA77E8A27173C557047C3A0596B2C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626860116, "uuid": "36291e8e-2a35-41c0-a93b-ef6a8ec419f7", "value": "1536:icLDNYJgd7cT2uN3KR99WHSFhRx7Q9A1WwpE9PD:xLDMgdYT2uY9gSrRxcZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626860116, "uuid": "9f2100df-1cfa-4dc0-8559-6d8c4d0c5256", "value": 64152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626860116, "uuid": "6e89955c-2129-48b3-aa72-7bd9c3b88d98", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626860116, "uuid": "f14af417-0b3a-401f-96ea-37073deb761a", "value": "62d60e5db3ea476b22b58c44eabb298b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1e83ca-e9fc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626855729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855729, "uuid": "206b29b1-eddd-4ce7-a59f-c6c8e7ce99e9", "comment": "Malware payload", "value": "c1f536666537f5a06d3fabaab3d9be65", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855729, "uuid": "fd77497c-5132-42d5-afc2-5254255360a9", "comment": "Malware payload", "value": "c91814a20e581ed58e22d44f441c195d471657ff36e97a4934abe9c603c16dfa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855729, "uuid": "aa5a02b2-8a37-4d27-b1ac-3a88a0a54389", "comment": "Malware payload", "value": "a8d4aca7a5691d7a3df47f354e76a6dbafa50002", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855729, "uuid": "49fcdf38-60cc-4f1d-a239-d74de274b016", "comment": "Malware payload", "value": "1d3ccc0ebe7897bac5ed6cda054cbec4c552d9c01676178d87913bc1cf444d853ab3966f9203bac270863408d18f804a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855729, "uuid": "cd5d0b9f-8917-4f85-873c-25b16252b1c0", "value": "T1D831C0C3EC3C005171B7405E99178451EA86A157A72BAC27BFBCCEC43F7A974A4A07B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855729, "uuid": "330176a7-85bf-4f05-b7d8-8079e650bc45", "value": "24:45km2XIoX3ddfW7C9WvuZfioLkOYPTyHNy1SdRbw9U+ciLiBAxdHVH7gFjUfA7w/:4oTX3vMcioLkOYoTdRbw9GnYAcv5e7pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626855729, "uuid": "245b1e98-fa5c-482a-b029-eac346bf9346", "value": 1749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626855729, "uuid": "59240deb-9f7a-4ecd-8c78-9d6422b17700", "value": "text/x-script.python", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855729, "uuid": "b6fe545b-2f75-47ff-9f1f-e5a3694bdba7", "value": "YJHLZX.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65deee1a-ea54-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626893377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893377, "uuid": "69c7616b-a212-4de4-b66f-a6a2829b8962", "comment": "Malware payload", "value": "2c224577bf79c043800a200f474bb441", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893377, "uuid": "08972bff-2df3-4f2e-a2d5-da6348b090ac", "comment": "Malware payload", "value": "ca92051ba1da055bad08b16fddb1d65af97d7bce1cefbcdb0cb663a1703e6b99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893377, "uuid": "9769bec1-7ac8-4ad2-a0f2-5fee11ed2ccd", "comment": "Malware payload", "value": "4c5a1f02deaa523f2efdf6b7761ae18073111a22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893377, "uuid": "daad14ca-e3af-4e14-8022-0584e1189cea", "comment": "Malware payload", "value": "0cdaa34eff02b8bf696b7a992bf60f547a8a7e5c777ea0820aad70e78fc17974372b8c6ed182e5144954738dd9ecd6fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893377, "uuid": "47d9b1f2-c908-447c-8f1f-7eebd7182bb4", "value": "T15755F03944944A63C672A1B3DA69F701FEF35A9272319D19539BEA830F2340366CEF1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893377, "uuid": "ef70fe92-4321-4668-9cbe-d64c45e7ac84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893377, "uuid": "5561c90b-2bf3-4f96-afc3-62451d5de961", "value": "24576:7H5cArAD1gDG8odXupXBcFnb+HcwC75fpWvhyz/wBUGMbqLdmzb:BrAhqNoxupXBmniHcH7OyzVGySAzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626893377, "uuid": "2eae52b9-7894-451f-a3c8-80110ed8fc7d", "value": 1344512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626893377, "uuid": "c4c50917-5d9d-44eb-b59e-e46bb38b276b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893377, "uuid": "12a8119a-22bd-46e0-ad11-e0564a5beada", "value": "PRODUCTS NEEDED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580e2f94-ea7a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626909674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909674, "uuid": "8a2c7f7e-4692-46b0-9676-0945422410a3", "comment": "Malware payload (RedLineStealer)", "value": "59f3f9d13f2bdfe94922bfaf59ce1f7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909674, "uuid": "61e7975b-34ed-4c45-9769-d124abd12051", "comment": "Malware payload (RedLineStealer)", "value": "cacc3559c7ae7b8f5a4210016f13b9fbfe2a1d457edb4b013a5b5434956174e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909674, "uuid": "a804e325-3d20-4046-8fa1-af081cb03969", "comment": "Malware payload (RedLineStealer)", "value": "b27083417010591f72a752dfc720ac46d3680117", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909674, "uuid": "df76e976-fd0f-4312-843b-de6928b60d1e", "comment": "Malware payload (RedLineStealer)", "value": "345cf587717729982080e2d2d66183acbd5985e8ea95f4a2a30553c6f2b2f0c5339859746ddf4e9509bec50d9223edf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909674, "uuid": "50aac776-da73-47e7-a467-f2440e181b6b", "value": "T124C4FE2866BFC009C4A7EAB12DDC98BBD99994A3640D713311B9633B4F52794DF0F0B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909674, "uuid": "09367bf7-5ed5-461c-846b-b9147e17ecff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909674, "uuid": "7912d3d2-1f78-4669-8dae-c84eb13b21c1", "value": "12288:WSonQeXJBalve212zxIc9fXW0JtTOIbfOuSES5aYIw0oz+:tKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626909674, "uuid": "fbac1c8e-4624-47ef-ba7b-a7f95f52d192", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626909674, "uuid": "ddad0102-dc71-4a64-aafb-15133b8c0746", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909674, "uuid": "a9cbdd00-d4e7-46fc-8d3a-f0b797769fe8", "value": "CACC3559C7AE7B8F5A4210016F13B9FBFE2A1D457EDB4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f06600-ea44-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626886392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886392, "uuid": "46ff0273-5a5c-4afc-8cfc-54c1e93f43a3", "comment": "Malware payload (RaccoonStealer)", "value": "0fb3a2f1fc33bfa7679bc431c14bda58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886392, "uuid": "fce0b14a-5612-47c9-a63a-12dce8e2be91", "comment": "Malware payload (RaccoonStealer)", "value": "cb00c6d4692dba24ced86cb2c28685c5fba1a05492b1a6454c1cf92d6b2f99eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886392, "uuid": "a61a3fe5-b3f9-4d02-806d-af1d11d19ccd", "comment": "Malware payload (RaccoonStealer)", "value": "9acfa3fdef04e3fa0020a178a792c53e67d5f61f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626886392, "uuid": "ed2909b9-f7f8-43c3-8910-25a9da8dddfd", "comment": "Malware payload (RaccoonStealer)", "value": "a3e7202a6ea55c0ba5b797d1a121ef015db95a7fbef093c6db621ac160488fda280c8d51296cff9b402bec44e7cbca62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626886392, "uuid": "66480911-6b75-4fcc-9ff3-0cf165acbbeb", "value": "T163B40190B6D0C471D2A24D3258E3C2A0AA7EFC26BD7E4547766477DF2E323C15A6E306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626886392, "uuid": "fd16cb85-0301-4915-9375-438f9fedb9de", "value": "010b99662693ba25ba201961c31754d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626886392, "uuid": "e800d498-0703-4a33-bdb8-092707bd75c7", "value": "12288:j8YQiCftQ/p5oYThPuGUjFnLRTLNwT0lB6yvLhm2ld:gHicQ/vo8hPuNxntfNwT0myvLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626886392, "uuid": "967c8496-0c1b-4589-ac52-fc11caf20081", "value": 521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626886392, "uuid": "e7100453-185a-405c-b3d2-d51d828f4076", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626886392, "uuid": "8bdea825-e257-44db-b6ca-03b8bf3b6e5c", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.3056.28487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee89764-ea58-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626895190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895190, "uuid": "276ec02e-c22d-414d-a5c0-f3bd537caacf", "comment": "Malware payload (RedLineStealer)", "value": "f859381cc1f43adaaefea79f640d9f3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895190, "uuid": "bb1db5cf-8b5e-4458-a3bf-fd56cf1056a1", "comment": "Malware payload (RedLineStealer)", "value": "cb9bdcab060d8b91eafa1dd442464cea40aa7a6547c02a4483f113f49c50ab18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895190, "uuid": "722f74a3-35fa-4b45-b229-e4061cc5a780", "comment": "Malware payload (RedLineStealer)", "value": "d3b16cf09004f93976e9523cdb74f002ee443b68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895190, "uuid": "bb9e4cc8-c5dd-4a2d-b1a8-a6881ad338d6", "comment": "Malware payload (RedLineStealer)", "value": "c634e6b558971e6e22d62eafaaeb399f09642529473629b5a3a34bd0432cacdc4fc4d31372a0510c476c0148eeee3a93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895190, "uuid": "b0ca9cd2-65df-4d5d-9b18-c46e5de90a93", "value": "T1B7344A9A7794794CC47E0530C08753A07EB688852622CE55EBFA331F8EB73D6C94CA9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895190, "uuid": "db5ab5e4-2b67-4526-b260-37365490abf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895190, "uuid": "247ac9d7-5c36-4e03-8734-faa612db53bf", "value": "6144:RgXjsh/qA4QcKuR+9//JmXEyy5LtzEHVT:RgXo/qAfc2kXEvRzEHVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626895190, "uuid": "0f567f63-6506-4d8c-8f1d-3b7ba0bf811b", "value": 252072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626895190, "uuid": "2337191c-e98b-427f-ab58-6e0cc387b5f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895190, "uuid": "7dd29c1a-9355-4449-a8cf-32360cf6ef82", "value": "f859381cc1f43adaaefea79f640d9f3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609031ad-ea4e-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626890791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890791, "uuid": "955abfa6-3556-4e9f-84d2-036db8b6c235", "comment": "Malware payload (NanoCore)", "value": "fb64fc2471a48928b7989f7e959de261", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890791, "uuid": "0e61dc22-84f0-461e-864d-8836711d4bec", "comment": "Malware payload (NanoCore)", "value": "cc536d630284e622821d1034fadec488cb35dc72bdfb75edbd184a638d052f98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890791, "uuid": "1df26139-3770-4304-9a54-23859790822f", "comment": "Malware payload (NanoCore)", "value": "334f95083ee83d20255b87e0bfd4aae86a922d20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890791, "uuid": "bc932307-afa0-4248-b573-3c595ea45699", "comment": "Malware payload (NanoCore)", "value": "407a2d6ebd95e75ac5fb632834fd45958bae0982977354293893947d67523317612e5ed05f05df04565889cbeea98412", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890791, "uuid": "79b724c9-3462-42c2-8f15-36f3909fde8a", "value": "T1A61522708F73D5EAEEA6413F617F0AA54D712D13C4C92DECA67239940A0BE154F0A4EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890791, "uuid": "d04a3df1-0e4c-40cc-b5ff-9d209650749c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890791, "uuid": "98bbcb21-fa15-4774-8a62-0a411694e590", "value": "24576:6ULRbkn8PjhH42j74d8BAk1t1L+PRUyplVnv:6atkAY2YapQUypbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890791, "uuid": "78fa4fb4-a1ea-488d-a054-e47df7eee8c2", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890791, "uuid": "518ab237-a429-4f70-a37a-cbb115c2d658", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890791, "uuid": "d49383ff-7bd5-4138-8e73-cbd871467d85", "value": "fb64fc2471a48928b7989f7e959de261.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef6d144-ea23-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626872186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872186, "uuid": "86e79892-5c19-4da2-9d25-6789ca93155f", "comment": "Malware payload (AgentTesla)", "value": "f27898a18dd4d0241060d198b6d68c57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872186, "uuid": "c43553af-e676-4f3a-a575-b51e599b5acb", "comment": "Malware payload (AgentTesla)", "value": "d0161531f5293cd6ed32289dbdcac085c08fcb305d66f0905f2ec10fbd6be956", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872186, "uuid": "d4b2344a-1cbc-4fb5-a4ee-6b2090122328", "comment": "Malware payload (AgentTesla)", "value": "e8a2fa6dd96259f1c1a14d7ef7dabf3a02072dc9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872186, "uuid": "f21b25de-b7b6-4a9e-8954-a88fc8da1651", "comment": "Malware payload (AgentTesla)", "value": "d8a9a6b8cd537207d7229b290206051625a21ab08e1f99a01d734670426ca2b538f0860dedddc46d972c8bfe4a7c1c38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872186, "uuid": "d1cd9b37-d862-4ca4-8042-0eb1cfe38fb0", "value": "T18BF412B04A63DEE2DE165A3F623B06620C311D2BC0584C9DA76239DC3A5FD575F0A4AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872186, "uuid": "c82af826-3edd-4f4d-952a-ed3de0239342", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872186, "uuid": "85622d15-85f2-485c-a17d-5e2cfc25c32f", "value": "12288:jvFWssZm5qy2FRbaXjdMvknHmEFTmi98A70pIASvGUusoTFw+iBl3Jloz6E0nMm:/ULRbkGbEFKi98A7tvuvC+iro8nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626872186, "uuid": "ca7b765b-400c-47bb-af5b-606849bec110", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626872186, "uuid": "e6948158-28ff-4922-834f-0f6457fdf5ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872186, "uuid": "38c9a6a2-83d0-46bc-8504-9e920e33f20c", "value": "microD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a796c6b0-ea28-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626874589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626874589, "uuid": "14141d49-384d-43c6-98e2-f38b93a38cb9", "comment": "Malware payload (TrickBot)", "value": "917e3c54104affcbe521e23e85517bb0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626874589, "uuid": "8f0d4574-a26a-42ea-869d-b9359a132a1c", "comment": "Malware payload (TrickBot)", "value": "d06c5ec5cefe2c6b80bf532cae9c270f2e25f0f2c5e6b05cffa36fe8a17dac3c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626874589, "uuid": "cdd20b1f-a579-44a0-92eb-6b57a747a98f", "comment": "Malware payload (TrickBot)", "value": "1bffd59bd2618f7ef810c02e9ddbc2011949e251", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626874589, "uuid": "5186d650-c9a0-4a9a-8c89-21c8a5efd5f1", "comment": "Malware payload (TrickBot)", "value": "a6a84d02af7c2e60b09cd033d2df3f692e07b32c03c2ce5ed304617b9e11bf7c7954b0c261d8961dacde9dd1728330bb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626874589, "uuid": "c770c2bc-c0d8-4848-9829-2696430c7e6b", "value": "T152D4C012B590D036D29F01383E515B79B2EFA9A01BF1D463E7F0DB5C8D329825E3B25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626874589, "uuid": "8d46a97c-1796-4e87-9258-a8113a26bcf2", "value": "aa766223dad1548ddba0e06749dd8601", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626874589, "uuid": "c20033d0-0f2d-4988-ad87-a2f697bc8403", "value": "12288:t7NI5iGRtGvUw0mKBMtd8gzyYhJ/W2s2dFS8J:7YRtGvUmqI82yYf/WelJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626874589, "uuid": "f8b4b170-68d3-48fe-bd18-800d688c9171", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626874589, "uuid": "49e15778-a0b5-43cc-abf7-25880ba78ffa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626874589, "uuid": "20b751e1-ae51-4c0e-985d-f820558f19ae", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c65051-e9fc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626855722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855722, "uuid": "ed4f2d3d-487d-4eb8-b273-96cb26b6b13a", "comment": "Malware payload", "value": "21fe59134a16cdc774f6033cfe81d2c3", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855722, "uuid": "72f2f145-5758-4c24-af42-2d3f401dc419", "comment": "Malware payload", "value": "d1ae3ed0e65a3e85becdaea040af72e64f84aaf2e97dd62ba55639a81265d46d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855722, "uuid": "bdce3ecd-fbca-4dd0-96f0-1fe5e4b6089c", "comment": "Malware payload", "value": "30fe926526cdbcb9598c2d263b90dc6a959d5fe6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855722, "uuid": "b73cb74d-6997-4882-bcd6-b73a6ea2946f", "comment": "Malware payload", "value": "b0a2cba0daeb0b597554a748f9f884026ab000f0b071558d694d3569652b6cd8a6395ad87c8945657e744758df886cca", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855722, "uuid": "982e810e-eccc-488d-a1f0-479c7a668bc1", "value": "T15F35E122B9C68036C2B327B15E7EF769963D6D260336D29727C83D315EB04816B39763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855722, "uuid": "4efcf834-27ce-4081-8978-a9c378038580", "value": "24576:nEnRmJkcoQricOIQxiZY1ia/AGh1M9q7I0dMZIDL:nEMJZoQrbTFZY1ia/AwMshgID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626855722, "uuid": "bcc7ca4f-9be9-4fe6-89ee-cc2576473a43", "value": 1163264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626855722, "uuid": "b82bb9e2-d2ff-4877-94dc-9774b72f315a", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855722, "uuid": "a3eaa68c-c9e0-4dbe-8b56-a987b404184e", "value": "cgdifn.