{ "Event": { "published": true, "date": "2021-08-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-08-05", "timestamp": 1628208181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d2bdea5e-2e21-4648-a6f0-2779488f5686", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f41ac81-f600-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628176702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176702, "uuid": "ff1aee6f-d23a-439e-888e-411fc3c9aa31", "comment": "Malware payload (DanaBot)", "value": "0261d6c09c1f707a5231b9368368827a", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176702, "uuid": "3d590eb3-dacb-48dd-a634-ca8c26a694f8", "comment": "Malware payload (DanaBot)", "value": "00386f5a0b2c05405ef8dded9f15282e5a1d91e44d1264f139ecb9ac1204217d", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176702, "uuid": "83aed184-5c90-48c8-81ab-61ed36f61c15", "comment": "Malware payload (DanaBot)", "value": "e1c2958f6e36478ed1714d2680e3171e9517b40d", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176702, "uuid": "b728c5d0-1af6-409c-a265-5427fb2aa952", "comment": "Malware payload (DanaBot)", "value": "086ee4bb40a2e516847294fa14521f6ae09fc0803d31e9fbcb5d0bd64d162b29156fc5e90401e2c8cade4c38c323bd5a", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176702, "uuid": "bf79c6fe-6abc-442e-893b-0d652727741c", "value": "T11D352326F981C47BE5520BB14EE8C396C7527CA6CC7A29873B94134D1F35582FE6A307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176702, "uuid": "1af647d7-a677-419a-aa54-073b75d70923", "value": "2a9c1ca66125aeff7a1c36242be63d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176702, "uuid": "12f29a5b-9af4-4f14-b093-9c1ddb4c64e0", "value": "24576:V0YILxtm+yLvubrtGyVbwqHx40+8nB9s0YTofO:VCyL2bsMbwEK296WO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176702, "uuid": "8a80e06e-825a-405d-9bc9-634f77ed9807", "value": 1098240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176702, "uuid": "f8e98170-5aec-4a64-960e-b8fa80ae38ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176702, "uuid": "5a56004e-c960-42d4-a738-5009563cd974", "value": "0261d6c09c1f707a5231b9368368827a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237f03ac-f5ff-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1628176172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176172, "uuid": "fdcc8efb-6600-4e73-8eec-b94c8bc35667", "comment": "Malware payload (BitRAT)", "value": "23dd723300b2c35a6c94ab0a53293f82", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176172, "uuid": "16a830b9-b99b-448d-8e4a-2b2e9c119322", "comment": "Malware payload (BitRAT)", "value": "0088daad429de39bd42663b9b508af98da7b8a3d09e4b7ff0012a8901a32253b", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176172, "uuid": "d19fc20e-dcc2-434c-a1dd-4f73e666bf6b", "comment": "Malware payload (BitRAT)", "value": "8a7fcbc04ea369cd9c2e2f41b0846b7ed12b0f16", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176172, "uuid": "31c286f3-1c88-4c53-8f99-6b17fc8dcf67", "comment": "Malware payload (BitRAT)", "value": "e3614a4434aadec3116ec6a4ccff830c65267b9aaa3c2da9ae6ee59d8e63b529231b1ff4f2199e743ad4d5108712d69c", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176172, "uuid": "a5507c69-88d6-482d-a518-e63d50b171dd", "value": "T199E45B66B1D0C479C31118740C1AEEF6652D6D609E58394BBFF93E8E1EB1A653A3E00F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176172, "uuid": "60813a0a-fffe-472b-9ab8-b8fb8fdff6d8", "value": "f1f21c88e9cb261ec581191bb4c538e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176172, "uuid": "d73b5e11-40e8-4599-bd04-6e012dd07109", "value": "12288:cLJ8IaEF3CbhMemzpeVhpEj7c0DFtIGnu+:cLJRaElQMePyNtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176172, "uuid": "360ec97d-688c-43ca-84a1-7a03c5127212", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176172, "uuid": "db2bc8b4-2077-4296-83c4-7aadbaa0cf6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176172, "uuid": "f1a6d26e-f801-4263-867b-428e7819ed06", "value": "23dd723300b2c35a6c94ab0a53293f82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "748c340a-f5e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628163853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163853, "uuid": "e43b82bd-5b1c-4181-9312-b1b132db2321", "comment": "Malware payload", "value": "acdbd3dbe3160cc6e99118cd5a61a60d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163853, "uuid": "d2f04edc-3a0d-4732-a1f8-7b145ea0dc34", "comment": "Malware payload", "value": "0201805c8199e6a427225194eff554a62cf1bcb008fc7e61fc6da1d3177d5d09", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163853, "uuid": "4da1f3e2-3f86-4ca0-bb34-485b2e793c08", "comment": "Malware payload", "value": "562c4cb09647135b79e692485071b706f093e176", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163853, "uuid": "2433929a-abfa-42b6-b077-bde0c1d8b814", "comment": "Malware payload", "value": "2a7cf9ef238bb9ef82b4f7908eb97bad2a18df9f8ba4c0f2afe6ac24f4b7254558c3f4442422eaf06077edcad5be4f24", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163853, "uuid": "4b51da63-6990-43b1-b075-3bdc3e525acd", "value": "T1675423BFF21B081D6F59886ECF7CF4101A347D2116D1986F6A3A77C72B55E0EA028C4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163853, "uuid": "8f134d6f-286a-43d1-be79-06808891405e", "value": "6144:jzJLUrot1Ll//tiGSe4L5qwZFgWuI13fg1lRNkoopHorP5VJJ0:jztRtLj4c2CIdfgbRNkRpHorxVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163853, "uuid": "65bd272e-a507-4250-94e6-829350f79c21", "value": 289756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163853, "uuid": "e9fab4a9-2e10-4717-8d32-4769c9b3c46e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163853, "uuid": "4ea3795e-d498-4af5-a93f-e03fa9f88f51", "value": "NEW ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d04acb8-f61c-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628188670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188670, "uuid": "8524295d-2ee9-498d-9ca0-46b80f1ee885", "comment": "Malware payload", "value": "71b6febdaccea66e739ead121613814a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188670, "uuid": "e2ddc206-57b5-4960-8c69-cbc91b977239", "comment": "Malware payload", "value": "03ca3c211536cd312b4e46531314c5ad021171026441e99f1d951b9ee8e29e46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188670, "uuid": "804c7718-5d2c-46b1-8820-088c0d8dae00", "comment": "Malware payload", "value": "10a055107d83f9bc7ae5dd0ba6cdb2f368c014cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188670, "uuid": "a3e5e1be-0dee-4e77-95b0-12bc975fae0d", "comment": "Malware