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbfad59-ea23-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626872529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872529, "uuid": "e9d8a230-cff4-4bb9-a599-0ecfea5ed830", "comment": "Malware payload (SnakeKeylogger)", "value": "aee648a732fbc5c9b5130915d42b3f23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872529, "uuid": "17eabfcd-63c8-4d81-8d22-a1551e70735a", "comment": "Malware payload (SnakeKeylogger)", "value": "d1ebb1368f129b5ee1f5ca2e8460b6a748a01e57f7cd6eddd80a5340368cccaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872529, "uuid": "4e8c2e35-5004-41f4-8da2-11579d8fe2ed", "comment": "Malware payload (SnakeKeylogger)", "value": "9602b721a17f12326c0ba67323a9734f71417425", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872529, "uuid": "0f46b5bd-6d3a-4b92-b485-53379be51568", "comment": "Malware payload (SnakeKeylogger)", "value": "9e102b6677c619c5bfa8fc610d1ee0973bd25970de578d2c5514aad687deabee4e4c9b797ad11aea437fd6018ab0da7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872529, "uuid": "af8377ed-32ce-4c29-bc85-7ac00bd16582", "value": "T17505BF3113ABA684ED3E67B88838C14597FB7016C67FE72D2C8440FE2E72751AA57346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872529, "uuid": "02844726-c330-42d6-901e-b6783d777e7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872529, "uuid": "3bff48aa-b030-42b5-9c50-a21e94a5904f", "value": "12288:toWZDwigpLqjH9Z8wyvUIZbVO+H6EjTcnUsu35dqwQIYj5Eo6dQiDi7t:3gpLqOvDBFaEjTeUdJhpNoviDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626872529, "uuid": "89c2e5c6-9942-4407-89cf-c93f74a956c6", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626872529, "uuid": "99646e55-d834-464e-89d3-840a7aec7dd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872529, "uuid": "038d9fb7-1790-4b31-9d6f-928f32c88d24", "value": "Aditi Tiwari Resume.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03936b0-ea59-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626895676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895676, "uuid": "92dfb014-c6b2-4899-a38b-3994643a6b52", "comment": "Malware payload", "value": "02993ff6b755930b93f2d1c4968d164e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895676, "uuid": "e8a6ec61-c149-4958-a274-571ac8d3ed3b", "comment": "Malware payload", "value": "d1f1dc5e97c6966a99c6f254cc040c8b01a7e9314b2afcb385d696aed260e501", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895676, "uuid": "2b49f408-6c89-4115-8d95-04c3e1edae5b", "comment": "Malware payload", "value": "66d5e6a747eed80af0cd0405ce6ea3c916066b48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895676, "uuid": "26779498-6563-42ba-8e2a-37583f28bf02", "comment": "Malware payload", "value": "2aa1e76f7b77c77b823c8b43759e3aee2b1e4983bdf015fbb3919f1dadb1bc8da4df47fc3b517d7aaa3fd331cbe5e8b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895676, "uuid": "e558aa78-1726-42a6-b527-33f6b45da0fe", "value": "T1A5767D03F8A614F9DAFEF13085A193227A717C6943327B831F9546AA1666FD47B3E340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895676, "uuid": "82b45323-8338-4447-8243-e6b3dd31d0be", "value": "1cd364a9e949d5ecebd6c614e64bc545", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895676, "uuid": "4cd7219c-6b17-4f02-9d37-355fdf1771c7", "value": "196608:EEJQ+deRdW1H1dTW2zu0h0ZcsYCFoF4sIIm:/JPde3WN3u06csYCFgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626895676, "uuid": "6316c334-2857-464a-a79a-167aff19c3c3", "value": 7602176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626895676, "uuid": "db7d8905-82ce-453d-b63f-64a130cf36ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895676, "uuid": "ffea38c7-e9d0-4e75-bba9-dda26ff8ccb2", "value": "jyheeckptwa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aada5ba-ea50-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626891667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626891667, "uuid": "5a1c28d1-3a78-4631-8708-6ebc16375226", "comment": "Malware payload (Loki)", "value": "d308eadbac9ea8eb3b0d9ab1112419be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626891667, "uuid": "1a1e6bed-8e55-4a5e-ad95-d1d3c02ffcfb", "comment": "Malware payload (Loki)", "value": "d3b21861d2dbbae76b30b6c1253be0775c7ea63d183ded44f041a609cbd929c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626891667, "uuid": "7a778f19-77e3-4074-b73e-cb007b471809", "comment": "Malware payload (Loki)", "value": "afdbe9177f5a38d59197fac722fdd91f9c50c928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626891667, "uuid": "58bcee44-0a06-48dd-96c7-a71dc8ef3e7a", "comment": "Malware payload (Loki)", "value": "e87efbff8b691df5cc0d97ccf9093e80e9ea14da640e86d61582aa130b1b434128900d6b2defc2c9f3ab87f6b2011f41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626891667, "uuid": "ff62147f-b27f-40f3-aa78-a92b22fb07c8", "value": "T136358D264DCE4667C2744AB7D330EE01DEF14DAA2504EE152EC1F0AB9D3729A94DED0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626891667, "uuid": "a292d609-1230-4e67-b0ee-b90ab82de03c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626891667, "uuid": "ad55fa27-7e7e-438d-9b3b-76164df5763b", "value": "12288:LKEvPYcl43oy3rfdW5dqm+FEYv1dXIlrh+b1xkXtFyNefbJjWSAFQipP5o:g3oUdsdqmCIO1otkWNfipO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626891667, "uuid": "8d001d6a-3476-4a77-87a8-064c4f82c055", "value": 1083904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626891667, "uuid": "83c39394-7681-4dc7-b874-f1a7f81798c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626891667, "uuid": "e9638cab-2e38-4743-a4ce-499959d0e1ab", "value": "aviso de pago.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a193149f-ea66-11eb-875b-42010a9c0053", "comment": "Malware payload (Pony)", "timestamp": 1626901208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901208, "uuid": "4d853726-63a6-4ad0-9424-e16b9ae57336", "comment": "Malware payload (Pony)", "value": "3ce66caa331cbde38b08ac28665057ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901208, "uuid": "0546f6d0-3153-4de3-b1f8-669c631ec684", "comment": "Malware payload (Pony)", "value": "d3e8a314209b568a8161c36aba3c799860ec55c867a4d9ded2183657d0e37eed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901208, "uuid": "d63835ec-dfd5-41fa-87e7-24d57d797cf7", "comment": "Malware payload (Pony)", "value": "65113ab42af92d2888005f77a38f319ae7957583", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901208, "uuid": "da961ed6-f750-4106-905f-7c729474c01e", "comment": "Malware payload (Pony)", "value": "7b9d5d082f3251d5f2c9693b05d549801b5654e546f8dd5b483152608d30e2d12973cee0a3eb6a693ccbbd32eab16561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901208, "uuid": "8bb29cd9-90b0-4103-bdcf-141ab2726c8d", "value": "T17375C01317E3BA3FF25A167B0CE801A871467B727EA3CE43B921A8F7855644D335468B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901208, "uuid": "17fb3fc8-9c01-4b90-a8fc-5071d7f00fb8", "value": "4e0949dfb15fa89be19c9b90d78b6864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901208, "uuid": "21b39b30-9b85-4a7c-af50-5194369c7837", "value": "12288:R4TZJHtqPRx+9Bvw6VjWVmzafcWf/rKpHGAcKEZUiX:RmJHjDpiNnGpHGFPZUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626901208, "uuid": "194fe4b2-fcff-42e4-8983-7a04005cc497", "value": 1703936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626901208, "uuid": "76a20712-e10a-4cd0-9fac-3b4258b10b95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901208, "uuid": "0cf7d733-47bf-45dc-9051-13577601d617", "value": "3CE66CAA331CBDE38B08AC28665057ED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049a4821-ea0c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626862290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626862290, "uuid": "cc0d98f2-0be2-4367-9a0d-30ac972ff4b7", "comment": "Malware payload (Mirai)", "value": "b488f50972adf22189eb3d910e3f68fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626862290, "uuid": "a4484040-967f-4c5e-a700-f4e6617bfd80", "comment": "Malware payload (Mirai)", "value": "d5c38a8932bd501540ef17ae89edff1083566d265eafc0af34d2f1ef1f29d167", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626862290, "uuid": "4a80a09e-9f78-4360-a9d1-08f5cc3fea01", "comment": "Malware payload (Mirai)", "value": "01ed3bbd4e3962e7445bea0017bfe1318e896596", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626862290, "uuid": "5c605a2c-91b1-4867-a060-b468f6a1cfef", "comment": "Malware payload (Mirai)", "value": "2d3dbeb306f90181c1ca1895bfe7fca2e69ee81ab442b41c5fc7e193c5f3df08bbf02c12a4b8b8ba697aa7d05c34dfb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626862290, "uuid": "d48684e4-4272-4723-87b8-9273a115c31d", "value": "T19D93800AAF611FF7E89EDC374AD92B0524DD511A20AD7B39B930D818F25B30F19E3865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626862290, "uuid": "e718487e-64b5-4d56-869b-e570301fe95b", "value": "1536:NYCYxrXP40ODyPwHRQ9PlzTRfyToNoZqNi:qCYxrKDy46NC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626862290, "uuid": "836d9c27-f279-4f38-bff8-af12b87f5406", "value": 92100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626862290, "uuid": "d9b734f4-df50-4878-892c-e6e1fde277fe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626862290, "uuid": "6069f666-6026-45c2-a40b-3cf7af21cd24", "value": "b488f50972adf22189eb3d910e3f68fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b97df0-ea60-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626898765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898765, "uuid": "ec453a27-0ebc-49f7-8ede-10b81f8abe85", "comment": "Malware payload (Mirai)", "value": "4790714f69fa9745ba3397ba0a5db322", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898765, "uuid": "57f825dc-ced3-4cf7-b344-d30d41dab875", "comment": "Malware payload (Mirai)", "value": "d5f3c6a27d2c4816ce12480235d7a4f8337e2565521b388c7082508c02993895", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898765, "uuid": "64b8b71c-3908-453b-b3d2-bed00105fce9", "comment": "Malware payload (Mirai)", "value": "8326164f3e5bab40439f0b63a53cd2fb00568cca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626898765, "uuid": "efb53f9b-6de7-4462-bcce-48dd180e5b6a", "comment": "Malware payload (Mirai)", "value": "4c491fb113527537b09bd9ff856c3ba1da3a29922c2cb3f54457a52ee39a81afa1a4aca0fe4a26503f6f44cf4d9f4a7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898765, "uuid": "b801e3d3-c21c-4ca8-95a2-16f3037c9554", "value": "T163D2E1026241FEE1C5B00231DD668A9772257E79D0D134FBD63C0EF8A6E9A1D47F8A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898765, "uuid": "f4652ca2-baf0-4774-ac2c-69b4eaba7e63", "value": "768:tusHfRavjynNKnjFcZIhQzhKMXgC39q3UEL7B:9RwynNIOQQ1KMwzLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626898765, "uuid": "a19b2734-df80-40f3-b458-237618395696", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626898765, "uuid": "c3c3a767-e799-4da7-94f7-a96c19228c29", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626898765, "uuid": "9e153ee4-9f46-483a-9e4b-7b7b67639bfd", "value": "4790714f69fa9745ba3397ba0a5db322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff982917-ea78-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626909097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909097, "uuid": "056c2037-c988-42bc-a835-9522b07d03d7", "comment": "Malware payload (Mirai)", "value": "49bacaf6e21e0a926a208b16db902efc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909097, "uuid": "3411666b-9ec9-484a-aa9d-9d3ba655c14f", "comment": "Malware payload (Mirai)", "value": "d6719d954d607a1310c5ecd6ab915a68371427e97310da67e33fa954ec656abf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909097, "uuid": "1677033c-fbff-4e1b-ab12-5b5e43259f60", "comment": "Malware payload (Mirai)", "value": "c7908d60bcae4c15f42d51c9ee4ca98197382263", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626909097, "uuid": "eaf87cbf-6c07-4d3d-affb-419a20dd63e2", "comment": "Malware payload (Mirai)", "value": "cfb5508d6772607e02fce453c02866e234383d9b93a05fe9cb8fc40fc1209eaec7b6e00dd33a10ab905645ccfc7686e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909097, "uuid": "ef7b850b-df7b-41be-92c9-622af75e8db0", "value": "T1B3435B02725C0E47E1662EF5293F1BE083EEED9011F4F585264FFA4A8676E77014AE9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909097, "uuid": "aa33956b-b581-4216-9d8e-16d3ad7262d7", "value": "768:NrbN7d3vRLWzhSW6RifQ9GKQSlNv92NF0q7zQXyx6W8gte+FiiT1+:Td4zhkEL0Mc1gte+kiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626909097, "uuid": "3bdc54d6-aeaa-4a76-bfd0-07f43d605637", "value": 58612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626909097, "uuid": "fc9146e4-36ee-4a42-931d-367f3280cc1f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626909097, "uuid": "b93444cd-bb91-4da2-915d-e557cb723244", "value": "49bacaf6e21e0a926a208b16db902efc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e16454-ea14-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626866127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626866127, "uuid": "eb1f21c8-be89-4a5f-a22b-650947fb09ad", "comment": "Malware payload (RaccoonStealer)", "value": "d16cdc18bb0eaa54bd5fa027a8081ffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626866127, "uuid": "ca865e14-901b-4be7-8cd2-ebfe58e46230", "comment": "Malware payload (RaccoonStealer)", "value": "d6907c6b017e06a1fbe8ca89190beb214916d62cb43c75ce596c29321c4b01af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626866127, "uuid": "29e6ef62-fe4b-451f-9522-b22b10860878", "comment": "Malware payload (RaccoonStealer)", "value": "adcfc23e9f49f43af85853981cf656c79077d262", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626866127, "uuid": "b24dafa6-c712-43a0-a2b0-cf021e6889aa", "comment": "Malware payload (RaccoonStealer)", "value": "f501e3f31af9c1331732a52e85a0cffc7e047107a016f54e9323d8dc266b15bdc816bafe1f9294dbfb6225a1c1711cdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626866127, "uuid": "16e17865-950c-4ee3-9d01-699d8b411066", "value": "T1F5050121E1D1B87BDE8D30FAD5A9C7FB7C6C64708FA021DB93A85D4D62B62D060B05D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626866127, "uuid": "cb992cdd-b4a7-40dc-b6f2-2eba9a0a032d", "value": "b59594dfc068d58636c83d19481c521f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626866127, "uuid": "db3848e6-a59d-4c90-908e-15ae19fcf8db", "value": "12288:eCd30NAt7btw+x3DC629r/AARVCTSuibiQvO8zNs5lzFMUybeHT5kK:BdENAZxwiCXr/AARu1QW8zC5xqUpzeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626866127, "uuid": "56c7cc56-169f-457d-9414-84c10a76b1fa", "value": 846852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626866127, "uuid": "0ea2bb66-4b22-4bd8-9999-18daaeb32c8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626866127, "uuid": "dfaa3622-d173-4c3d-8823-e6642414f8e2", "value": "d6907c6b017e06a1fbe8ca89190beb214916d62cb43c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b485f9f0-e9fc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626855713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855713, "uuid": "a1a8444d-4527-43ff-843c-ffd7a1042da6", "comment": "Malware payload", "value": "d68d75b1a3de31aa8ab8a0884cbf7417", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855713, "uuid": "4828c951-4566-468b-9428-e833bbd1234c", "comment": "Malware payload", "value": "d6cf06cd34f50317131591268d23ef266c01bf3f758893568f10204825cc3369", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855713, "uuid": "698fa819-8835-41c6-9b8f-c2d5007e9c1e", "comment": "Malware payload", "value": "c69c51d524cf871794ece1d1eef2181c0938f208", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855713, "uuid": "97ad06a1-8d67-4c30-a95d-bcf58cb0f923", "comment": "Malware payload", "value": "54321be8cfe9905f076b5267f2c1a9af0355632c2ac26b3ff5df24230ffdc249e308ec2c140b5cd4cac4b314f430248f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855713, "uuid": "bc7c8b84-590f-4975-ba6d-5e7df1a4f44f", "value": "T10C058D86F74AF863C9F7C63A4775C66AD6064C544B03D7431A85723C1ABBAC09B89FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855713, "uuid": "76a7d642-23ea-4dda-a3cb-25f3e6ec62b3", "value": "12288:x7u/0HH5jq6pA10Ys18L2hEKbIgVWSoEQWPvdVDqFntOS37C:x7I0HHY6pAWJ10GLIDSoEBvdJCp37C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626855713, "uuid": "29d81f04-20f3-45f7-b596-71d323309867", "value": 871971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626855713, "uuid": "76545b09-5555-47be-9f39-a2455924b9c5", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855713, "uuid": "3ca5a54b-8bc3-49f1-964a-d7644ddeec42", "value": "Corona App.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595e304e-ea78-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626908818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908818, "uuid": "8b86c926-7c21-4c61-a327-353d8f042797", "comment": "Malware payload (Mirai)", "value": "335e9ccfe1ac9ee7c881437201690ad4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908818, "uuid": "feca3033-2a57-4f83-afe2-cc85d716b75c", "comment": "Malware payload (Mirai)", "value": "d71e3885003d806abdc638f3d8e46583eb9b9aa9e853b6213da264b0ae1a3e14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908818, "uuid": "3dfdde9c-f3b4-416e-85a5-b23574b04a5f", "comment": "Malware payload (Mirai)", "value": "3cba38a5610585d5ef60f19e1c331ddf79897b21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908818, "uuid": "5c0965c0-7a54-445a-bb70-4bea568bb4d3", "comment": "Malware payload (Mirai)", "value": "d0ef70c599c2abb0dbe04f381bc598c379a8fa96648174c4698069177f27fd548fd9a8e76cdba9f4404dadcaf093112c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908818, "uuid": "d3865ac9-af91-49cf-90b9-4d5d570e8fe4", "value": "T128739109AFA10FF7E8AFCC3749E81B4528CD651A21A93B75B934E418F24B64B15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908818, "uuid": "f852e750-a834-4f91-bca8-1fe05c436bc2", "value": "1536:+MNC3NQQvB53XRqmpo3UnrE8VbZMXPRi:JNC32QJpBXTVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626908818, "uuid": "2e6e81fd-f7b8-4843-8ee3-8e020fea52a9", "value": 80312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626908818, "uuid": "ea821200-2a24-4b58-b41f-6e06003b37a6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908818, "uuid": "3b4a03da-0ee1-4e22-bb7b-690125e89775", "value": "335e9ccfe1ac9ee7c881437201690ad4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88ec60f-ea3a-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1626882349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626882349, "uuid": "b24dc635-e86d-48e0-a165-f718567e1efc", "comment": "Malware payload (RemcosRAT)", "value": "fac63388180400b3674a1721b2edd8b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626882349, "uuid": "5b58555d-02c1-4143-a0ce-7b9b40ff2fbe", "comment": "Malware payload (RemcosRAT)", "value": "d8d1848fcde25e0975a524cb62ef2d622997caacbee10038cb4b49b23b76d484", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626882349, "uuid": "bd0ed614-d8bf-4e40-b8e3-bde702fcc15b", "comment": "Malware payload (RemcosRAT)", "value": "c05421fac7a45cf84a983b561022564652d39480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626882349, "uuid": "42247bc3-c379-4888-9982-eec206dd3b16", "comment": "Malware payload (RemcosRAT)", "value": "5cb73d1291036660c115ee7ac85bd704daee3bea9d00b56499bfdf7443ab1518747c39e79e3891aaa1c788590a00608e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626882349, "uuid": "c3d309d4-4fe2-4c05-aeea-1e5a2aa022c9", "value": "T1E325AE23B6C29833D163193CAD5B1779E922BD226D5424863BF43D889F7D6D278362C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626882349, "uuid": "6d695a55-1ac3-46fd-89ad-953e5c05fbaa", "value": "2c32ac23e13b112e3e03fd714ff79b1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626882349, "uuid": "c5044409-be22-498f-a71c-185c95af2d28", "value": "12288:a1SrPE0bpFJ1P3JOV4NijdKqyfdIJWV4Ko1Mv/OW5d5QQRSsg7/Ssdpk6dzsSU:a1AT1VP4Dd2dcuSImW5fVSJ764zsSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626882349, "uuid": "0b9883fb-f1c9-4b9b-a443-2002eba7951e", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626882349, "uuid": "041a2043-f50d-45be-972e-0b8efc852f23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626882349, "uuid": "5226491b-2158-4024-a11d-95d99ed40150", "value": "documentos de env\u00edo 21 de julio de 2021,pdf.e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207fd166-ea7e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626911299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626911299, "uuid": "f2b3fa1e-0607-4c81-9202-8eeeaf657692", "comment": "Malware payload", "value": "c49fb42eafdcf7e2b1bd428ecede8924", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626911299, "uuid": "b6a23d67-e0be-4f00-8575-a4a149dc5ab9", "comment": "Malware payload", "value": "db23b14320b86c540aea73f5475aef99369e0608b76307244d9770e6a807a945", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626911299, "uuid": "af928854-dc92-4506-aca4-38bce57e5db9", "comment": "Malware payload", "value": "66f5e4204081659a73d2910b26a5c8be137fff08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626911299, "uuid": "7f81cdbf-d6c9-4926-b404-80360c3e57e9", "comment": "Malware payload", "value": "6b891943e28a722ef475ff559121b940dcf00bcd49d60e55f8883805d8fd2ac491f2a84012ff143f0a56d5639a464609", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626911299, "uuid": "3b7e1347-2462-444e-a429-5d42ca9a89ed", "value": "T12005E011EF70A03BEDD342F6DBFA89B8FE245E50034450DB41F4F4A90B6A1E1A936B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626911299, "uuid": "775beb78-8b8f-42a0-b95c-da05221bbcaa", "value": "d2febb6e3520c065d9a86f5e4da61ac0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626911299, "uuid": "e07de733-3831-46fa-8bd8-46cae4629e3d", "value": "6144:rpOoQGRUdhpsRa8xAv63irwS5/NllSuWF5KvQ8HWqENm+5b2iSP2Re8J2or:9cKUdgRTxq9LOuiAI82qEY+vkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626911299, "uuid": "249b161b-958a-44cc-9235-5a57851883e0", "value": 854416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626911299, "uuid": "ef718974-f6d3-4fa4-af19-cfd93ed27546", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626911299, "uuid": "9f9d1aee-c30e-4449-bde1-4fd20f85b31d", "value": "c49fb42eafdcf7e2b1bd428ecede8924", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56052c7c-ea78-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626908812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908812, "uuid": "9b189b34-733f-474a-bc59-74f57fad35d3", "comment": "Malware payload (Mirai)", "value": "53f4e6cd868db1b0da6af9a3b57ea6bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908812, "uuid": "ad9e68fe-d658-4d1e-bdf2-aa15d8339ad6", "comment": "Malware payload (Mirai)", "value": "de55ba23ab03ed33b6c770cc82dee0a0e0761a185a7bdbfb2fc8cb5168a4ff0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908812, "uuid": "df344c7a-5b38-4fa0-9a18-607509c3ae12", "comment": "Malware payload (Mirai)", "value": "45b4e79dafc5ca97545f32a1526f05366fec956a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908812, "uuid": "08859c6c-fc76-41c0-acf8-7fb552dc1bcd", "comment": "Malware payload (Mirai)", "value": "c5c39de58259aa879f0f43d15f26004a6dae0f8af3e89a93119ecb297410b8e657abb5615824462c9cefdfc01dd86d19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908812, "uuid": "cf297fd1-7d21-426d-8495-7083e681c4c2", "value": "T11B333BC5998BE8F9DC1105753176AF73A6B6EA7F2028EA93C39DA833DE02542D10335D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908812, "uuid": "fab6225d-5dbd-4cbc-acca-8e6c45b07900", "value": "768:WQCsyW9k3qvMZuVsfKPd+7VUIKqzPNLDDbBNLNzyqu3+PoG6pRXmf8p:WQCmk3qvMZNfKl+7VUIHvvduOspRA8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626908812, "uuid": "c1de432d-a516-4efe-92c0-9a87b340b379", "value": 54428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626908812, "uuid": "361623bb-7be2-41ef-a057-9cd70988cee0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908812, "uuid": "7a59bc73-6ed5-4d9a-9a5e-18f5d22f9672", "value": "53f4e6cd868db1b0da6af9a3b57ea6bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169e0f50-ea6c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626903552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903552, "uuid": "61b6a5a6-e836-464c-b368-6bb8b3880b20", "comment": "Malware payload", "value": "20377b9eaeb7b801d02a879e2575c727", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903552, "uuid": "1f842c66-623b-4fdb-a446-58a5841ba9b2", "comment": "Malware payload", "value": "df529e7fb2456c752fefb9b1733e1498d005f7616650bc2d6057582312b5adcc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903552, "uuid": "d3a4d745-f999-4717-8ae2-ef5b62727dc4", "comment": "Malware payload", "value": "b8efd329640805a46e1d72c0842f33575f7585cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626903552, "uuid": "6797df2d-deaf-4a38-a369-1761f9ebe814", "comment": "Malware payload", "value": "bb89e10f5721734ad533dfdd5fa076ff9b5df2b55418b4803ead5c939a28f95d834033d460fd6d2fc0ca048f1e190001", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903552, "uuid": "729a8a65-abf1-4898-aa56-cf7e06239c1a", "value": "T19D639E6072B18B35F97953F60472419057FABA8B642ADA1D1CDF30C94A3AF498721F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903552, "uuid": "78a03ad0-9061-484a-86ab-3733543c5a10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903552, "uuid": "9d6e02e1-814c-4924-9ae4-5cddecbc3ce3", "value": "1536:43LjihkbuN2ILjiz4eg+8VkeMkAo7pkSvP10v1:43LjihkbuN2ojizrgJVHL1kO1S1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626903552, "uuid": "1abf5623-dfba-440c-aa87-0af0856f6e35", "value": 72704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626903552, "uuid": "4b969460-2d65-4129-9c60-862ed364b611", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626903552, "uuid": "b85ebffa-eb57-4a39-a479-92ad826aa04f", "value": "20377b9eaeb7b801d02a879e2575c727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703cd240-ea1f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626870631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870631, "uuid": "ceb9cb75-28c0-4313-b145-c73979731f8b", "comment": "Malware payload", "value": "44ca80d3ef5c434975df6e1747936695", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870631, "uuid": "27698641-53d2-4eee-8139-92fc071598b8", "comment": "Malware payload", "value": "e13fb6156b386d9cea3a46c3835a97636ad0eeddda3b354f86f19915721638fc", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870631, "uuid": "9c70861b-d57f-41c8-8d6d-46852ae9bf89", "comment": "Malware payload", "value": "c498532c7dd6da7da44782e079116825a131b54f", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626870631, "uuid": "2471f17e-edb5-4667-9689-2478010744b7", "comment": "Malware payload", "value": "540110311e9ac951825d80267badfe9609abf62eaa50ca0855ee39fbcec81c8f559fe1419a1d39384b40fa59da2d0602", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870631, "uuid": "682370c1-3ec3-4c88-91e5-4981ac477920", "value": "T17546BE457BA860E4D27A8139C946861AD6717C421B614ECF316CFB5E2F337E39E3A312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870631, "uuid": "c19ccb9f-dd09-4e7c-a155-880d4c5ed087", "value": "98304:6Y5AobyLU4UUU3UUUtvFObnuijp2LU4UUU3UUUtvFOK8lQ3f53eyibmw8a0FDI:heLU4UUU3UUUhFObnuijp2LU4UUU3UUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626870631, "uuid": "d1994c44-5176-4286-bff0-5158e248759c", "value": 5865472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626870631, "uuid": "c6aef99c-d3d0-4825-ab4e-3dbb8279a30a", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626870631, "uuid": "60f44395-c0fa-4da0-b104-6ec81f74372c", "value": "banload.