payload", "value": "f098c572520453cc155170b1bb6f870f1a3e68d574d9caec63322662461f7f77d61baf06b41246e6f19b8e8714436746", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188670, "uuid": "050bd6aa-690c-424a-aa27-0e2339d44bb4", "value": "T101255CAE365032DFC8A7C872CA581C14F7A4B467534BC743905326ECAA1D9ABCF651F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188670, "uuid": "490b5c6e-a372-4562-bdb1-ce152d19e827", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188670, "uuid": "2a5445d1-9958-4336-9313-212f94428690", "value": "12288:0T7zT6Ffi0i/75/BH2djXOQ0mp0ptZJKI/W4YtPw72ygbSOTNdj5Ir5ctQfO001K:0T7yFfvi/75/BceQh0nZJKIuPQMTLIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188670, "uuid": "36d52524-8409-49bf-885b-58f8dc4e7007", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188670, "uuid": "618f3a5c-9a5d-4ada-9feb-0b1a2c927248", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188670, "uuid": "2efb1c24-c95e-4c0f-ab91-b89ba99efe73", "value": "71b6febdaccea66e739ead121613814a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65555c21-f5be-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628148365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148365, "uuid": "2bbbef87-b766-4809-9394-f2e901f6c3eb", "comment": "Malware payload (RaccoonStealer)", "value": "d1dde95cd9f06e02cd390e4c3d4e4903", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148365, "uuid": "b29c5633-8fe1-4793-9c68-48dd522baecd", "comment": "Malware payload (RaccoonStealer)", "value": "04b34c18709ece0d212e247408e19b638f9eddd1dd24cf9c839fa5bcee5fc9b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148365, "uuid": "0cd6d41e-aa92-49e0-8a9c-4a7fb7caa181", "comment": "Malware payload (RaccoonStealer)", "value": "f5c28eda724bedcc8b0c06ff29da1f69aa871f5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148365, "uuid": "7ca003ae-634c-4706-b5cb-4f5c6ff4f091", "comment": "Malware payload (RaccoonStealer)", "value": "3c26ccd1d1a435e5bac2babdada6310f517dcc928223b7cb2c3e0ec550a54119747e957dee2d5090ea19b129c0a3bd9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148365, "uuid": "fac629b9-b731-419f-9e47-83c348fe1e1e", "value": "T108A4121138A2C473D76E057D8853CEB26F3A7CB44DB59A872B81426D3FA11D2EE5630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148365, "uuid": "401b630b-ae89-4876-a6b0-f4e12e955942", "value": "e2ba8e1f75a8e02687cc194905c50074", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148365, "uuid": "750b4da4-d60f-42fc-aea1-37dd3c6f2935", "value": "12288:0VBVsYBVEg7ahiLEdiHTd2Dx7/AbPw98nRG:02uaULEd0TdAx78wiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628148365, "uuid": "b99d7326-1748-412e-9b32-012f50647e11", "value": 473088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628148365, "uuid": "16753e28-c1e6-430d-abab-8e4462923f58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148365, "uuid": "27bbd534-bde7-42f2-a97a-8dbd02a87aac", "value": "d1dde95cd9f06e02cd390e4c3d4e4903.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c410fb9-f61b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628188347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188347, "uuid": "7e52a1de-8f0f-4771-8cf0-0f3af5a0d742", "comment": "Malware payload (Formbook)", "value": "94589c900f582c827be848f069c01983", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188347, "uuid": "8505fe78-b2bb-4aef-a656-e14663d5d0c7", "comment": "Malware payload (Formbook)", "value": "04e127c5bdf94f075639d7f44badd25223f3ebeede44258367413d8463505020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188347, "uuid": "96cfe81c-bad0-4b4c-a35a-b27d020db3d6", "comment": "Malware payload (Formbook)", "value": "bd1d7bd592b90f9322dd738daefb7306822cdeb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188347, "uuid": "27e9d88a-9409-4066-a81c-a9904cc3f900", "comment": "Malware payload (Formbook)", "value": "33656961669df7a32981808667cc1893f3eae177cc41851956f0995a8c7513c6ba3f0c52666b028ac070977c208c8e73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188347, "uuid": "b38ce727-e710-4479-8904-cd62c32c004e", "value": "T1F5E401BA5188BF9BE22C07B827A8530853F991B55ED1F647BC90BCF5389E741C34324A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188347, "uuid": "1c1cc971-e366-4162-bca4-a2c08fcd3ce4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188347, "uuid": "1289e331-7acc-4afb-82d2-de6d987dcf33", "value": "12288:gtWrVHYuWorkU44r2nsjyqJBGKg3p/4F6tDnrJ/4WDO9XM4vuLR1xWWU8XBq3E:gFmB4yvODmevKWDe8UeBq3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188347, "uuid": "ebedf060-9c5d-4af9-b577-8f3c6a40af0f", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188347, "uuid": "e90d6453-0eec-4bbd-9566-002f98c3872f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188347, "uuid": "36117c67-792a-4a9b-83a5-c4e9daf71edd", "value": "94589c900f582c827be848f069c01983.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009395ad-f5e6-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628165376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628165376, "uuid": "53b8109c-bb96-43cb-99f5-d89fa879c874", "comment": "Malware payload", "value": "7cf0b940c39b45217b214ff26e78587f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628165376, "uuid": "2cd269c2-293a-4b37-aca7-63d114bbb4e2", "comment": "Malware payload", "value": "0532411d15ff23b27d4f5306264a32e972c0181dcb5ca0fe8a9b6694a2280369", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628165376, "uuid": "3e138fb8-7a43-4e82-ae19-3e58ee37ef0c", "comment": "Malware payload", "value": "cf21bb7712bdae111632c7a13940351b491343a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628165376, "uuid": "025e5608-16f1-4c58-8435-a7fa9fb8602c", "comment": "Malware payload", "value": "b584c50357b5a37b82912457b5b632bc337b565976a6019a618200622d9b12ffed30105f0d78fdd4654b54a5d3486f84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628165376, "uuid": "3dad44b5-091a-46bc-955b-5cee07680351", "value": "T1BD473320F6401E47DBF98A73F0A2DB725F296D37471540E70B6992E94CA7781B83DE28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628165376, "uuid": "a901595f-f701-435a-9a6c-e79d01e89849", "value": "7235131d58a25a8130aac9df516d4024", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628165376, "uuid": "81a48631-69da-4ada-b5c8-1d7b22a3c5df", "value": "393216:uAP1dyZTDeIRs4dpRhFrjclKdBIYcDJADjOSY1OTlWG80rY3jVMQZTAkWmGN7:b1qDeIRLFrIsNIC3OSVW6c3vTAtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628165376, "uuid": "d48c7f67-6e06-4477-91c9-fe6a179fa428", "value": 24741198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628165376, "uuid": "05d45bdc-7e94-4bd8-90ad-9613e25fcf22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628165376, "uuid": "2fdc120d-d2c0-4c52-9fde-5a5582f9a37a", "value": "SecuriteInfo.com.Trojan.MulDrop17.52128.341.13409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf39aaf1-f646-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628206928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628206928, "uuid": "7bf26479-d85d-48e0-929e-01f62ea53125", "comment": "Malware payload (DanaBot)", "value": "c816517a9f394d367fdd12bfafb814b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628206928, "uuid": "f6313a9d-1582-45b9-9b6a-8b1c41cf36f4", "comment": "Malware payload (DanaBot)", "value": "053542bbd9ab3b0436469e6d6ae5ff0b72e55f882a08e23d8ab481e1357d9528", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628206928, "uuid": "123a95b6-6fbd-4b73-a13a-c03f5eb6f54c", "comment": "Malware