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8e462f-ea64-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626900263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900263, "uuid": "21c6aa38-0b4b-4d4f-ad78-fc50662855a7", "comment": "Malware payload", "value": "e27318b5d518aedb83accec2767fa87d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900263, "uuid": "bbce9cf6-fe11-439f-b3c8-38a79d20ac63", "comment": "Malware payload", "value": "e15a30747a6b21794d76525b32ee3c32521bb917839ae3b2519f4e174cfe107f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900263, "uuid": "c3473447-92f4-46d8-b52a-f3400ba3eb5c", "comment": "Malware payload", "value": "b66e7afa9b5c6bf8fa0634f0490b25c5cfd9d20e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900263, "uuid": "9f7e0abe-232d-4a1a-9bc5-5d86e09f7cb8", "comment": "Malware payload", "value": "5f20cc3a82a7c749f9f1c536c0bb767a0f3e410d2fcb98723f2ff0d49c8b0d2642f8644a320c33549bad4f8a90820f54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900263, "uuid": "736e8ce1-aa9e-4e99-9a45-9107d6555964", "value": "T15C648D763B8AC613E518073861EB9F3107D54ED6F831E6C7AF98326A8D30AD57C83658", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900263, "uuid": "5fb7d5e5-3fb3-4276-80f1-adb47f35b108", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900263, "uuid": "3865cf2c-2df0-4979-8d2a-f5e2524724fb", "value": "6144:FsnmNB+YHXC3URo4rIlKiDc2vRGH/65pRm2ST0rzTeIvIVn6uJD:FRSuwKi/RGfZ0rXeKmn62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626900263, "uuid": "7de05e1b-60f1-4105-99bc-28b97861603d", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626900263, "uuid": "52785600-db2d-4e32-b018-f5609336bd32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900263, "uuid": "34604da7-1af0-434c-928c-a591a3353ab2", "value": "e27318b5d518aedb83accec2767fa87d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997f2e39-e9fc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626855668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855668, "uuid": "ec9c1ac0-adfb-4849-a4a5-7e4a1045db09", "comment": "Malware payload", "value": "623a68c5c01d07896001c6b9f84bdfc0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855668, "uuid": "586b8a36-3c67-442c-a1d5-5f9df8ecb312", "comment": "Malware payload", "value": "e1b46d3d5cb232880efd189482c49882178db717994d3f3663dfe4eca843bfa0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855668, "uuid": "da52e14f-e806-4f75-abbf-62f9a55eeb09", "comment": "Malware payload", "value": "b3665e9ba822ea05683906bc3baf88c5d44e9c49", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626855668, "uuid": "d3187399-a0bb-490f-a84d-60cd374e595c", "comment": "Malware payload", "value": "a1a9f49bb4afe9d70d77ad6d671b96d31af1672ec2ff9b85c36d1cc1642f3e5878a4acd29b92574ad40a8729f8bdb4c6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855668, "uuid": "493ae39b-7b82-40c9-a4f7-bf605a5b74fa", "value": "T18595E086F7C9A46FEDF3C3364776469A96024C5A8B43D3574A94B13C0DB79C08E4AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855668, "uuid": "67fc510d-6bea-4788-bea0-9b85a7916ffb", "value": "49152:See3lHOdSXZa8Obvzd8zKGc71SiOLBVPLqAo5YgwQzc:SxlHASFOV8zDc71SrLBVPLRorI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626855668, "uuid": "07ad9355-53c2-4729-af23-bcf0f9320892", "value": 2039509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626855668, "uuid": "7cbc10a9-9634-4a7f-b199-6b16003db6a0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626855668, "uuid": "7012d8a2-7274-47a3-942a-80460536d29b", "value": "Claro Security.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b23008-ea5d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626897463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626897463, "uuid": "fa206cec-2754-4cec-9c33-7ce194799579", "comment": "Malware payload (Dridex)", "value": "45d9d9c13a4b2f77a5635a64cd58bd03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626897463, "uuid": "18d3cd85-21f7-4ea7-a80d-ac747f198889", "comment": "Malware payload (Dridex)", "value": "e26c7e7c111e41d766ab313e1c4c0f17cbc9710aee23248b017735caf97f2a0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626897463, "uuid": "70be1d17-bde4-416c-989d-244b7de086f6", "comment": "Malware payload (Dridex)", "value": "be2b540f68f41a7a05e7d68c52712347f979b706", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626897463, "uuid": "15ca7f03-c995-4d42-8b09-675541cecc03", "comment": "Malware payload (Dridex)", "value": "e4c581ee9733f0ea6e148b7760c1e272e4fa3aaa9aac708eabe272b6c368d0061eac3cfd8aa8d36e9ab2f6723a776430", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626897463, "uuid": "aa1c5d69-4699-41ba-9f90-f610faa9ba41", "value": "T1A804C0C9D2FA1786D4B1967D1D84531BA4183C09CC35ED96C980CF5EEA3B204EB3675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626897463, "uuid": "c6381a83-626f-4834-9df8-e0b71e0395b4", "value": "44b0dcdef59120fe964e77dc09a5f1e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626897463, "uuid": "dd0918fc-6a0a-48c3-a466-aaeea2ba0272", "value": "3072:Zb35eJIBwzBgXbJ26juQdZHT5K4PrsF2ATdwNBJUiG7NNNNNNNNNNNNNNNuetbX4:ZNe2Gzm1dZtK4Puhha87NNNNNNNNNNNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626897463, "uuid": "9af7892e-d0b2-4ecd-926c-b2a3e7f23231", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626897463, "uuid": "84cd0e01-922b-41cb-a4f6-84c8ef1d3094", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626897463, "uuid": "097b74d3-59ba-4241-81c0-eeb9a3f83d15", "value": "45d9d9c13a4b2f77a5635a64cd58bd03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c86a5a7-e9c2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626830628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830628, "uuid": "31e7c745-ae78-4338-9ad4-bf92c7aedc0c", "comment": "Malware payload (Mirai)", "value": "b5b4270d58fd04f429ca2238894da605", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830628, "uuid": "cddc7df9-96a4-4989-b840-db75db24f5f2", "comment": "Malware payload (Mirai)", "value": "e52481b59dadd3294caa8991d2d4fb2fff6a133a5595b9a90489967ced6de6e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830628, "uuid": "98dd25bb-aee0-4aeb-ab92-0947a08d5900", "comment": "Malware payload (Mirai)", "value": "f8dfef69a28d9c0a8a0799e0defdb4148e29c6f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830628, "uuid": "3058be71-09d9-4aa6-9e1d-95ee03151553", "comment": "Malware payload (Mirai)", "value": "2819f738df5bd02acdd1b57158feebabbccb526bf862c7ac368263e4e9743bc7f38cb5075d7534849e1edea62bad3da5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830628, "uuid": "d74b1093-b5e6-4f3f-9189-349da219ced7", "value": "T14DD35D56EA808B03C4D5277ABAAF41893323EB54D3DB730699185FF43F86B6E4E63501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830628, "uuid": "be648000-139f-4b26-967e-0d1c849111a3", "value": "3072:6TW4kh/g76bJq69aBLSiW0sGVs8i6jlICmO/GNz5M/9FUkSKHbj50:6q4kh/g76o6SL7fVs8i65IyGNVM/9F9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626830628, "uuid": "5751281a-63ea-430a-83b8-dc5d924b92f8", "value": 140022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626830628, "uuid": "4edebe21-baa5-4f42-9589-a5c20ba216c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830628, "uuid": "7fa75b81-eabe-42bf-a56b-c73e836ba293", "value": "b5b4270d58fd04f429ca2238894da605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2a74b3-ea58-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1626895102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895102, "uuid": "cdee6b4d-cd6e-47da-aed7-2727e9bcbd42", "comment": "Malware payload (Vjw0rm)", "value": "bb68ffac31a93529e16ad187a8628ec6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895102, "uuid": "47c38c04-a75a-440c-95c3-52baa81db33d", "comment": "Malware payload (Vjw0rm)", "value": "e67cad373ea8e2db60f4f40422645d2d6dec30a589d56426f86678aed2838ce5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895102, "uuid": "ef487473-7338-4b87-984e-952961867c1f", "comment": "Malware payload (Vjw0rm)", "value": "189155d0c00a2f3225513444b4a5281f5517c256", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895102, "uuid": "046f1e19-4c4d-40b6-b263-9122f6307180", "comment": "Malware payload (Vjw0rm)", "value": "cefb9b3de90b1aa2a9a5bb79c1c8e843fc8665c4e34e4e1c745a2e6e94c9ea2d115cb053dfb2c493bc528992b17c1986", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895102, "uuid": "1beb19af-72d5-4f38-bbf5-0c2fceae0e0f", "value": "T164C1639D284B863913D23B8A807DD10DCCF154B47F28D1A125ACD6C57A0DC7A87FA5BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895102, "uuid": "51cef893-d46b-4937-8eba-8be4c5845a22", "value": "96:SABNo5Datk2c24ZRMHXE6/BIt+Ys+fJODdQqR7bJyKhjOS4Uu/ingHXRZfzYMe/d:zS+K2c24ZRMlBIoYs+fJsfRfcJingHXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626895102, "uuid": "78e0cf95-7cb0-45ee-922c-34e2b150ef90", "value": 5913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626895102, "uuid": "2abac8ee-e9b1-4cca-b83a-35d113a2ce90", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895102, "uuid": "9c584f51-8532-4a4d-a144-3db8e1f9998d", "value": "Inovice_01.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a58f03c-ea55-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626893760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893760, "uuid": "ccfb55c0-afb5-424e-8fd9-e79d45ddded1", "comment": "Malware payload (RedLineStealer)", "value": "a20ebb2a10324b073fd40110d9ee705d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893760, "uuid": "2e7cc19e-3398-495b-afd2-ce80be5c6554", "comment": "Malware payload (RedLineStealer)", "value": "e6cb7b6bd4848499533b29bdf85f60e362df435c6254d74521ad40dddfb77d1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893760, "uuid": "54548c52-6e6d-4f50-87d4-7111f5ab314b", "comment": "Malware payload (RedLineStealer)", "value": "33cf4d5e7bc35f9ef524ad9eb38c9e229ea128f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893760, "uuid": "ca4a81e4-2b4d-4e80-8646-0b46271d47aa", "comment": "Malware payload (RedLineStealer)", "value": "46ce9a6ff6c8868981dc00ad5396535b1bc52fea0f0b5157eb276fcac709bc92d2208186e8aaf5a4e4bbd9c0ff5763b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893760, "uuid": "8d7b9c44-0646-4cea-aa42-7284f8c7944b", "value": "T1DDC4AE642950D750D6D932318F2BD9F402BA7FEE5D319A0F9F8E3AA01B72D742607386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893760, "uuid": "2f3ebcc5-8cb0-43cc-b7e8-aaa86b14a04c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893760, "uuid": "3fcc2130-9221-4d9c-a71f-f2d9fc5aa4b4", "value": "12288:6YcKMLzrEXzefUvKZhZEfFrwWB73e1gzw4R:6azef3ZhCNr/B7uyFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626893760, "uuid": "c671c5d8-e79e-4882-a134-d55cfc93bf87", "value": 549240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626893760, "uuid": "51b4095a-24af-41d2-9099-9bc8f7238d10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893760, "uuid": "ceeaa827-fb5d-4642-80fc-cafa266b1ba2", "value": "e6cb7b6bd4848499533b29bdf85f60e362df435c6254d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fbb902-e9ec-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626848741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848741, "uuid": "ae5eec3d-31fa-44e7-adf2-a2fbf78b2f0d", "comment": "Malware payload (Formbook)", "value": "48be983e92e7f8b7d6da338994d15fa1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848741, "uuid": "e5d75b5f-2a83-48bf-a1a9-6fc0c08d7ca8", "comment": "Malware payload (Formbook)", "value": "e8ef77f22c8ce664462e48e9ef87ff9a2d33bda2d785b454d04e3e5d3eb01c9c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848741, "uuid": "c66eeafc-503a-4460-a397-5dccb8c1df00", "comment": "Malware payload (Formbook)", "value": "fbec67bc40e50da7fa99f78e6affef79aec4200e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848741, "uuid": "59319023-11ee-4bf0-8198-80edbc0fb282", "comment": "Malware payload (Formbook)", "value": "4154f0555371e1145675d7b8ffab8ab219d50b8c26e0d36ace572a31173d2db664778ddc62a7b599161e2ca198bb0709", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848741, "uuid": "4f32e118-af17-4711-9bfe-29a36cc2479f", "value": "T13D45123DF9F7A57ACF3642725642C3B091EDCCB8A723790649683C8731BD1A6C25AE05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848741, "uuid": "bb5a90d9-6141-4dbe-8d0f-d9111acf6aac", "value": "24576:RtF/KcTd8yp5LGIun2NXHfUEHs2TGxYYsKFTyr1OzExtpxOccCEc9cSVJ:RxTdhLGIuavggGxYYHQr1nxtpRRcSVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626848741, "uuid": "1f808b43-06cd-45ad-bb67-b73911fb411e", "value": 1260032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626848741, "uuid": "552cf0aa-c0a6-4676-b26e-1d157e5cddfe", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848741, "uuid": "699bc0ff-9810-4ac5-b845-3d7ad1893034", "value": "REMITTANCE ADVICE [REF0000360261].xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734d557b-ea25-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626873213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873213, "uuid": "f2be35de-55a4-4d9f-a9a8-49996612ed17", "comment": "Malware payload (SnakeKeylogger)", "value": "5f427b2e7ad4284c6bd59747027190ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873213, "uuid": "36ae2512-2a41-447b-bf1d-02398616b80e", "comment": "Malware payload (SnakeKeylogger)", "value": "e9992a371caad09b90678673a576bf2bf81c712a431d77b371900ce25bd71d05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873213, "uuid": "c4aaac5b-68d0-4f33-925d-c2a9dfa009da", "comment": "Malware payload (SnakeKeylogger)", "value": "76734e738e36467e1186a2487a477738ae9f5e19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626873213, "uuid": "47ae35f9-9e4e-4e0f-9406-cb147223587c", "comment": "Malware payload (SnakeKeylogger)", "value": "c2d490efee41439cd2a53ff604d1ca7448ff2d4e741a4003611fe7fc6a4f86537af9380c177ea937238aecfc62c18551", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873213, "uuid": "3b73b799-6782-4942-b468-017eb03828d3", "value": "T134257C88F54075DDCC2B8B328975DC70A2523CB99737D90E18DB3D6B7BBE68399110A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873213, "uuid": "98ef8ccd-e117-4aed-b8d1-12fca821beb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873213, "uuid": "c7713c6f-2307-4777-afb8-17d3770d0000", "value": "12288:X40iOJRFK5O3Z9oOi37c6InBwQhAG1JNKYwZXSJfuoaJp5AJ4eAiStUnWvBuSuPc:I0dJRFK5gZ9B36ItAG1DKY+XDRVAz1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626873213, "uuid": "c9fea70a-1486-4733-8031-de36e4098e64", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626873213, "uuid": "0e6af13f-1ec8-4e9d-82c0-743f40e211ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626873213, "uuid": "f3f58cd8-5699-467e-976e-3dd2dd9ccb40", "value": "Statement - 30 June 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e227e169-e9c8-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626833456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626833456, "uuid": "ceeb9889-ddfa-43e0-94ad-d0c97d223a4b", "comment": "Malware payload (AveMariaRAT)", "value": "79d863368e039ff567883368a5f041d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626833456, "uuid": "7c9511db-5908-42e2-b9ec-e45046074b8c", "comment": "Malware payload (AveMariaRAT)", "value": "ea609cf51571388693642dbaaf8e6ef297792328ad16a24af7287ed7d2ee342a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626833456, "uuid": "6f01d1b9-7da1-466d-a70f-e0292fc6f277", "comment": "Malware payload (AveMariaRAT)", "value": "d1f4e320f407da1b1840f8abae68e5f91a1c34fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626833456, "uuid": "1da19aa0-83ba-4bf0-9de6-be35ad62b220", "comment": "Malware payload (AveMariaRAT)", "value": "a1c73c822e7955ea2c66ca26cce6ff00f2f61c9464406aedcf9a754fe1f5428ac2bd4f474eb07285608daf38b0524a22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626833456, "uuid": "113904ac-68fd-40b6-9031-b15d93c27413", "value": "T1A5F5123706691045E1EAC83ED137FED432F3037A9B81A47875E6AAC726358D5E713A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626833456, "uuid": "0ed3ee4f-9eea-40c1-8e23-77da2503a41b", "value": "440c2f1f8b4e85a8125518c273eebc8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626833456, "uuid": "425036e5-ff88-4f53-941f-a43ba387a6d9", "value": "49152:90zMop2WziVbanQXUvnI3CJ61rzqAUT3CYKS8NJaNXwjpbCzK9lj2gYXVq7:GzQWmVbiQE/0mAmCINXwA2bj2ggc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626833456, "uuid": "b9032e5e-eac6-4d0b-9142-0898250999bd", "value": 3393064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626833456, "uuid": "37fa46d0-cac8-4230-aef9-20d3bbc2d7af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626833456, "uuid": "88173d0e-d183-4255-9e44-37836fe92ee2", "value": "79d863368e039ff567883368a5f041d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c219d46a-ea3e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626884083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626884083, "uuid": "0cd2c59d-428c-4752-b915-214a6cd65bb7", "comment": "Malware payload (AgentTesla)", "value": "cb77d2b48b058c56299f4ed61bb2bcd4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626884083, "uuid": "35be43f7-9e5d-4558-a677-a323640330fd", "comment": "Malware payload (AgentTesla)", "value": "eaff71128153dd8aca8aee7ae6ba8fa4b9e93d4592b3093bd4e19b8eb1d0ee36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626884083, "uuid": "331fc9e3-50ca-4f1c-be12-365f10254c09", "comment": "Malware payload (AgentTesla)", "value": "f8848b76c9049861a4ebed94446d1b2dc2dc2c8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626884083, "uuid": "aedd007e-ed6f-4d58-9dac-b9ad38a4aacd", "comment": "Malware payload (AgentTesla)", "value": "aff389d1a2f450a9d1f3cd7572cde9ec8686571fa71cbdb5a78498b6b78d3ae1e0a9539849a4b6b5874fad3e5584b113", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626884083, "uuid": "4cfb447b-4496-4476-b2b0-64c42211ab7f", "value": "T16EE42316C1FD2718D744921318F2E3227D3E8BB2A51D67E1A0A1F20D6F64247F22E5EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626884083, "uuid": "3d2048bc-8563-42f1-a8f1-af1a8e691f22", "value": "12288:laEiTifhaKPB65fJrIDw6PyhfdYuHC4Ip0ndRQvFq13SM92EyZmra7pZl9etLmL5:3KifQKJ65RIDMh9Hw4dRAq13ZYEybXzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626884083, "uuid": "7700d322-bdae-49e9-aa82-e822e55d5c9a", "value": 700661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626884083, "uuid": "0b76e65a-fa0b-447d-9400-30ee7cef6f0e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626884083, "uuid": "c2995987-fe53-435d-9681-5f5c2f4e0532", "value": "Ref 4359-0201-106.034.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1fc2bf-ea53-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626893065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893065, "uuid": "e14bb091-9d46-4ca3-9211-a4f93174c3dc", "comment": "Malware payload", "value": "af3b8e50273970903dcda39cfe17de45", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893065, "uuid": "b91b12a6-ade9-4ffe-acae-0b04b42ca968", "comment": "Malware payload", "value": "eb98f8207ac56b6b83adf5bd84c851e3b66e21ed29dc4b24b9653c4a3ed4340f", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893065, "uuid": "c65b1d22-1505-427e-b53b-5c313bf7484c", "comment": "Malware payload", "value": "63140db148b783fd3803a20d3ec21c882c236f3e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626893065, "uuid": "28f1487d-0c6d-42b2-8f16-743e05884462", "comment": "Malware payload", "value": "9b0a70567c5aba23a42acf5fe1204c2f1161d5969d484e3ed56a4761d74d5704258ba4897e3614f50397079d57503968", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893065, "uuid": "04b7d8de-e441-4f82-952f-643af006fe74", "value": "T1BCD4336E85E29541CC800ABB54A6D3F91EB80CB82AC7DB65AB62FD039415D1F33F68C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893065, "uuid": "d38be9a5-19c3-4646-8147-856f52fd5cbb", "value": "12288:YGwskwLhlI5ts8DzVWtzzPZLvCDO2Lpk/2aHWLLJFhGZzDbGzZE5qiw1GSCXy8nR:YvsZLh4s8D5WtXhCDXLu/lcLJFhGDbim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626893065, "uuid": "c48784e9-8607-4ae7-bd9f-39a3e70e2eba", "value": 628333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626893065, "uuid": "d5a8bac3-4f3f-404e-aa5a-1acca5255f60", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626893065, "uuid": "4f14503b-d970-4bb3-a81c-5f50215441b7", "value": "Docs_Ship.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e643ae-ea33-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626879155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879155, "uuid": "f3eb7846-5eae-443e-a920-cb2c7395c50c", "comment": "Malware payload (AgentTesla)", "value": "9f47d7fecb4794c475db8c10e2dfb22f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879155, "uuid": "20d514db-e1b7-4272-9600-2d18a78f4be3", "comment": "Malware payload (AgentTesla)", "value": "ebee6aa23581694ef24a432fd0e09a5b150e9238f973ec62d182d6ca8c0b07e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879155, "uuid": "57118765-1c8c-4593-a9fd-538d4067f415", "comment": "Malware payload (AgentTesla)", "value": "c508bc265b17c20866bd73c16136bd4dd5cd2d1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626879155, "uuid": "bbf4cf96-8b87-4f69-9a5d-79499573da1c", "comment": "Malware payload (AgentTesla)", "value": "5bd31a2342be65e8ac4b18c5c27d3ec9cb2cc9bdb440b9d3a8a5c3c28dcfb7a76ebb376305aa31d66c08c8bd5bb9cba1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879155, "uuid": "03541e58-e072-49fa-907f-1e68c1e047a7", "value": "T11CD423A120DF6FE48B895E13785FEB7F9803BFDAE031972445DAA89C79A5F0138D0590", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879155, "uuid": "212ea651-4f8d-42eb-9255-8597c14299c3", "value": "12288:KoAo9FwTDq6S2vGziHlMnSH30uZlohbS6fhJnb7b5LuuII2CfD:KWfiD1JESXLI7nnb35KBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626879155, "uuid": "8504bbe5-69bf-49a4-b666-3abe65cebf16", "value": 639656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626879155, "uuid": "e4472b02-6a3c-481c-9599-145451b75cca", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626879155, "uuid": "58db29fe-d810-4277-938c-c0a8533ab59e", "value": "Specifications_Details_20330_FLQ.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75209665-ea73-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626906717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906717, "uuid": "04e60778-1d23-4651-910d-316368c6acb1", "comment": "Malware payload (Mirai)", "value": "0e6d0f8b156fe3210facb386000d90b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906717, "uuid": "4736a5d3-0939-42f4-b066-109aa81ca311", "comment": "Malware payload (Mirai)", "value": "ec53883bab5a172a2c1481510684925e1cfe4306f22c8387f2b5a072aeef5521", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906717, "uuid": "72f77008-69d4-4085-a368-ff88045f4e37", "comment": "Malware payload (Mirai)", "value": "9f530137f13ce406eaa5987b2696eaa30f4f7e0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626906717, "uuid": "571de06a-5366-4b67-a6fe-99e055a2007e", "comment": "Malware payload (Mirai)", "value": "66a3bdc227833e571e93df1b8d61db2a92a5aa4c33276bc33bb82fa75c899e52888f47bedf86f7571b10b5b8d37c5b05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906717, "uuid": "7d54e604-7af6-48d0-aa0a-ab3b50d645cb", "value": "T113731B25BD791A37C0D4767E60F78B02B5E1228F6AE4C5093D730EAEEF246407847AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906717, "uuid": "7cd540b7-2e45-41bb-8231-4c4d77f61ad5", "value": "1536:aDGRJ0hUD5hFS+LoRDC107o5mju6v8zuGroQV:Aj+EVCmRjbv8zkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626906717, "uuid": "e502f71e-3452-4277-9093-6203d9afda2a", "value": 75720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626906717, "uuid": "8a105f27-38b3-447f-a989-20e85f793451", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626906717, "uuid": "11d81fb3-e877-42db-942e-2edc9959a10d", "value": "0e6d0f8b156fe3210facb386000d90b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70cbc861-ea5a-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626895972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895972, "uuid": "e5ca4ea2-bf37-49f0-8903-0bed6eb94d04", "comment": "Malware payload (Dridex)", "value": "fa5ec3e53520d0d4de5e26611b8cd51d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895972, "uuid": "fdb7313d-694f-45c1-9616-785f931c1696", "comment": "Malware payload (Dridex)", "value": "ec705e006b4074a61b4b001660ce083e1948bb7ef17c69a90ad5ef5bb635d132", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895972, "uuid": "a038152d-3c16-416e-9d88-9080e718f260", "comment": "Malware payload (Dridex)", "value": "6ce8c358ec95955f2816ab1bb376c025ade61922", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895972, "uuid": "7bf4b37b-8461-41b8-aaea-e560f370fa92", "comment": "Malware payload (Dridex)", "value": "c8cd26919bf6770468afecd0b118eed548dd02dab521081ad2d25aadf55894a2ea751a7ce0e5b0be51f09449f079d502", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895972, "uuid": "456ba180-5422-4ea0-bc07-82a66a322f63", "value": "T15004C077AEDFC0B9F2A39470107437AB26F57A032419F492DA61C8DBF83D99468A4353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895972, "uuid": "9e0b90ae-f7be-4145-a1a1-93e26bb2808d", "value": "458d7355fbf070054838e3593829db8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895972, "uuid": "7d17d3db-ffd3-41ea-9cbc-94165054f24b", "value": "3072:0VadvfvemTEtQ9yoZPW/k/nklVtu77wBeZUCEQZRpbBDp57WQhdIif4:tDTyJWPd/nkdqw4/HbB77WQhdIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626895972, "uuid": "31598759-1793-41f0-93ca-d2d194f95aa0", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626895972, "uuid": "b0002e2f-264e-4a77-840a-d93ce7f71478", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895972, "uuid": "a85e3c7f-29e6-47cd-9147-4a91e2a59697", "value": "fa5ec3e53520d0d4de5e26611b8cd51d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a3743e-e9ec-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626848705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848705, "uuid": "a82a900a-7d06-4f41-b9f8-1ad95504b133", "comment": "Malware payload (Formbook)", "value": "e8e5934ac8c39cedfb38985307ee7b03", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848705, "uuid": "0c0280a6-352b-435f-8d20-2b55e2ab8464", "comment": "Malware payload (Formbook)", "value": "ece4d2f1e91d723320e3c6374fa33aca7d05dc03d9403d91ab8388867d43c46b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848705, "uuid": "2f53b24b-8980-4379-b34e-f5a1096af9a4", "comment": "Malware payload (Formbook)", "value": "2e861bf7dfb04fa42b2b7b31d85122c72d035ce6", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626848705, "uuid": "6fdd8af8-782e-41b9-a8f0-12134c1ef3db", "comment": "Malware payload (Formbook)", "value": "e77ed363d75a0746d02db979977b9157b36e409c40884b9834e7ae79c50b0fab12019fc8bd0ea84d5d94ab58e7ffbf41", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848705, "uuid": "526016d4-44a4-4b78-959e-82a64abc62dc", "value": "T1F6451250FEA28F42C0A34E32D065ADC9D93FCD666479FE9F9508369BA87853603D3B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848705, "uuid": "0fd85add-8827-4cb1-b916-456e0abb4b5c", "value": "24576:PsnxLUWzvll9s/nD7hyvl1f6aXICTT3hSVELP0lt2rHw2L6dNVaaawzAaaaaaatk:K35k/HhGXCyIm8VE7StGHOdNV8nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626848705, "uuid": "89670826-9410-4c80-b8c4-17e052823eff", "value": 1235456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626848705, "uuid": "a4d490ab-9011-497f-92c0-bd2131de1328", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626848705, "uuid": "f6bec7b7-f29d-4b41-bf27-3033c0097c1e", "value": "DHL 07988 AWB 202107988.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5012405-e9e7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626846748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846748, "uuid": "1b72cf3f-37bc-475d-81ef-8ff44655b888", "comment": "Malware payload (RedLineStealer)", "value": "a754616553c0f9849238d05240be5e78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846748, "uuid": "06e820f3-c81d-4b9e-a4bb-057a74cd4edb", "comment": "Malware payload (RedLineStealer)", "value": "ecf7f3127f2bd944475638ba4fd6f0e38266b87f3067529705284cd5038400e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846748, "uuid": "fa4af57c-ce14-484e-80e7-bf241266edfd", "comment": "Malware payload (RedLineStealer)", "value": "185cfb0d8459cb2ac33a4d482a357df3726df100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846748, "uuid": "7ff1c38c-922f-4a82-b369-c99ba3c06009", "comment": "Malware payload (RedLineStealer)", "value": "aa6948bca6b49dd7f8ad1296e93bbfd90362630cc70d7ed9ed574a819c24310cb1e46d3f4e2e6fda91fad0ab0a6f021c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846748, "uuid": "23461f85-b195-457d-95fb-9381283d1416", "value": "T17EC533113BAA91F7DA07613566847FB790B9C7991A2008C37B50EF0E8F3C8E5D116BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846748, "uuid": "f18a0e82-4c66-42a4-b610-94f1a862ef99", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846748, "uuid": "66fc2784-5ade-43dd-8491-b80a3eb93375", "value": "49152:xcBbPkZVi7iKiF8cUvFyP+pKXQZM7U6HGlEwJ84vLRaBtIl9mTj/ELyQVSt5:xHri7ixZUvFyP+pUQgdmqCvLUBsKjEyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846748, "uuid": "b9452bfc-e5f2-4bd5-9b13-631880d625d8", "value": 2609072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846748, "uuid": "5541ec99-3c65-48ac-a46c-7316d3eb402f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846748, "uuid": "3402befa-701e-421f-80ca-2e562e566fb6", "value": "a754616553c0f9849238d05240be5e78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3dbb741-ea4d-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626890608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890608, "uuid": "439bb30c-6fdc-417b-8bb0-30818f649e68", "comment": "Malware payload (SnakeKeylogger)", "value": "f223962d913a5a81a1e8ede9f2751d1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890608, "uuid": "b1a46909-906c-4c03-8e02-ebdae05b7852", "comment": "Malware payload (SnakeKeylogger)", "value": "edf4be11c04f2228e6448b9e771f3f8969e8bfcbf914252064c8ee07629c5f4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890608, "uuid": "b275b234-f6fb-4093-a85d-7881e3648e3d", "comment": "Malware payload (SnakeKeylogger)", "value": "0d68ea4b1b2baac139cf78bad27918f864640061", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890608, "uuid": "3d9dc3ab-717b-4fb6-b12e-3c68fbf29ca6", "comment": "Malware payload (SnakeKeylogger)", "value": "041102c0686103382cb13d4a58b24d04fd63dec97fa5496e1be8c0d5897e85a1d98713e61555b6c403d837d46db0afcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890608, "uuid": "82a9b3c9-2dff-40d0-828c-2843e45db9b8", "value": "T124E4F175632BA208DD388BF62CA6D5E377BA782A166DC53C1D48E03DBC7273D1AC0156", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890608, "uuid": "774d91f9-1468-490f-8bbd-fead0f31f598", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890608, "uuid": "74e38885-6b66-4e1f-9a6a-04efc4b2a857", "value": "12288:i6xyvUIZbV2TCTB35/9cIiS+T1lw+KR9SOk:7MvDB2TCTB35uAR9SOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890608, "uuid": "70cf0466-28fd-46de-863f-2428fbb0ecc1", "value": 673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890608, "uuid": "94c471b4-c220-4eba-bb0f-77c49ff06c0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890608, "uuid": "5f9e0c2d-5564-4ba9-a8da-b5dbfff41b79", "value": "f223962d913a5a81a1e8ede9f2751d1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214eace6-ea08-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626860620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860620, "uuid": "4f293355-487c-4cee-9c1f-f3f5f1b5dd64", "comment": "Malware payload (Mirai)", "value": "a1004c7e8c99bd82f00a3c000639f7b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860620, "uuid": "64f7c803-f429-446c-91d8-a9a28b878893", "comment": "Malware payload (Mirai)", "value": "ef04a90eefd089b9d4024a95414325d753d268fb85a1a2033bef05aa2a93fe58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860620, "uuid": "9f4b0b04-097f-4d74-8cf7-0ac0fb57adb7", "comment": "Malware payload (Mirai)", "value": "6055dc3f23a7c184dfc22e4446990c1551fb634a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860620, "uuid": "709cc9a3-189b-4b9b-beef-c49ca33c706f", "comment": "Malware payload (Mirai)", "value": "b02265d98223b68f016363ba00e247211a08cc3f152257b770a95f1ddbb255c5db5d0a47b9211f91a5a17e3a44ce6112", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626860620, "uuid": "9eb5cf2f-6a4f-4ce1-bad6-93306f10d024", "value": "T1C3C2D08935058BEBC486E6B963E757D02D5207B6C443EC0EA364BA1348470BEBD83FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626860620, "uuid": "830fec69-915c-4a13-aacf-8bde64fede63", "value": "768:z+RzqCgSk1Hm3/xeU/8V36joj7Q4JgGlzDpbuR1JS:z+sCgSnvjo3k4VJuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626860620, "uuid": "972a080e-a3ff-447b-8654-f15729cada3e", "value": 26168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626860620, "uuid": "b7dad628-7f85-4fb6-98f8-b6f29d92bdac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626860620, "uuid": "4e374439-806b-4224-85b0-d7ee884dce92", "value": "a1004c7e8c99bd82f00a3c000639f7b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0df2c8-ea5b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626896258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896258, "uuid": "b7c74b0a-a64f-4f3f-9dc1-be1d34cffdad", "comment": "Malware payload", "value": "8b8ec117d4cc2eb8cb246433c1090dec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896258, "uuid": "cdc4987e-85e9-44a6-b2c9-0777070a9552", "comment": "Malware payload", "value": "ef08eafe517a3af06bb806865de42aac88231aac2e1462fa5b44b0db7231cf28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896258, "uuid": "20ee7469-e322-4b49-8636-c223e4876658", "comment": "Malware payload", "value": "61dc358323c1df9334c5169e133ba57ee6bc5186", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896258, "uuid": "0a861173-063b-4652-a1e0-b4d832ca1699", "comment": "Malware payload", "value": "8fd08d0e92ba8da1cec7c609de1f213af3dc71e69da653d57695fcf50f17f4b14b395c841c2cb4bcedd7bfbcd7be0d2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896258, "uuid": "953e93b2-24f1-4fc3-9148-db9e87d6c650", "value": "T1FB04C077AEDFC0B9F2A39470107437AB26F57A032419F492DA61C8DBF83D99468A4353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896258, "uuid": "47de52b9-e0b9-4147-a78f-2f6e938a2ea6", "value": "458d7355fbf070054838e3593829db8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896258, "uuid": "dd5497ab-db88-40fb-b088-cfeb71b44fce", "value": "3072:UVadvfvemTEtQ9yoZPW/k/nklVtu77wBeZUCEQZRpcBDp57WQhdIif4:NDTyJWPd/nkdqw4/HcB77WQhdIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626896258, "uuid": "5120db99-a558-4277-a307-ddc0a9f8e544", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626896258, "uuid": "ee1787d7-d158-4847-a139-c80f7e3be8f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896258, "uuid": "d054ae00-b744-440d-8f69-42606e5ba141", "value": "8b8ec117d4cc2eb8cb246433c1090dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06fc074f-ea23-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626872172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872172, "uuid": "00429856-eff9-43e3-a0c7-b664aa5dd002", "comment": "Malware payload (RaccoonStealer)", "value": "283cd7c1de6f4f05ab545de5b709b680", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872172, "uuid": "31f44e29-af83-4271-b6cf-33f734b165dd", "comment": "Malware payload (RaccoonStealer)", "value": "f008c90d89557c6fc77c36be56ebabf294e414e04ac1ddf00b4fdaa22af3a7f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872172, "uuid": "4d6443ad-f305-4c2a-bd8f-73dd421a48e7", "comment": "Malware payload (RaccoonStealer)", "value": "c786af5d4452b438d0b34722c025f8bf0509df4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626872172, "uuid": "dd3230ec-f3d2-4c4f-9776-31153c90af50", "comment": "Malware payload (RaccoonStealer)", "value": "4a5b929a701f5165c1aeb41dee85ab9c3d105d92ec1d6d14f54aaccfdca963239ef46a14e55cac9bae67eafa487a5ce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872172, "uuid": "f58fb59a-a731-480f-94f0-c2fd821e6a54", "value": "T1F0B40110F6A2E832E1B1483148F7C2851ABFBD266D2C464BB6463BDF5F312D2967D352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872172, "uuid": "50daba50-3f69-48be-8193-62f30cf4526b", "value": "f1287ea8340d83d7c6e292a6b7d8dbf5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872172, "uuid": "4db4da42-c190-4463-a561-eddc3b2c4f84", "value": "12288:8z4ljVwWxWjj3fZItPbTJ+nQKv5ZZIS+/hNxaXPMynL:8z4lBtWjjw/J+nQ+57ISghkMynL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626872172, "uuid": "57cda4e7-6dd4-4e03-9857-9ee3a19e8e9d", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626872172, "uuid": "d8ad2c32-4a7f-440a-9d3f-8dc9b2c10732", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626872172, "uuid": "a70715c6-f296-4f1b-ac96-336cd87b9732", "value": "283cd7c1de6f4f05ab545de5b709b680.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad23ba6d-e9e8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626847111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847111, "uuid": "19169208-e9b1-4e21-9366-b5ba2ebf5eb4", "comment": "Malware payload (AgentTesla)", "value": "68ca906b3a5d37a1eb8dafba33ac3f04", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847111, "uuid": "7df87980-80bc-4b45-8242-50c2ddde3ba7", "comment": "Malware payload (AgentTesla)", "value": "f0212164481dbc5204645f14e6fd604178e2a1bbc7064e021f459b3aa49abacf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847111, "uuid": "e9093380-fe99-40ab-b6e8-4c0021329b80", "comment": "Malware payload (AgentTesla)", "value": "a4fd4d03da3e9d4d48893b517beb26ea9814d003", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847111, "uuid": "f84250b1-a512-46e0-b5eb-e062bf28f12a", "comment": "Malware payload (AgentTesla)", "value": "d03bf0250ff63c105509687af79cb7c2fd49c9349e8710d2e16f032b9ac6d816f924bc47734aba26c10cb7e2427bd3f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847111, "uuid": "c3ea6c06-0f10-4e9f-97ea-02dc1861863a", "value": "T1758423E9670E1608E234D5BB5271020A3646BEE4FE835E76B0E600BDB3F5F05D439A6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847111, "uuid": "fc6a0f50-c7ef-4ef0-aa1b-52964168500c", "value": "6144:lliXzGkj/Gu1ZBFaU4rWD9ueAB3a0uV25T/ysJaN+cYCs1QD7LyCLEwZmD/cAjRo:l+z3j/b1Z3crWD9E3Ug5T/F2Ng1uLhPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626847111, "uuid": "1b434716-3623-4d75-bc6d-adb45c027af9", "value": 389062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626847111, "uuid": "ee201549-002c-440c-8c53-43d50c1b2644", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847111, "uuid": "7457fe68-07e3-446b-8a2b-5f57cac89324", "value": "PAYMENT COPY.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d879e3a2-ea07-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1626860498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860498, "uuid": "228b3ea0-7a64-45de-9831-9be0ba1090db", "comment": "Malware payload (Quakbot)", "value": "02ca3e9c06b2a9b2df05c97a8efa03e7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "webinject", "colour": "#B8B4D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860498, "uuid": "d47de35c-a0e4-418d-bcec-4da09d9bdb6b", "comment": "Malware payload (Quakbot)", "value": "f07fcf86314fa15184d72e18227d81edf1ff35dfefc87097ebef39ff14f874f2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "webinject", "colour": "#B8B4D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860498, "uuid": "d50c2b5d-bb3f-4b57-b106-ba03a950406c", "comment": "Malware payload (Quakbot)", "value": "d236cc5ebb003013d0517dc4d039a7158099ad16", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "webinject", "colour": "#B8B4D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626860498, "uuid": "42a52a06-3f8b-4ed0-affd-103d73713078", "comment": "Malware payload (Quakbot)", "value": "31a80f1401700b4a6c4b9a75920e7caa627404fdd4212d852456bb47590e23d6100a38eea13ca629f3bd6b9b949a0502", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "webinject", "colour": "#B8B4D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626860498, "uuid": "fa3ff535-3704-4127-a957-c8bbf77d1bcd", "value": "T1B2F3AE2270F1417BC172193C88EA672DDBBFB721A27188C77B882BC45E5A145DB3B5C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626860498, "uuid": "badf772f-9852-4c83-8362-2f69bbe563ad", "value": "5268995af35bc97344fbe14c1426b29e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626860498, "uuid": "0b27e7ab-e42a-4d30-9f12-8d91f5b156aa", "value": "3072:w/P5MDLH0UhnH9VnQGURmtT17Q9ED+QaZIiTBftSd1yZyC:w/xKLX9dImtT17wEi7IiTBlSd1yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626860498, "uuid": "dd92ac8b-e1fe-4977-8d8c-ab7d4278bd0f", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626860498, "uuid": "0d471e20-d7a3-4916-84ba-84119c6dc68e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626860498, "uuid": "40487b53-6901-46c0-a26b-dae2014a54bf", "value": "qbotWebInjectLoader.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10abed06-ea38-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626881208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626881208, "uuid": "9e520636-65a5-44e1-a09c-fa04d091f97f", "comment": "Malware payload (Formbook)", "value": "b8b1a1e689be765aad3fe0f8d97199af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626881208, "uuid": "a205a986-e77a-4892-9579-c9e52a13af42", "comment": "Malware payload (Formbook)", "value": "f0e734543c047d2ca1a76a4e47553e85d50c57ff9d3dfbd0e55806ff890fef38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626881208, "uuid": "96ffc870-0fcc-48ec-819a-4c9e8b4e9999", "comment": "Malware payload (Formbook)", "value": "96b923aaa5b0d3e9974b4080298bb8a7bcfcf725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626881208, "uuid": "5399023d-7c08-42e4-96c3-75670b857631", "comment": "Malware payload (Formbook)", "value": "6908959095e551a7b5d0b5b2cc618ece36ecb89aefd37b128de152bc5a48980ac9d7e7327740456207aa59ed6196eaaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626881208, "uuid": "64f2ff00-795a-4309-b732-678137937cc4", "value": "T18E358C61F307EAA8EC2213B8DC7AD8F12263BD5DD525892B358D7E2DB9B334150E1907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626881208, "uuid": "ccf6f622-aea4-4b4f-b029-78afe8129a4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626881208, "uuid": "776108d9-80a1-4895-ae4b-41d2f5dd1b9f", "value": "12288:hcqMZxfFZwuKkZXpVgBrzfGJ10YKy0K0XN2zNOQ3yHQowxtv4yaUVKnp:EZxfFSdkZpVSrzGJ6K0wh5CHQFahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626881208, "uuid": "80f5a6fe-3101-4fb4-a422-02625ac58bcf", "value": 1145856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626881208, "uuid": "fcc80bad-79a5-4961-80ab-4e240d5a7cbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626881208, "uuid": "ceccc093-e4e1-4516-aec7-aa4611cae3bc", "value": "2bINu9BOqKtJHoo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2edc1874-e9e9-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1626847328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847328, "uuid": "ea9ef664-f874-4d31-b3d2-c52691bb8fb4", "comment": "Malware payload (NetWire)", "value": "103362e59d9fd456e9ce47da23e14e4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847328, "uuid": "a842608a-6546-4ba1-8af2-1354af2c13bf", "comment": "Malware payload (NetWire)", "value": "f1079cf4bfcc93d98a75ee56bac5fc02f9e8bbb2bf255f7c3d0b25504c539e40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847328, "uuid": "b6e78ec5-6096-437c-94ac-711bdd7b4061", "comment": "Malware payload (NetWire)", "value": "5f557d79f1085f1e05da881204d341f2c82b20b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626847328, "uuid": "c4356d09-fcac-4528-a3a3-d7c255ed4d9e", "comment": "Malware payload (NetWire)", "value": "b9e51206423c448f691265881f009fe45aac06737d713a0e0ac9f81fddd18a98802d761b0c0ca1c95321ff4fd9003cde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847328, "uuid": "623ff91a-18fa-43de-8e9f-d631a3a32eca", "value": "T19A05BD3804684AA7D67A97B7C555A310FFF08D927250DE1A4ED3F8C72D12B43298EE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847328, "uuid": "88478227-7d47-45a1-a291-8e67f92812e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847328, "uuid": "37806935-2d7a-4ee2-b101-552084b41097", "value": "24576:5mvq2frO4+yIL7/vlhSh0JEtBoTgbRrzkTMvcrmGgbs:4C2cyU/vlQh0JELoT2rQYumGgbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626847328, "uuid": "5506822a-7ff4-4526-b985-981727c226af", "value": 873472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626847328, "uuid": "6807a8ab-998e-4fcb-b215-d2febb9938b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626847328, "uuid": "afdd2e77-9ab7-4630-baf4-46f7c802556d", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78e1bad-ea77-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626908546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908546, "uuid": "06402f25-efad-4216-a872-01306b47b21a", "comment": "Malware payload", "value": "b616fd1f7f7feb981184ad846c626b91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908546, "uuid": "91ffd1f5-8586-40db-8f9e-82ad9ec900ff", "comment": "Malware payload", "value": "f2aed23ccdcd5c9b2ae03bdf764e971a5ef30d4ef9dfc37f66806a057433c23a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908546, "uuid": "61c7a0b6-3dca-4dba-a3d9-4de1557ac824", "comment": "Malware payload", "value": "03fff323686df503349f619be5b6081e0818980b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908546, "uuid": "7d9cf316-f3a4-428b-baf3-082bb1d4aa94", "comment": "Malware payload", "value": "3c38e67265ef67b8e46fff554c162aa119e0e42f6ad6ccde2863d3574c7d30c1d9ce78119bb8b9c38a87bfc9a4258bd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908546, "uuid": "e5f75538-9e53-4beb-9378-a32afeabd864", "value": "T1645533107B4286BFCE894FB653BF1440E924D975A71216CF0F2B2B7AA54332C4C766A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908546, "uuid": "dbccbcea-6798-4c81-9033-40ff87ca2793", "value": "4da7a3c908f70c18780a67a792276e49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908546, "uuid": "61569428-3092-4e3e-8f88-553a3927e8c4", "value": "24576:i7yUiF3RdB5H1DBxJrR4YQmeXtaXfyh+GY6LJxY+hSf8a1SzQWgg74+We1tX:7bFBH91DB54YViyfC+GJyinj+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626908546, "uuid": "28561169-679a-49ff-8d73-f24454a7e850", "value": 