payload (DanaBot)", "value": "2aad9407b2230a9f1e0c94135908aa78f27dd65b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628206928, "uuid": "cdaae5f7-7abd-4a27-b953-24aa0dd87672", "comment": "Malware payload (DanaBot)", "value": "fbad9bb50eaeb60a84fda69f68f602480f61bb9bf27fb2950e19458716ab2686d2aaea6dbbd18d9acfb3f72ce1791cda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628206928, "uuid": "47ae6e5b-1927-4562-b472-9b18b498ca04", "value": "T1403523332580D833D027BDB858AECEA53A7A7CD5ED61954B3F90579E3A30AC08275397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628206928, "uuid": "a2b28491-c308-45f2-8011-b97850b6fc2d", "value": "14314a2a561f3c740022851a022f21a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628206928, "uuid": "4778bdde-574d-4308-be7e-66655c8639ea", "value": "24576:kn58UH+Y7r7VrOs8WvW4eba4NG/2KQy1v2wEzAdRUjdYT:kGt07JOsNvWxeAG/2q1vCAMjdYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628206928, "uuid": "c44e29e0-7707-47fb-875d-f6576ce826d1", "value": 1098752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628206928, "uuid": "14be5077-81ef-4055-a7ef-03f40edcae62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628206928, "uuid": "73baac05-2948-4c76-a1f6-f23661351bfe", "value": "c816517a9f394d367fdd12bfafb814b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d14833-f5f5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628172118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628172118, "uuid": "c69cf735-db78-4f79-9409-eeeff3a1b758", "comment": "Malware payload (RaccoonStealer)", "value": "694c8583034b2e42800fd74d6a12d25b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628172118, "uuid": "bbb922dd-676f-4ec4-b6ab-c094a8f5ba65", "comment": "Malware payload (RaccoonStealer)", "value": "06354a4c57fe091f471c92cc648e6fa88aab354127bb8cecaf6ddae358805782", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628172118, "uuid": "d63ec7f2-4b87-475e-b6d6-853d9ff7fe70", "comment": "Malware payload (RaccoonStealer)", "value": "dde8d71c906515cfbda61be623719b829c94839e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628172118, "uuid": "ef3966c5-fa41-443e-95d9-b3dba45b5430", "comment": "Malware payload (RaccoonStealer)", "value": "91d38a782b3c9d9d97091857874063bd7762eb5d8a6eecc54728d15eace6b862abae1a219fce0468851a219073fbec51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628172118, "uuid": "985b31eb-1bc6-4366-ac93-ce5a7a261aa5", "value": "T1DCA402917641CC3FF5A1BAB04555C6616A27FC24CD209BCB3B86A35D6B3A2E1AF34307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628172118, "uuid": "75655bc4-5bc8-493f-aeb6-5d652a092a16", "value": "5db1361d34b46103924e72350663b6e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628172118, "uuid": "1408185c-24cc-44f1-9204-96d249e96fc3", "value": "12288:EbfEqq0qFQq9qDZUwQzMoPhWob3wOITj8E9oi0KtP:ofEqq/uqc9sb3lmpp0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628172118, "uuid": "cf6e2525-bf3c-4d68-9333-8ae03d7f9819", "value": 488960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628172118, "uuid": "bc92ff85-838c-4ecc-bcb6-524ca50dfeec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628172118, "uuid": "9923e4f4-1bb0-4946-bebf-9aa755f28290", "value": "694c8583034b2e42800fd74d6a12d25b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868fb59a-f5d6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628158729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628158729, "uuid": "528fae1a-1e00-4357-91de-fb179dc0e2c3", "comment": "Malware payload (Formbook)", "value": "ccedd914fbe08e1b2812df96dc74278e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628158729, "uuid": "24d6a00d-390a-47b7-933c-b0fb1569e702", "comment": "Malware payload (Formbook)", "value": "0655ee712ee939add7c23e011eb887fe70f085e1fea6df1dbeb07bc8df7ffdb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628158729, "uuid": "56090fa9-a21c-4cc5-a35c-ee8c57a575ec", "comment": "Malware payload (Formbook)", "value": "28f842d61848963be0c801a1276413488e3e1c7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628158729, "uuid": "ad2c18fc-6aae-4922-9900-1bb8d49eee3f", "comment": "Malware payload (Formbook)", "value": "3dda2035f3e9e647289476e79e013c5ea173d4dc277ffb7627b063d9188e82d7982a53372ddf17d2d2ee594f60468a40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628158729, "uuid": "2aa27e6a-106c-4534-8516-6fb82c3e01c4", "value": "T10E54E0013595C8F3E5210A714C55CAA1AAF77C724D7A9A8B3F85676E9F322D2CE2C307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628158729, "uuid": "fbcb1051-d8e2-49d6-ae8f-999e496d721f", "value": "2a9c1ca66125aeff7a1c36242be63d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628158729, "uuid": "c27b0cde-c481-46a9-b8f2-fd552a0eadbe", "value": "6144:p6W2Lqr88kcKh6skSJwTxUl2IcseaMV7m:QTt8LSJwTxlIcQS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628158729, "uuid": "339cae01-0be1-4045-96c0-bc94b270539e", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628158729, "uuid": "078dacdd-daa0-4d65-876b-1b84b6c78a9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628158729, "uuid": "b83afdc6-21a7-478d-99d0-c4069277033e", "value": "ccedd914fbe08e1b2812df96dc74278e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba34348-f5f1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ZLoader)", "timestamp": 1628170280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170280, "uuid": "9c06943a-839f-4a05-aa70-ff271ab24fef", "comment": "Malware payload (ZLoader)", "value": "5f4069c9716193f3592946f168f459db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170280, "uuid": "9556f5cc-3b7b-4b5a-af22-5f5da38ba319", "comment": "Malware payload (ZLoader)", "value": "06f39b7745fc370b817fc6f4ba226ac2f39994bf7da7296a99feb68d730ed174", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170280, "uuid": "80cb9a82-e79b-4874-b43d-5e9b397be779", "comment": "Malware payload (ZLoader)", "value": "e16fe562704106b55d40c3f6525dd1a56a5f5df9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170280, "uuid": "ed342407-ed3d-418a-83f8-9385c672f026", "comment": "Malware payload (ZLoader)", "value": "8dbbc28736d971b274feab33d01c153d74f864f9c0de82984f4e82b9386ce87b4fd0595fadd6cfcf85ce87726ca6319d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170280, "uuid": "2024838b-617e-4941-83cf-9f03cfe3d5bc", "value": "T128F36C0BA7F81066E4B5937059F202D359327D715B3882EF128E997E1E336E0B632B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170280, "uuid": "0ab16827-fa2e-48ef-ab3b-bbf718dcaabb", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170280, "uuid": "c7ba9951-7ab7-46d4-8677-2a95a6272438", "value": "3072:jahKyd2n31F5GWp1icKAArDZz4N9GhbkrNEkbk2rv:jahO9p0yN90QEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628170280, "uuid": "65b1665e-b99c-4e08-be5a-9d8d8f2a6a6f", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628170280, "uuid": "b377072a-fc50-4900-9b4c-fce80f6abc9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170280, "uuid": "d54a7685-5392-4ce5-9e1f-2c59f8b53dce", "value": "5f4069c9716193f3592946f168f459db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746c617e-f62d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628196065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196065, "uuid": "9a470c48-0ba8-446c-9508-1f8ca07777ab", "comment": "Malware payload (RaccoonStealer)", "value": "8c1988306df71b1cbe4b53232619b50d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196065, "uuid": "268ed643-9e37-45b7-a42a-5fca8c3521de", "comment": "Malware payload (RaccoonStealer)", "value": "07c4e57ec7a5cee875b35fc78c4e54a89a27718a6a843ffa104f564698201ec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196065, "uuid": "11eafb65-05bf-4bf3-813a-91517b756c77", "comment": "Malware payload (RaccoonStealer)", "value": "abbfd0fbc4023471323b675da9f0dbb9108413fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196065, "uuid": "18c27648-47d7-468a-8e67-fa06cd10f16b", "comment": "Malware payload (RaccoonStealer)", "value": "d45e1f11c51010689981d9efaa1040f9d9f47f77a74f1776d2d91cb6496e7261933d22beceadd9484fba883a4c89d4d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628196065, "uuid": "173fbf1a-e534-45f1-9646-512da8ad7b9f", "value": "T1E7A41222B740CE72E9437DB524A2CB41BE6AFD60C621D206BFA7179E3F212D09776351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628196065, "uuid": "3be4ed09-d8bb-446a-9057-bcdeafc870c5", "value": "6809132c99c8b7d8b68eb68186d7f67f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628196065, "uuid": "50cbf304-43f0-44b9-a9fa-c7be9b8000af", "value": "12288:byA4Dtg4rtUFZ2ziT2u+ASkRcu46CRjYL:i5g4eFUGT2XNf9YL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628196065, "uuid": "54a89d39-60d6-46de-a82c-6b0604273cd8", "value": 473088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628196065, "uuid": "c1b11f02-b6fb-4477-9805-d35f2a4f8a87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628196065, "uuid": "43bfad29-42a4-475f-8b30-ae82ff80358b", "value": "8c1988306df71b1cbe4b53232619b50d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c2b0f2-f62d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628196101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196101, "uuid": "96acd40e-6e7b-4f76-8bd1-959a8d405683", "comment": "Malware payload (Mirai)", "value": "798e91708cc8f9a4e0b607610bc708db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196101, "uuid": "e99e730d-8247-4c56-988e-906ab9ab2ac3", "comment": "Malware payload (Mirai)", "value": "07ddfb3c9edacf6bd130bd8310c4a4dc05350c6df2dbb0df38e59f89896094ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196101, "uuid": "effa9301-4236-4d07-b48e-a0643e2faa58", "comment": "Malware payload (Mirai)", "value": "4f6050d2bd7cdc1823cbb5d7bc78ef4afc2e6433", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196101, "uuid": "788f57e9-109c-4683-8c04-fecee39392f8", "comment": "Malware payload (Mirai)", "value": "d1eb756258fbbdd78db2385b49c603d5e27a2170b2825bd50daec3f32f46cdad7b5c72fc0b40c8503fdf5f97aa7d56db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628196101, "uuid": "11ed0524-c02e-4b58-9885-003166a46355", "value": "T1A8133A56BC918A2ACAD0237BBE6F548D336167EAC1DF7217CC146B2077CA50E4E63781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628196101, "uuid": "c40c55e6-19a3-48a7-8bb1-ec61c8ac8229", "value": "768:m7rD56t3UmLEFv86x13lbp2Jd57bzSZPyo/asep+JKwpY5IGRSav31PmB0Oj1QVv:g6tkmLEJ8oOnHo/aBpMKwqSgaHj5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628196101, "uuid": "cb622b0d-62c2-4265-a2de-db8aaa2d8e23", "value": 44900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628196101, "uuid": "b2070159-d43b-41bd-b31d-ae2bc798e509", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628196101, "uuid": "4575a828-7cf2-41d9-9330-753c6696ed03", "value": "798e91708cc8f9a4e0b607610bc708db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab8add2-f61c-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628188908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188908, "uuid": "dd43b418-d284-456e-91f7-230c4c46b199", "comment": "Malware payload", "value": "bfdc6b9626ebc50042b3aaa98f9e4b28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188908, "uuid": "2b6c2517-57e5-4d26-85df-b5ea50be3961", "comment": "Malware payload", "value": "08da3e0469aeef33e9297ba4e98c67717fdff972a31782ccf539da0bf026bfb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188908, "uuid": "f314c11d-b71a-45dd-9605-b9f95445351a", "comment": "Malware payload", "value": "1baaccf5312e31af76226563d0888da5bd01eba0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188908, "uuid": "4c1243bc-5ec8-4453-91e5-83424448eb87", "comment": "Malware payload", "value": "86dc8dde0bf27cf84ef15628a2d19a33052fd6178b5348e6388f388891e49f7de78cdc0764793a9d161c6651a82eba60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188908, "uuid": "5b1b062d-ea70-4fb3-9cf9-2a5373f199f8", "value": "T13CC4AE3383840EDBD3B850B890011901A2F5C25BB293EBB27DE458E975F5BA9D7F351A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188908, "uuid": "3677b10b-ca8e-4adb-9b91-37cb3f61bbb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188908, "uuid": "63f0091d-0223-46c3-9947-4a3b93cba529", "value": "12288:+G9BcAs40ifjOT75ItUf+v07/KrDgegG0:XBc9FiUNISK0LXG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188908, "uuid": "ed28b39d-118c-4a94-a7d6-8bf5f12488e5", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188908, "uuid": "ff77d181-0d01-4e69-a33e-5b1634ea2123", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188908, "uuid": "b0f87b70-b05f-4ea8-bc34-8c2232a89441", "value": "bfdc6b9626ebc50042b3aaa98f9e4b28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d51c04-f612-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628184467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628184467, "uuid": "660c6f18-a02c-499b-b6b7-f228de242199", "comment": "Malware payload (DanaBot)", "value": "a566e990569d33f61fcd5712953e46b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628184467, "uuid": "90bc37aa-ce95-4d53-a308-f02291eca1ae", "comment": "Malware payload (DanaBot)", "value": "08dcec9e59f25bb87556ea5acb6c778d88f5bf14d4a130758543f85923e646a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628184467, "uuid": "e20ea823-6807-4bf3-8366-7ab7c228b288", "comment": "Malware payload (DanaBot)", "value": "8ec5c1c91ffddd646515e1cf8ae1be49309f5d4b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628184467, "uuid": "bf561cb0-964e-462e-b6e6-59f8d9c12796", "comment": "Malware payload (DanaBot)", "value": "b03e7bdbd17fcbda5b8c491efdbc81ef5c5bb479a57af54e7f233eedb7976e63b3dd237ac09d8dc7346b08591b691684", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628184467, "uuid": "20e494dd-015b-440a-9c75-be324ecefb24", "value": "T1C73523027941CC76F0623AB54A09CAE06E3BFD66C9A5AA57BFC6574E2F152C2DF70301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628184467, "uuid": "c1d992d5-25a6-42a9-b2a8-81a1169becf0", "value": "c36bba2f7ed1360c17671decb7b1e9d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628184467, "uuid": "917a2ec2-e1dc-4b49-963d-fa2128bd3efa", "value": "24576:DJSnT43vt7dgVL2TE+ZgsPsu1MtxVvt/eXGigJ8YL:kT4fgmEyKu1ml/6KJ8YL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628184467, "uuid": "8038d6c1-c663-40d0-b7f5-eec47b037813", "value": 1137664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628184467, "uuid": "2da2a5e0-5d2a-4608-b7e5-988cb9bfef58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628184467, "uuid": "f7ed93f8-2891-4c8f-8ee3-0f9ce9d9682e", "value": "a566e990569d33f61fcd5712953e46b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f38b709-f5b2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628143094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143094, "uuid": "c1bd3849-b7ec-46a2-a75c-84882eb9993a", "comment": "Malware payload (Formbook)", "value": "9e619445c257dcf062bb1791942d3bca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143094, "uuid": "7fd35bb5-3932-4422-83b7-af95b3a0195e", "comment": "Malware payload (Formbook)", "value": "0aae8246644059c7f7099859255863f5b32bcc04118717f44375928b3cba9add", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143094, "uuid": "ec909f8f-45e6-49a8-ab1f-fd3bc257ad29", "comment": "Malware payload (Formbook)", "value": "4b72570a1fdd5e1cade32730f1440e746b64f12a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143094, "uuid": "45b0d724-6d52-4b8c-8b02-75951495a449", "comment": "Malware payload (Formbook)", "value": "22b2858a337d83092ea3481c7a02fb006f4688654e8fc116ee3817c7509b79d95bcc1b80b9b2b23e6835689f398b5be2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143094, "uuid": "58f19b88-f7c5-427b-8ed6-c901bc18b003", "value": "T112B5C1A3F22CB33EE51551B838D59D6E56ACDE3C561EE1062B72329BE420A1C17C0ED7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143094, "uuid": "454cf941-16cd-43c9-9196-2ceac81e635a", "value": "24576:PuOfaOfaOfaOfCOfWOff0eVfu9RXUp7JIQsqVVEskIWK2OfaOfaOfaOfaOh:Pvu9Rk7JZus1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628143094, "uuid": "b095bd7f-bf09-47d9-9b31-707de3284ff1", "value": 2397410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628143094, "uuid": "160582f8-dbad-48de-ae31-51ccebc5e68c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143094, "uuid": "c457eed8-490c-431a-a497-a29545972fbc", "value": "9e619445c257dcf062bb1791942d3bca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb74099-f5c5-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628151575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151575, "uuid": "b0d96d36-edfd-4c75-bea0-2f53b2cce284", "comment": "Malware payload", "value": "599dfa297a7933c72569f0a715a94e5a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151575, "uuid": "bbe43847-43ec-4285-9fc8-1bde075e3992", "comment": "Malware payload", "value": "0c8b4552d5808ddc4dac11749b00e950fc815824500944ed75a32ca46281e105", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151575, "uuid": "6ea5b2c6-fff9-4414-9f39-913694838453", "comment": "Malware payload", "value": "4dcea8fd9b93a4dbc25a1d4d7ff800ba41ee9db4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151575, "uuid": "ceac767e-17b3-46e1-80d8-90c7db70d360", "comment": "Malware payload", "value": "429131bf0049e52479588ebc091652bc4233259c159be47d98ab6b3e262aaf8ba0086a65c76c43471d5306d8ec1144d5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151575, "uuid": "dc582007-af18-455a-aec2-27657cbf6f02", "value": "T1255423BFF21B081DAF59886DCF7CF4101A347D2116D1986F6A3A77C72B55E0EA029C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151575, "uuid": "cb4e5aa4-73ce-475d-8650-da6c75f6a407", "value": "6144:nzJLUrot1Ll//tiGSe4L5qwZFgWuI13fg1lRNkoopHorP5VJJY:nztRtLj4c2CIdfgbRNkRpHorxVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628151575, "uuid": "0898eb4c-7ed3-4203-b92c-6cb28fc00312", "value": 289760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628151575, "uuid": "95c739f3-dd74-4a3d-9c64-a0b5b8a0608e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151575, "uuid": "28200598-683d-4a9a-8b7f-3b4d33b6bce5", "value": "SALES ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf5e750-f58f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628128245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628128245, "uuid": "647a8bd7-61f3-45ce-aad8-8490988b65fb", "comment": "Malware payload (RedLineStealer)", "value": "6621c0e6b6a64c9244b3fea0fd8e662d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628128245, "uuid": "ef758ca4-d3fc-497a-9f77-8fc7243c2013", "comment": "Malware payload (RedLineStealer)", "value": "0ccfbc16ae8b084b8ea6c8585ec8973f78304e18ad0317b51beca03c5c0eb499", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628128245, "uuid": "5ab2bade-30a0-450f-ba48-4be88a65fc01", "comment": "Malware payload (RedLineStealer)", "value": "f9ef8d8b7a6d1ad92971e35d96d36642e18a1f8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628128245, "uuid": "fc540bf9-45d4-40bd-92c9-3efed7d727a6", "comment": "Malware payload (RedLineStealer)", "value": "dcfa495675bd9ae25b12fd5f833e20acd8bd2abce9ca0996354e284a9005ad7a2b329ed47a249b70172b70bda358f44a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628128245, "uuid": "c95814b8-ed6e-473d-b7ad-499e472b4811", "value": "T1CCA34D2163ECDA2AF7BE0A3564700515C7F1E08FA011E75F4EC6A4DB2E76B8229546F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628128245, "uuid": "6820ddf8-1017-40de-9b4f-6598284d7799", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628128245, "uuid": "e9c83efc-a356-4e4a-be74-f7133db0c7f8", "value": "1536:93LNmocuiRYBsU8ot4ikAYGOKJF288smbfexvbuvUyyedg983ZqCxXsE+G6ijoi8:9xmocX3ot4fAPJz8hgbucyzdQSn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628128245, "uuid": "275e33b0-21ae-4dc5-b4b5-dc6ed3c53789", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628128245, "uuid": "d9f56bc5-1f8e-4f97-95b6-fad626148bca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628128245, "uuid": "b1b0c884-f6d4-4422-8ba5-1aecc2663423", "value": "6621C0E6B6A64C9244B3FEA0FD8E662D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd8b5e5-f631-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628197882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628197882, "uuid": "738a19b8-1524-4ef3-b539-12c355875cef", "comment": "Malware payload (AgentTesla)", "value": "d79d866a100dd80f8542105f2cda5849", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628197882, "uuid": "413ae5ac-5fed-4aa3-b0e2-52c601889a1a", "comment": "Malware payload (AgentTesla)", "value": "0ce584c6859a30c7831780cad7476db2510829d01afe84d19ac7aa9cb6440ca1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628197882, "uuid": "124fb6fa-7beb-40d2-8717-56d03305c6c9", "comment": "Malware payload (AgentTesla)", "value": "2149c1927c9fb261ee2eadef94162f4525a8b99e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628197882, "uuid": "29ec7f41-80d3-4b24-9561-a3332f592ca6", "comment": "Malware payload (AgentTesla)", "value": "6d0f4a182e4e61022ced6eafe5bff2ee04e973d6508fc2c8ac809dfa5b7effc4fd07d8c20e160fa2708c9c139dcd7729", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628197882, "uuid": "157e2451-09b7-4983-88cb-ca6fc10f4095", "value": "T161F41214B3981B60E47E6BB45974404427F4B1199B27EF9FBFC064DA4EE371883ABB06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628197882, "uuid": "87663bc5-c8f0-45df-9b56-8754daec21d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628197882, "uuid": "4c490748-6f5f-4b61-b3c5-d2d8756321fc", "value": "12288:gBPNCT9XGNkdcgORn+HvkzCl+PszVyzTGz4HzvuwxuB8gwAt2NjFgYq:JZ2NkdcgORnBCMIyzTNH4iglMNji7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628197882, "uuid": "dc9c7abc-f418-4332-8201-702a876013fc", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628197882, "uuid": "e1f1ac44-3e22-4f17-b9ee-14fd9d60c979", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628197882, "uuid": "0262ace0-1fb2-4b0a-b624-e4b8de04f460", "value": "SecuriteInfo.com.ArtemisD79D866A100D.3881.30384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57063050-f5fa-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628174111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174111, "uuid": "22ed48b5-d876-4fd6-b6d5-50ae46eba407", "comment": "Malware payload (Loki)", "value": "74c0f41c711f0113e7a4e15916559950", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174111, "uuid": "edf15bc3-1b20-4068-9d13-6b17b3c95e1f", "comment": "Malware payload (Loki)", "value": "0d417500d89da353ad3823bab881f3ea98f23bc21fbb66e3942215a05877af90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174111, "uuid": "76a440e5-e6ee-4158-a69a-9f1a0d40c025", "comment": "Malware payload (Loki)", "value": "206920db72d4b5c448b6f24047a639d992766c7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174111, "uuid": "e7c8ec25-047f-4f2c-bd44-d25a74e3aa89", "comment": "Malware payload (Loki)", "value": "8f3769e1eb399da1d1af1b74c7dee1d1b62143e4fed18d3c1813fb484ae857cc6b6399716feb4b58781e2d6181ef57db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174111, "uuid": "9c29fdef-3461-403e-8c60-745ff4c84ed1", "value": "T194C4F151B9C2E823D15A4A32C993C9B45B3CF9102F919BAB77840B7F2F656C44520FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174111, "uuid": "33286e1c-7595-4d01-946e-622e5314693e", "value": "7f3a4a0e96d9bcc5b3425ad3dca611da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174111, "uuid": "e1d62f8c-67a8-4030-9fd8-6b4be40151a5", "value": "12288:Wbfkuj587pX6UwIQ1PyNFijB0T1tbx1gbniWUfTgTzTTTTTTTTTTTTTTTTTTTTTJ:Vu187pX6wmy/60T1tb/cniWUfTgTzTTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628174111, "uuid": "de7f57b9-2a40-47fb-9ccc-18d8c9bd1ed1", "value": 590131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628174111, "uuid": "70228372-aad0-4380-a289-bda29463aa6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174111, "uuid": "4ea21568-2818-49d5-b516-738906f6dd6f", "value": "74c0f41c711f0113e7a4e15916559950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8288e4c8-f5b5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RanzyLocker)", "timestamp": 1628144549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144549, "uuid": "d5ecc031-fbc9-4386-9398-e2101455dd1c", "comment": "Malware payload (RanzyLocker)", "value": "84e8bf44a339c6c2a51aedb17b52e83e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RanzyLocker", "colour": "#537C32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144549, "uuid": "a933bef3-be3f-4aba-97e4-d65d2d083391", "comment": "Malware payload (RanzyLocker)", "value": "0db6f0721b23aba59852382dad8042be26832c7bb182d79f4734e17da3bcd5ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RanzyLocker", "colour": "#537C32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144549, "uuid": "b8ac66d7-bfcc-4d11-8276-7c9fc76e69a3", "comment": "Malware payload (RanzyLocker)", "value": "6681ac4c02f2b2696590eebad5f8e94cf1723678", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RanzyLocker", "colour": "#537C32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144549, "uuid": "abea28ab-0e24-442f-92da-cf0447a73c9c", "comment": "Malware payload (RanzyLocker)", "value": "59d10e0f20c5dea9cd75ca489a50db80f79316a243d0b2cfe484a579e1f67e8b9d5ade2477e235950619552b063d2754", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RanzyLocker", "colour": "#537C32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144549, "uuid": "e7ca34c4-c06b-4016-874a-3afbd5e5404e", "value": "T18ED37D5071C0C4B1E57A493185E8A6A3AA7DF9300F618F6B73E40B2E1F785D09A35DEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144549, "uuid": "8dcbb583-ac5d-468c-83ca-8573ec3c7cf5", "value": "65f731597048104980e8041a141b37d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144549, "uuid": "1ad3a14b-d06b-4761-8218-9348534b4680", "value": "3072:1ZO75plD368W/5SeiLHpV3IhzfW+3g70XdlqgDuYUB/vemeeCLEJLV:1C5px3HW/3iLHpV4hzu+jd7uYU5JegT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628144549, "uuid": "a073f37c-da12-43a7-815b-08f56d2410d5", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628144549, "uuid": "e6d8f9a8-3569-4866-a331-7009c1525a9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144549, "uuid": "71927b38-beb6-4d4c-b15f-fb4f5e189cdd", "value": "1009_deleteme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de169f04-f5af-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628142125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142125, "uuid": "c40cc4a6-da62-4371-bc46-6349cf6f24b4", "comment": "Malware payload (Formbook)", "value": "a92f2000f313179189819fa74c20064e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142125, "uuid": "d0ec8eae-5fb3-4a18-aef6-df616fe32d55", "comment": "Malware payload (Formbook)", "value": "0dc3ebc01a431373c4587f2222879eb61b2255c8355bee94e2e62e90483f17cb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142125, "uuid": "672b3b9b-ff79-4e3e-8817-3a64fd6db9c1", "comment": "Malware payload (Formbook)", "value": "2e6b0afcaa220decd4e1f6dc9ce94bba8a5dfa2d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142125, "uuid": "a18c0525-0a7a-431b-a6dc-9ef82024b6d9", "comment": "Malware payload (Formbook)", "value": "85573a37fc5bcbc11f64b1bfe6c4756de5ab65337d2d3acbc2b9ebae1d76367815cbd9227b8f1153bdee92468599d3eb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142125, "uuid": "6c90af5b-7dc3-445c-93ff-97a6be5d9408", "value": "T1E1056B2229EF114DF3B79BB60FC4F8BF46AAE673561AB0F638411B964322940CD51736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142125, "uuid": "e19e44d7-26fd-4106-ba54-c20009cb0fea", "value": "12288:fRjfqAqZzoR65AXwgFvuSSHI8+YPPDrdGh3vSFFkpF2it00W5yEv3wCd:uoR6qgT33636F8v0Rfvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628142125, "uuid": "2062055c-dad8-4ffa-a7f4-1ec547404a19", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628142125, "uuid": "83f8e07e-c346-4d42-9ab3-dfdc1f54c466", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142125, "uuid": "3e1e67cb-1546-46cb-935d-9eaca794ac08", "value": "Purchase Order 2070121 SN-WS.Pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07866ce5-f61d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628189010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628189010, "uuid": "b5ec3e62-bce6-4f4e-89c8-0a744b117a1e", "comment": "Malware payload (DanaBot)", "value": "7822715637930a3d172819306ac76fc2", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628189010, "uuid": "10f1e8d3-5058-4daf-9edd-10a47023558e", "comment": "Malware payload (DanaBot)", "value": "0ec6e0825a2fc0fad53014005501839b31dad92997612244a573b52decc70435", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628189010, "uuid": "72012b62-0a2f-4118-9288-0e38c998c15f", "comment": "Malware payload (DanaBot)", "value": "18d152ecbb3e09d2ba7408adfc63be1d7b1d2495", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628189010, "uuid": "9182007a-5dd8-4f04-863e-5fa12314b4a5", "comment": "Malware payload (DanaBot)", "value": "7ca40dbbc5f9e298dcb5c82a25c26d82f025601ebe50720f6200e02ac94163da3277791cdb3080ca8a6aed11672a5dbd", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628189010, "uuid": "0b245422-1792-493d-8f00-2514ae772d51", "value": "T1D93523203684CC32F6293AB4C811C7516B23FC66D9299A97BF86A75E1F312C1DEB534D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628189010, "uuid": "93ee7ead-0157-4a1c-9c20-8534899357f0", "value": "c36bba2f7ed1360c17671decb7b1e9d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628189010, "uuid": "4ab0a977-745c-4e04-8a85-0d8344c0fd0b", "value": "24576:4p2So7/OUM34T7Nhf4hG+94ji9qoCtXBACgxZyPKHBSNE46hlYL:QorOpovNhlY4jGChBACWoKHB/4WlYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628189010, "uuid": "29bf6eac-dbe0-43f6-8af1-389c9fdf9865", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628189010, "uuid": "1d8e3967-9579-4f7b-a66f-c23d8e4a365b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628189010, "uuid": "da032131-0d83-4e79-8833-87e11eb443e7", "value": "7822715637930a3d172819306ac76fc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59deb6fd-f5c9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Lucifer)", "timestamp": 1628153070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628153070, "uuid": "dca0e6ea-6ab3-4a49-b3d4-4dfa4609b380", "comment": "Malware payload (Lucifer)", "value": "f45354ef5a541af61c8ecd547603ddfe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628153070, "uuid": "bf90d7b5-5191-4227-a027-6807d932c2ce", "comment": "Malware payload (Lucifer)", "value": "0f419357649d1a57ba5e12792b289029a08b64767dc31e26c8aecf97cd03e0db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628153070, "uuid": "52a0da47-cb85-4172-9e3b-1fa5e3dc019e", "comment": "Malware payload (Lucifer)", "value": "8b261eed77787fa7202a2f599cab77b2baa81065", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628153070, "uuid": "38809e12-38f9-480b-8170-0066583dc447", "comment": "Malware payload (Lucifer)", "value": "9180ac732ce59b979ba2e7399e220b79cc873b61ab071a7dfdc1165f756ffeaa5fe6ca984b9d3c6c45d519c547d02feb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628153070, "uuid": "63ed9a17-971c-4697-9ecc-c67eda425dc8", "value": "T148D3320976A62DC3E13A5AF830511279CBF83B6E76ADD1F80DCB6AC615E1FC05B90907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628153070, "uuid": "bb330246-6110-4ce6-9e0d-b89cd83a11ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628153070, "uuid": "2d736001-07a6-43c4-a5e5-eee05a123235", "value": "3072:lzMMYFtohN6fIRVFyHn676c8hNfdZeZSNYTi:lQvLC7yHnbcYQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628153070, "uuid": "e459a856-da3b-44e6-8c9d-ab551fb2c60d", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628153070, "uuid": "ee9d1d32-f945-4322-a439-e83354e1c1e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628153070, "uuid": "1abcd050-f437-4732-8169-fb59f7e06123", "value": "f45354ef5a541af61c8ecd547603ddfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1044a298-f619-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628187307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187307, "uuid": "0912d4a7-fbea-4a99-8748-045377ed7f2b", "comment": "Malware payload", "value": "5bf77baccb5d82b6e513cf07036f57e0", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187307, "uuid": "8ab95383-cd50-4465-97ff-8516592d0a9a", "comment": "Malware payload", "value": "0f4df6e8615de2604c5baf27d0edac53ddbee97e081648ede2c3b41b7515511e", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187307, "uuid": "9616b025-e81d-4687-ab68-f87c09313737", "comment": "Malware payload", "value": "3ba449f94cfe19f3a92eff4e80ce24f3554cd420", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187307, "uuid": "2ec3fad4-6c90-4555-a744-5e0157b98e97", "comment": "Malware payload", "value": "00c5e2d7c895bea2a98b5e4aab444b1d2ee1718695b0f5dc54e0d7fd20c0d3a69600ae4bce3d898b97634201602113ef", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187307, "uuid": "d0747083-048c-4101-8939-7c041f99018c", "value": "T15C621918EFE98336D5ED0AB10C73A60407B9D2039D26EF2B1DCCA55B6F53B820B51791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187307, "uuid": "51f2ffee-48c0-4f54-90f8-02503d0f7f3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187307, "uuid": "ffc16ce3-f70e-44a0-b2fa-27b460bdac61", "value": "384:JMHGywcoVnN2tC5fbC9o/AaTwe4b/rOTS:qPgVnmKbTCe4b/Cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187307, "uuid": "95b234b3-72ad-4ab3-8a3e-0714f266b98c", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187307, "uuid": "91949fa6-0902-46af-ae4c-9dc611aba601", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187307, "uuid": "d3dbd91e-5ec6-40a2-8ab2-a35a99cea405", "value": "0f4df6e8615de2604c5baf27d0edac53ddbee97e081648ede2c3b41b7515511e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624d0a43-f5c5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628151367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151367, "uuid": "372c0182-0def-4a76-aee2-105c1b7b787a", "comment": "Malware payload (RaccoonStealer)", "value": "8211949786137560be90cbc71a7720b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151367, "uuid": "140d78ca-4325-4a47-bebb-a389e8db1b29", "comment": "Malware payload (RaccoonStealer)", "value": "0fb7ffc5ccc6a4250153508f8af38b9f70aa06516164c441aa2ef81cf1289cd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151367, "uuid": "ddfd9121-ed39-4c56-b3d3-ca2470bb767b", "comment": "Malware payload (RaccoonStealer)", "value": "48ad5da16021524149c6fcc22c2b81d7c605da52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151367, "uuid": "7a73376f-7912-4d92-b51b-9df4f5fe234e", "comment": "Malware payload (RaccoonStealer)", "value": "7a1f066cb3c2420af861e596fc4413495076cf2cd04838e06909d670908401231473711ff267cac542eaf83a3584173d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151367, "uuid": "60e4fa58-5d1e-4b2a-8f75-c86cd4ee790e", "value": "T1DAB402113681CE73F1616671C835CAA4AB5DFCF05D65868B3BB0668E2FE61D29E37302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151367, "uuid": "11a0f4da-75be-4fb5-ae85-607e538fb761", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151367, "uuid": "75598a91-ca7e-41fc-9486-0e4d39a351f0", "value": "6144:m845EYNdTlcoBhCU4AT/2lC7gt/Jv0VV/TYvn8WNRolclHGOAx:WyoBhCU4NlCUt/t0b/TYvn8EH3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628151367, "uuid": "7df460f2-3181-4b6c-bc1a-10da2e3f3b8a", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628151367, "uuid": "e1b47a04-ac5d-4fdd-9da2-f0d1f9acd9fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151367, "uuid": "45d25ee5-f8b0-4f87-9a4d-daa99da7ab6d", "value": "8211949786137560be90cbc71a7720b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8daef9-f5f1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628170309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170309, "uuid": "80b61722-271f-4bdc-baee-1622aed2491c", "comment": "Malware payload (AgentTesla)", "value": "a81ddfebbb6626f0c6eb6e07fbc99f7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170309, "uuid": "45ecdb3c-0361-46a5-b954-a17742659835", "comment": "Malware payload (AgentTesla)", "value": "104f4f62e38ec1d0ab06d2f0cb1e092a448bdb5f0c3e14c03eb8f64fc2307ece", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170309, "uuid": "013df416-50cb-4e79-ab02-8534187a0c99", "comment": "Malware payload (AgentTesla)", "value": "9f161dc7ef5e5e786d283d13822df01817665f4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170309, "uuid": "98a5ef2c-2b89-4771-9477-18226781619a", "comment": "Malware payload (AgentTesla)", "value": "df87486c6333c5b9fd40f3e757373b696504fddb312f7d4491b8c4b151e0d6d55f6708413568bd2b3007337b23562018", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170309, "uuid": "e1f8bd1a-d25e-4f56-94fd-6e3ecba5aea8", "value": "T11B5512A97EA867A1D2CF3C7404C58A3B4CEBDC9356E8B4052587BA61B13CF76D78046C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170309, "uuid": "e6ea2d85-bb41-4d8a-9394-9b7b18fb04cf", "value": "24576:+xrAHI9ArInvRsb4HTMgIaxXWgaXTTO2YeUH+VWWcDtRW:o0HIgCO8PJ2O9H0yK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628170309, "uuid": "226fa897-b38e-4bb8-8e5a-389b3af03f7e", "value": 1283584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628170309, "uuid": "db41abe4-0105-442f-a208-b777551867b9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170309, "uuid": "27f35180-1577-43e3-abf5-4054a9aaa588", "value": "Doc_98864567.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a44356-f62e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628196367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196367, "uuid": "14ac918e-21da-482d-8cf2-1c02f02563bb", "comment": "Malware payload (RemcosRAT)", "value": "c54342185881953b5e36fe05f977cc00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196367, "uuid": "a9c12857-1057-4c52-be9c-f029fd66a5b8", "comment": "Malware payload (RemcosRAT)", "value": "109a5ffb53cd3311e68c5a28f84fd1d7eb668de3db43a35c344f83785187f915", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196367, "uuid": "cc1ab37b-a1a6-4ea7-8ebd-79d764657e35", "comment": "Malware payload (RemcosRAT)", "value": "e2185b97ad8f467c51470da67ac09e07dab8fe60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196367, "uuid": "39d76e25-f9ad-4ddc-ae2a-36d6709fc104", "comment": "Malware payload (RemcosRAT)", "value": "237862934d2e7dc936530613f922d0c6f8f41f9ff9605dbe79811241041fdc1cfa7d9517906f6b895f257eeb6a6575c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628196367, "uuid": "88aa909f-f1f4-45d1-a00d-cf8e83563c2f", "value": "T13E158C2229EB154DF3B79BB60FC4F8BE56EBE573570AB0B638910B464322940CD61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628196367, "uuid": "94076a1b-ede2-4056-b1e7-e2ceacae69bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628196367, "uuid": "78e6fcbe-486d-421a-b035-0c062c0043e1", "value": "12288:8HLoR65AXwgFvuSS3sGs6+XqIXq9MZj9Iba0vWtgA7K+zqrkb1NnSzv:8roR6qgEvaiZBEacBuoe1NnMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628196367, "uuid": "821f8f8a-489a-4018-aa19-33062ad44e6a", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628196367, "uuid": "ff90016a-cd2c-4796-83ad-37bce7ffa206", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628196367, "uuid": "4e13e67a-c905-48e5-bd2b-95b4b673407e", "value": "c54342185881953b5e36fe05f977cc00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1e38f6-f60d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628182330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628182330, "uuid": "6390651a-e594-4f94-9f19-16b2da8460f1", "comment": "Malware payload (SnakeKeylogger)", "value": "e3edc417be072edc95357b41c5901d75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628182330, "uuid": "88479ede-3a7a-4c18-938f-e0fba41073ad", "comment": "Malware payload (SnakeKeylogger)", "value": "11ec5629d8faba1d833f479be2741e05dbf9cf4e391a651afef4ed3b4f9b8cc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628182330, "uuid": "95d6bef6-f7aa-4225-b606-27101cfe3df7", "comment": "Malware payload (SnakeKeylogger)", "value": "ac9319644fb88e04255497f0462f18ccd391b709", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628182330, "uuid": "ec852912-1c46-4798-a3eb-4baf3548d2a2", "comment": "Malware payload (SnakeKeylogger)", "value": "2580bebe25e56c18adb0ce7964a68d6f0b82e0390a309c3b1cc723d5e4b14dbcdfa6499f68f0bd11264bc4fd22fbbc1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628182330, "uuid": "59787c78-a362-48ff-bea6-c3eddaa7c35a", "value": "T1DFF46B2229EF158DF3B3AB750FC4F8BE56EAE573571AB0B638910B464322940CD61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628182330, "uuid": "5f2da4b6-34a2-4b08-a72d-1ffa29136d91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628182330, "uuid": "30d86ac1-0790-4884-8ba9-73306fe4e49f", "value": "24576:JoR6qg27BkyL7lERH7m6WyySyCB0CzU11:Wsq7BkyL767wyRyCB0/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628182330, "uuid": "87696131-7bfc-49eb-b52b-dde9e8c98f45", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628182330, "uuid": "be948e2c-5c32-4656-bb50-1cb89de17ad4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628182330, "uuid": "68ad8926-ed85-4238-9441-d58c35b89269", "value": "lLwIMX6OKZZo7VL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43418d1-f603-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628178240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178240, "uuid": "1e69c5b0-53a4-4ddf-aa2e-583aed31341c", "comment": "Malware payload (Mirai)", "value": "200aa74906a7bb5a3d3dccdfe93e51d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178240, "uuid": "024f764b-f731-4976-ac4f-8f8cd409f810", "comment": "Malware payload (Mirai)", "value": "121d9f838fe49ae41aad357173701e01d81fe5cee2c13793220fbafc788374c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178240, "uuid": "bbb0d2b4-71a1-4581-9d87-35bc5369e35d", "comment": "Malware payload (Mirai)", "value": "c69285b4c86b63f0036c7f5339dc8802bdbb2818", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178240, "uuid": "467dfb42-a4f3-4687-8738-120d4992b1e6", "comment": "Malware payload (Mirai)", "value": "c90756bfe81795493f