1346560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626908546, "uuid": "818203e5-130c-4e1b-b224-4d02b55313bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908546, "uuid": "42653277-f32f-4163-ba50-009871f1f531", "value": "b616fd1f7f7feb981184ad846c626b91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb512d1d-ea59-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626895694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895694, "uuid": "7c347363-ea07-42d8-b493-4cf421d21d53", "comment": "Malware payload (Dridex)", "value": "56c09545b796f22000b20c84bf6b505b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895694, "uuid": "af129ecb-219e-46ae-be42-bc473800b8c9", "comment": "Malware payload (Dridex)", "value": "f2c2d92afa0f167bd54c763fc8fc3377bb6b9f1105b4bd0760c5a19018c41c3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895694, "uuid": "2832fed3-403c-4f3f-a998-29703c3e7bd8", "comment": "Malware payload (Dridex)", "value": "ba7998c8dbf5acdd5226ed9e1a70a8ee14065aaa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626895694, "uuid": "cdacbdc5-76e8-4363-b839-a6b3995e8a32", "comment": "Malware payload (Dridex)", "value": "12bed7511e468459611e85e0657937c7a6f9d35402242ecb48a4ab9cf68cd257a50537ffec68555ddd7758c269976eb4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895694, "uuid": "37b58899-4530-4c2e-b87a-efe21735522a", "value": "T1E604C0C9D2FA1786D4B1967D1D84531BA4183C09CC35ED96C980CF5EEA3B204EB3675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895694, "uuid": "10ccea27-bb88-428a-b927-b22ef3bca8e8", "value": "44b0dcdef59120fe964e77dc09a5f1e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895694, "uuid": "948c46a1-89dc-4433-a6d4-6bfe41afa574", "value": "3072:kbOeJIBwzBgXbJ26juQdZHT5K4PrsF2ATdwNBJUiG7NNNNNNNNNNNNNNNuPtbXkl:kae2Gzm1dZtK4Puhha87NNNNNNNNNNNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626895694, "uuid": "a95ffd47-ca1c-4543-9cc0-2f28225bedb6", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626895694, "uuid": "3a7dfdf4-e4ed-42a5-b974-fe9b54325214", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626895694, "uuid": "ef006611-487c-4f14-8c96-89840c0e358d", "value": "56c09545b796f22000b20c84bf6b505b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee56bb4d-e9e6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626846361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846361, "uuid": "424e3b0e-f9ab-4be2-8356-b22334d0c406", "comment": "Malware payload", "value": "46e5dfe28aeccc39ea893975d54e3d3b", "object_relation": "md5", "Tag": [ { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846361, "uuid": "6673af28-c20c-47cf-a8c0-22ac94cb0a22", "comment": "Malware payload", "value": "f3efcf47681d9f96afcbc843a241c21a643b173c48270446f6fe634991a57847", "object_relation": "sha256", "Tag": [ { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846361, "uuid": "7f7595e1-2fdf-4e31-94c8-6e9e71e508e1", "comment": "Malware payload", "value": "0df5e8599b332a7927bd0a9d87ad9d6b5ad332fe", "object_relation": "sha1", "Tag": [ { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846361, "uuid": "a0c0d5eb-f161-44de-aacb-aa6d7545dfc0", "comment": "Malware payload", "value": "c461e64eb3a5daa8d5ff8a9c6fa317027d8ad760091c73ecec65648a448a80d44cf80d60c7c41a75068cf5c8c616857f", "object_relation": "sha3-384", "Tag": [ { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846361, "uuid": "13a3c0a9-e6dc-4553-838c-f0a8afe2e4d6", "value": "T144624AE22A7844C3DEA6387083D9D8837C7D33860B5145EF10A6E6A51E937C9EB3861D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846361, "uuid": "da7a6085-e54f-412d-8d9f-6784e0228e63", "value": "650fb6bf48d8b35397597d970226ca12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846361, "uuid": "916eec84-ae02-4a39-b421-b579c67b0d0d", "value": "192:UE4rXVqgQxx5hsUIpYXooyKfPFWQFIZD80Hy5qnajW0w6EdV:F4rXVqgSxvVjrPFRKZDslBwJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846361, "uuid": "ab70b4a1-2f55-421e-9790-f45270c735a5", "value": 15768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846361, "uuid": "c966a4c1-249d-46e8-959a-fb97d5b29bf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846361, "uuid": "dba73c69-ed2b-463a-a8d4-9cd589841b00", "value": "Native.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9293708e-ea64-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626900324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900324, "uuid": "d257bba5-b7bf-4f8f-a2ab-0f2ce51e23c0", "comment": "Malware payload", "value": "c77cd6616dedbf3669345842f7231830", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900324, "uuid": "0aabe13e-bdb4-4eec-86af-535820e06491", "comment": "Malware payload", "value": "f4643ab52e51d05bce715ec6d0baae09ef15763318928c1ed8d3c24b72df3602", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900324, "uuid": "f205d82f-5f26-45e5-bdb6-a2ef30ee0eb2", "comment": "Malware payload", "value": "2a1bd1b6e7048c8e051fcc95707a6f2e6bc61b88", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900324, "uuid": "cdbe4150-5321-48c1-bac3-6254bc079191", "comment": "Malware payload", "value": "c94a94d197e77bda63f19d25673fadb337463376a0980af6e31a6e80a5c0e04a07dd7b395fd80d1994ce2f495bb0950e", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900324, "uuid": "b2eef358-556f-482a-96a8-73d7dac82e02", "value": "T165E449C1EBE1C92FFBD1957A0C524630127CCC4456804B977256F33AB72BA7C8E9A2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900324, "uuid": "cc1d943f-0c36-4e66-b202-bbb84a6585bd", "value": "12288:mGDH3roxGMC/mc4bl3q5uaFsvCgdz2l5MjavMmIf+Y6b:mGDXEUH/4EnsvJZ2lKjavMm/Y6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626900324, "uuid": "6817734a-f3b0-4593-9b2c-3c0f781a38a5", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626900324, "uuid": "e6a551ea-13bc-42a2-9769-111fce25b874", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900324, "uuid": "6bc1ad28-cec8-4c19-ade2-e72243ba8f69", "value": "c77cd6616dedbf3669345842f7231830", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33829fca-ea17-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626867093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626867093, "uuid": "0a61e401-a4ef-4794-a09c-b797fc96ba47", "comment": "Malware payload", "value": "00f6982debf7fc28b7e70b041bc22cf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626867093, "uuid": "effb7771-2df2-4b39-b2c4-c786fb53e4d0", "comment": "Malware payload", "value": "f4ab529f16fd2e88c1e552fdaacacf59c40cf863dfa6356beadaf310d5ae6544", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626867093, "uuid": "cb7f1516-1ca3-4747-a08b-fd0f6cb2cd11", "comment": "Malware payload", "value": "0ea8bb9950585da9969e4da760837fa88505542a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626867093, "uuid": "c79b2f13-b085-4c51-84f5-4883b7303fa4", "comment": "Malware payload", "value": "2e1e4191c383fb2046ef232b6a13eccd698d306c5c1e9cd4bc08153f86faa9b8675c5467486476949dfb4a3a0a7d36fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626867093, "uuid": "7f4befa5-4e83-4601-921f-57d9d4ba763e", "value": "T100156C56A7A800F9F17BD339C9D25603E6B2BC55132097DF02A0DAEA1F336E15E3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626867093, "uuid": "c68ae808-49ef-48ca-a57d-d1e4c66f931d", "value": "3ba132b0b7b7ed434ae1838170143700", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626867093, "uuid": "bb5e1f7c-a851-43a5-864b-f59d265752e0", "value": "12288:R42rO13CWthRtUZ1PuQB/V7oXU8OnSC+s59kr15gSQ/QwroSkohEZQ60Z:e261yWt36Z0QBpuU8HR5gS2QwroB2K0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626867093, "uuid": "9c6a4f19-1d0a-40e9-82cf-56f1b76fc0a7", "value": 899104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626867093, "uuid": "b3a4e8de-5e20-4e45-9243-553a4303940d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626867093, "uuid": "87334524-3b23-42b9-ad37-97ea2257dfa0", "value": "f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9987b265-ea4d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626890457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890457, "uuid": "66899bad-00aa-40b0-9dc3-eac1df62201f", "comment": "Malware payload (Dridex)", "value": "bd59e42a9ee00ba415448c31190e57d7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890457, "uuid": "d0919cca-15f5-4a57-b600-6e6b03575ed0", "comment": "Malware payload (Dridex)", "value": "f4f0127923c4a1c69aab04516907fd4010f9af8302e132b972d053813577b18d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890457, "uuid": "3d3edaf5-ab04-4a4a-beeb-436c98553362", "comment": "Malware payload (Dridex)", "value": "95bc249a25513514f1859b690fdcc41f7fb78bac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890457, "uuid": "a85420f5-388a-40fa-8263-da4a46644c0f", "comment": "Malware payload (Dridex)", "value": "2437f473708db4786a5ac3ed2602cfaae583779ce75e93a0a5e6c6d9f62632b50a4f85c18196c8a9199d7559feb5c2dd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890457, "uuid": "6de5138b-a797-48ac-9269-182d71aca25d", "value": "T1DD645ED5EBE1C92FEBD0D53A0C564630527CCC449A900B977259F33AB72B93C8E892D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890457, "uuid": "bce851e3-18e8-449e-bb05-40a22c2ef9fb", "value": "6144:q0Y35qAOJl/YrLYz+WrNhZF+E+W2RGtqPjKBbA2G0VeU+fMGMdcLJVI1LkbGX:ujwbA2EfKaICa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890457, "uuid": "7d993060-632f-45f1-9855-e2246918737b", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890457, "uuid": "e205b04f-a987-4d8a-9dec-e2d0429484b3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890457, "uuid": "59650370-484b-44fc-a6b2-fea1ed01e82f", "value": "bd59e42a9ee00ba415448c31190e57d7.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a06aebf-e9e7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626846542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846542, "uuid": "0499d538-f19b-4b53-8eca-2d6eb69d592b", "comment": "Malware payload (AgentTesla)", "value": "2ecad21fb0ad5ddb2938d7503152a7ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846542, "uuid": "ca197eb1-a429-45a0-ada0-83af65b8b75e", "comment": "Malware payload (AgentTesla)", "value": "f796a3fb3b89c3361d393605988484621450a0c8a73ff2c7f44ad65d11b56892", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846542, "uuid": "80660b60-15f7-444c-beb1-e723341c15e2", "comment": "Malware payload (AgentTesla)", "value": "89e74cf4461d51031767e4078b96775b808d5f38", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846542, "uuid": "e1baf480-f9b7-467e-8fc2-5fc6e340ecde", "comment": "Malware payload (AgentTesla)", "value": "bb1d82a3f1bd01bda4e1130e65c8bb1eb513dff28f6a55343d9b7c20ae9bfae38ee684ec8405be2490bbb46dd4da58a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846542, "uuid": "99e06aef-692c-4e1b-a2c0-efa61651cc27", "value": "T12FD423C4065A18E77EFAC2A933E772444C4F07E95EC5CABB20C46FC6B90F15984A996C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846542, "uuid": "fd5c34ff-559f-4ab5-a8e6-07e1af0f84d8", "value": "12288:8910yLg/ZaAbxdYjgYCPb5e7nYq+DMI7hOweib2vX:y0NUaeiFe7Yqu77Yw9SvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846542, "uuid": "16c013ca-6f4e-482a-a46f-9a627310ce77", "value": 622801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846542, "uuid": "e034c4fe-2caf-464d-b082-5135aaa35fa9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846542, "uuid": "038f5733-f9de-4f30-bb21-3f050ac2f2c0", "value": "Supply of Aggregate.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6784097-ea66-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626901270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901270, "uuid": "7a918abb-289d-4c4b-a4a1-1bbd1e0a32ec", "comment": "Malware payload (NanoCore)", "value": "767e1c497ff0d617de66c2d8ece44c49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901270, "uuid": "49ed74a5-b164-4b31-9eb2-1de53d9ca762", "comment": "Malware payload (NanoCore)", "value": "f84b3abd9e10ed3595fb957ba10f2c222fa6ac99605bbfd768cc65ee4f59e6e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901270, "uuid": "54bbc030-5e15-4576-b8e3-01d3da142b6f", "comment": "Malware payload (NanoCore)", "value": "118e1e764cd05b98c631bb9a5687acae94f208e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626901270, "uuid": "0e70dc8d-ff97-4acd-9f12-308c8500102c", "comment": "Malware payload (NanoCore)", "value": "79f4c209adc5ade31ef213d663b365fef7a4109f0cfaceb8e3b05888172d015c0572d94e329a5488dea5854cfc4b69b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901270, "uuid": "5ec197bf-5c7b-4100-b25a-30bc27171454", "value": "T1AA14CF2537E84A2FE2DE8AB9711201569379C2E398C3F3DE28D455B79F667E00A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901270, "uuid": "389958fc-fa5a-4813-8a4c-7a047fe7f80a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901270, "uuid": "ae4b0faf-a297-4dfb-8438-e7430081c74f", "value": "6144:sLV6Bta6dtJmakIM5KcGLYiO5C3e6s7338vSa:sLV6BtpmkjYiOS1k3Ta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626901270, "uuid": "7b17c94e-bf5a-4279-8698-2230274fa928", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626901270, "uuid": "8e982b62-2616-486a-b545-f8649e896df0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626901270, "uuid": "614d19ca-39ae-4c55-b965-ab35928b3167", "value": "767E1C497FF0D617DE66C2D8ECE44C49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca35f4c-ea4e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626890677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890677, "uuid": "f665edc2-6059-4db0-b18d-6ef6c3d7375a", "comment": "Malware payload (Formbook)", "value": "6a0200a4316e595561f8527e3bcf27bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890677, "uuid": "a8083083-0532-4fe8-aa0f-1c343bcb4100", "comment": "Malware payload (Formbook)", "value": "f8f02165547227a6692d503cf1203dcaf2d43b58219bb78cb0e42895f49a8121", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890677, "uuid": "09a9c44d-fd1d-4167-b786-362aeaedd400", "comment": "Malware payload (Formbook)", "value": "4c356c914ccdf83b8c89b6a02a2c4a9391094763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890677, "uuid": "a8b6ea9f-8a8e-4af5-be59-8755bd273fa7", "comment": "Malware payload (Formbook)", "value": "555d85392c84783ae4982fc60dcc95ba75b38d6423a91f74e8465e425844ff56ffee1f32c056df3f30c0e748396175ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890677, "uuid": "fb840363-89d1-4669-ad0b-e941b6ceeaa8", "value": "T1CB15CF2113E7A290EC3DA7BC8C38C14597BB7016C67BE77C2D4880BD2E72755AA97352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890677, "uuid": "e5a373ac-62b1-4655-a7fd-6fe8cc1a8e26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890677, "uuid": "fb0b1240-b315-4e11-82e4-f1768a765577", "value": "24576:lz5blkTvDBvsVcU3zqqLa3vhoX9jTRUp:xs9sVcU3zSGVTRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890677, "uuid": "1d6af507-0387-40d9-a6b3-a3ad56d41be1", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890677, "uuid": "2837b4cd-f21c-4801-877d-080d5e6f7b00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890677, "uuid": "0a8aa5fd-14e3-45fa-9695-1f3577c482b0", "value": "6a0200a4316e595561f8527e3bcf27bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0f5b15-e9e7-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626846792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846792, "uuid": "92cedc84-fc46-461f-a88d-cfc3de5e5eae", "comment": "Malware payload (SnakeKeylogger)", "value": "f96dad01ef1975fc088633d5e0155720", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846792, "uuid": "bcb2d8fb-b0c3-4e3d-ae39-7debd7a3061b", "comment": "Malware payload (SnakeKeylogger)", "value": "f96f36b5ba81ef22f295ffe68566217ef767f237210a8acab0fd57744878e436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846792, "uuid": "1b5411c6-2e3f-4e85-b2ba-f6dc5239954b", "comment": "Malware payload (SnakeKeylogger)", "value": "6d35ff17c11cf98b2c86ca7f0b4f39bb28598207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626846792, "uuid": "e2f34226-137a-416e-b70a-0bdaa81dc9ea", "comment": "Malware payload (SnakeKeylogger)", "value": "406e3f4b4aab4fed32c1c809919ecd2519f171a097b251f6998bed319022fd9d750dac8bc087149df53b0b059b6733db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846792, "uuid": "570054d3-2042-495a-876f-f1e5f4ab66d7", "value": "T1DED4E078732BA35CDD7487F92C65E5A267AF602A262DC23C1E84C03DBD7277C2AD0552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846792, "uuid": "8392d531-7ac6-4463-9c9c-a41c46ab076d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846792, "uuid": "518e3590-883e-4d28-aaa2-1681429956f1", "value": "12288:wEiyvUIZbVP9yMhRNbcJdTOxPZhxxzbu4BcFiNX89x5:fJvDBPxiJdgZ9rNcx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626846792, "uuid": "e9f5e97c-c062-4ab9-9968-efb5bf979285", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626846792, "uuid": "198ee770-b21d-4e83-9892-60402bc38ed4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626846792, "uuid": "d9d6bf04-637e-4525-a9d0-8432f859f818", "value": "VrepYj22q4lsHiA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50871fd0-e9c2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626830634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830634, "uuid": "9035363e-01da-469e-a98a-01f0790e6354", "comment": "Malware payload (Mirai)", "value": "2cda7f1b5a0b148baa4f75e7bc3ab765", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830634, "uuid": "a0267cb5-d879-4af9-8f59-19a46cf4a172", "comment": "Malware payload (Mirai)", "value": "f98a0fecfbe28d05f42f9cef5d784287e58485297f8a46241b26b998c57e306a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830634, "uuid": "f0e9bba2-2467-473b-854a-3a84c6983b00", "comment": "Malware payload (Mirai)", "value": "cc99e15098fda6fe63ea1de91f99bdd7d8f006db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626830634, "uuid": "26fbf53a-ca45-4559-9dc7-7623dff28207", "comment": "Malware payload (Mirai)", "value": "5d3ae2aee10ebf9b831bf77512a054d461ca20cb4345c5da534ceeae211667bb1340d1f51f52cf7f024651df67dc3d52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830634, "uuid": "8fc6aa20-8ba2-4bbd-b161-5739ab712c64", "value": "T1A2730846B8818B15C5D422BBFE2E008D331767A8E3EF72129D145F246BCB92F0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830634, "uuid": "14f7fec4-a31b-4aa5-805a-3a7010bb0621", "value": "1536:eonetNhKxIHn8vc2bQHO9q75xV2pybR/j3m1YeFALOacSXIniyvgeVAG69:4t6iHu/bcMq7N2pc/bmGeF7vgeVAGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626830634, "uuid": "497c69df-f9a4-47a1-b996-edddefc4b628", "value": 75124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626830634, "uuid": "6de20d61-3f8c-41b5-a61a-81e0b06ee3d6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626830634, "uuid": "0ff8eb70-0b2e-470a-ba8f-987c60f3029a", "value": "2cda7f1b5a0b148baa4f75e7bc3ab765", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb521c2-ea78-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626908823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908823, "uuid": "0573f47a-43b6-44b0-9a48-7a4791012c57", "comment": "Malware payload (Mirai)", "value": "8da121a5a68db2c5659c33b8ab10ad4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908823, "uuid": "299417db-467d-4dd0-97f0-eec18bc813f7", "comment": "Malware payload (Mirai)", "value": "fc0d8d914323ea847156691985f41fa185e4cf5963cae8a46f532c72604f5988", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908823, "uuid": "3ccabc09-8ab6-4ff1-80b8-3a44a64dd1ff", "comment": "Malware payload (Mirai)", "value": "9245e94c286f3b8db8d6b95fe5870d791d067d60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626908823, "uuid": "ee1b003b-a173-4115-8329-9a969ee5209a", "comment": "Malware payload (Mirai)", "value": "eb6c186e5a958f8fbdc9d58277e5aa44e3d33d69297ea1361ff6113890b8ca67bab6fbf8993ab8239ec72344985f96b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908823, "uuid": "d1ea9009-1cb2-43ce-bf8e-9ac7dc3b9c3d", "value": "T1B1D34B46EA808F03C4D61776BA9F42493323A755E3DB73068D18AFB43F86B9E4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908823, "uuid": "d7806e91-a0cf-4241-b20f-f3a3f5dc503b", "value": "3072:7VvuCmiEdtrs/8w76qJYFeSH+C07gzKrWdr8M/9QHEGNAw:7VvuCmiEdtrsk06MYFeSH+JggWdwM/9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626908823, "uuid": "43d499a0-8f02-4ee2-abe0-53459141d0ee", "value": 134456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626908823, "uuid": "05c6f325-9174-44e8-ab5c-b79478520145", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626908823, "uuid": "8055368f-3a5b-44b1-9144-192af56d819e", "value": "8da121a5a68db2c5659c33b8ab10ad4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdadec6d-e9f3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626851970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626851970, "uuid": "97bd97aa-b8ff-44fd-9959-9697eb96883b", "comment": "Malware payload (AgentTesla)", "value": "2c796a675fe4d3587af0bdadb10abb6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626851970, "uuid": "f8cd5e67-804a-49de-8a32-0f9f0379f5e4", "comment": "Malware payload (AgentTesla)", "value": "fd9f775b62c73a99dc6154eef0d19f9ada23a0d8c1b696465edbad5a946f2680", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626851970, "uuid": "2ce25a24-6fa7-4318-b8d0-84a09da1e96b", "comment": "Malware payload (AgentTesla)", "value": "1914cd557467b294d5fff9d33b90c8eab42a91df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626851970, "uuid": "53030a0d-6318-43cf-8bd4-45b5baca60bf", "comment": "Malware payload (AgentTesla)", "value": "3ec0bdcec9320ba4b51de04048aee159fa1680d58a66923d7397d6368ae0c6fd6e6316b8c7ec4b4777393871212db485", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626851970, "uuid": "c9e9e0e3-eb8e-4cda-aa31-566bcba8ec40", "value": "T15DF4F169722BA30CED748BF91C6AE4E267BB6429651DC63C1E84D07CBD7373C1AD0912", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626851970, "uuid": "1fd5b2b0-6d58-4216-927f-f44eb43a9058", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626851970, "uuid": "114e07b7-fe8d-4ab2-8874-baefde849407", "value": "12288:Q3ByvUIZbVQPY7ryyUBCBidBM2GkU8JHvTCNQ3I/3eRw978:48vDBQEryyK1dxU8JPTGtH98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626851970, "uuid": "e7768474-dc6e-473d-8c51-bc6c2eab2d6d", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626851970, "uuid": "51c8f303-1d14-488c-8368-6dba94f4fb8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626851970, "uuid": "8396a30b-8d28-4eb9-a30c-a037d132506e", "value": "DHL SHIPPING INVOICE.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1b1e4b-ea28-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626874624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626874624, "uuid": "a2cad4c7-6c0d-4ce5-b2bd-705f096c299b", "comment": "Malware payload (TrickBot)", "value": "11a2bbc677b1cc5d53a5d34351c026e4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626874624, "uuid": "662d2b35-1749-4b4f-b8bf-3a2b02547173", "comment": "Malware payload (TrickBot)", "value": "fda93931bb0b67a61cae3acdae38a66fba556813a194239c0391819b3dbfed26", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626874624, "uuid": "06455021-b752-401f-bcab-002ca85fc3c9", "comment": "Malware payload (TrickBot)", "value": "2bfdb0af11e01022bbeedfba846d71b2a29f8237", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626874624, "uuid": "719948a7-3a3a-4f07-93e0-75766e649132", "comment": "Malware payload (TrickBot)", "value": "d6af44bde56017ec0b77e251b7168df0061c22d1891910a23cdf195ae8442bc520f2641c05a702070c08bf0687e61bc9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626874624, "uuid": "47d98267-0ef8-42b8-b021-7deda3e1a9bf", "value": "T103D4C012B590D036D29F01383E515B79B2EFA9A01BF1D463E7F0DB5C8D329825E3B25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626874624, "uuid": "048d2813-c884-4e7d-814b-c5a7600ac0b6", "value": "aa766223dad1548ddba0e06749dd8601", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626874624, "uuid": "a6a2ccdf-8318-4584-834b-d4b5da1a61b4", "value": "12288:t7NI5iGRtGvUw0mKBMGd8gzyYhJ/W2s2dFS8J:7YRtGvUmqx82yYf/WelJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626874624, "uuid": "e497069d-2fe5-459f-80bd-f2d37891a11e", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626874624, "uuid": "5368785b-f24c-4521-9789-053b7a3341d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626874624, "uuid": "57acfc61-680e-4125-a9d0-48dd61eaeede", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb634a3-ea64-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626900314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900314, "uuid": "2a7530ab-6c10-46e3-af28-da6b810cc9ac", "comment": "Malware payload", "value": "5d15ccd61fa8f1488c26d0d4e39904dd", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900314, "uuid": "ffb350f8-9ab7-43f3-b877-9a5679a6fe41", "comment": "Malware payload", "value": "fdd4ee9e0e1f197e66f1efae2ce26db6ef0a1fa0867f9316c3cdb288fff6690f", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900314, "uuid": "24e9a16f-39fd-4a74-a548-2f9453d630d8", "comment": "Malware payload", "value": "40eeb9943f5af7f3e81c1b1a628919dd47be973e", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626900314, "uuid": "3f8e4abc-13bb-47e2-bb70-f1e8cec299be", "comment": "Malware payload", "value": "29804400899e2427b5d3c8a1c612a4b801aaba732a7ecf7e08c6bc7158a60d3b354fc1b68e57990b9b79d8912b260ef3", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900314, "uuid": "e3d28d73-a41f-48ad-998b-aab9ef826bce", "value": "T1BD645ED0EBE1C92FEBD0953A0C565734527CCC449A900B977259F33AB72BA3C8E851E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900314, "uuid": "b1c4be9f-1efb-4f8b-abc9-edbe4bd21bff", "value": "6144:A0Y35qAOJl/YrLYz+WrNhZF+E+W2RGt6PjKBbA2G0VeU+fMGMoafYy/+:gjwbA2EfKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626900314, "uuid": "24db324e-4263-46ec-b35a-8ecaabbf0e65", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626900314, "uuid": "68fa21f1-b73b-426d-aabf-6067887a7807", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626900314, "uuid": "7abda623-c5a6-4ca4-bde1-4815ac6ee487", "value": "5d15ccd61fa8f1488c26d0d4e39904dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d813149-ea4e-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626890705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890705, "uuid": "7b0801e9-d4e4-43aa-a4a4-24701019153d", "comment": "Malware payload (TrickBot)", "value": "b334ee94717042f0eec8afc014711302", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890705, "uuid": "250e14d5-f552-4381-b7fe-4e0c5f1ae0c7", "comment": "Malware payload (TrickBot)", "value": "fe91dea9457e5d92d63cb97758a278939ef33b0529bce694dba57d2db5caedee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890705, "uuid": "8ce100a5-d873-4775-86da-45ffa8dfc10f", "comment": "Malware payload (TrickBot)", "value": "697bfc0d601e704cf603506adda8590a3b5832e8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626890705, "uuid": "80ef7ecb-84dc-4ed5-a450-89b32d1f1462", "comment": "Malware payload (TrickBot)", "value": "5b0f9dbcc79a83821f197d6b80dbf69a3f64142d7ff33c66af8b23a998093cf85fe797fc46f91fd864182c9b2c3846c2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890705, "uuid": "0fe3eb39-57c9-4a33-8f57-3911511b8009", "value": "T101C4CF2235E08577C4EF16345E667778A3FBBD942BF2C147678A891C6D339028B22327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890705, "uuid": "172b95cb-87a0-4872-bb76-385496187f59", "value": "f3deb6209dc9c95daaecc9f849af840f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890705, "uuid": "74c7656b-6466-40e4-84c6-308675a678d0", "value": "6144:6nhWubOStZ6AbgmgwLp3gUhWeGtwOPc/woVPHma1MXohuPATdTpNSTrbkYW412ph:6nTltgBNwxgUXl/DGaXhu45pI3rep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626890705, "uuid": "82b889fb-8aef-430c-972c-bfa8c217d1e3", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626890705, "uuid": "3a6eb735-26d7-4ea2-99f1-4179083965d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626890705, "uuid": "0e50ca4b-e82e-4f03-9262-97f6c05b653d", "value": "b334ee94717042f0eec8afc014711302.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1830ad2a-ea5b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626896253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896253, "uuid": "974261e8-3532-41b9-9792-678dd3bbd97a", "comment": "Malware payload (Dridex)", "value": "3c2244956646acde36ff20732eb63071", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896253, "uuid": "3d62db05-5016-4ab3-8c0c-cce754840691", "comment": "Malware payload (Dridex)", "value": "ff277a5e33ec98ad5f0945834f731e39fa2113ac0369ade14fc690a9d1a7cc31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896253, "uuid": "71f86a9f-888c-474b-9a75-6031607b28a6", "comment": "Malware payload (Dridex)", "value": "f218a9c08cb26388223600bf3691a90be4cdfb7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626896253, "uuid": "c6fb31d5-ce68-4ad1-b55f-4cebfb84fccb", "comment": "Malware payload (Dridex)", "value": "a08eecc332a64d7c5f77070ab544ea4950df4b53e38e3658a3d252b12ae5f9f658a64045177c793f315f2a9784522cf8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896253, "uuid": "5e3a4ee0-aa74-4ebf-bcc6-69e76c282005", "value": "T17E04C077AEDFC0B9F2A39470107437AB26F57A032419F452D661C8DBF83D99468A4353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896253, "uuid": "5130ef83-6753-406e-99cc-a5994c2ea38d", "value": "458d7355fbf070054838e3593829db8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896253, "uuid": "582ce6fd-ee14-4b26-a62c-bd70bd880f2f", "value": "3072:iVadvfvemTEtQ9yoZPW/k/nklVtu77wBeZUCEQZRpABDp57WQhdIif4:LDTyJWPd/nkdqw4/HAB77WQhdIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626896253, "uuid": "c894496d-89b6-4411-8242-73e1de38ea3f", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626896253, "uuid": "f9e3a913-9b51-4d44-ae77-c295f6800ab3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626896253, "uuid": "a4992360-0c1b-45a7-bd03-358628eb7ffe", "value": "3c2244956646acde36ff20732eb63071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }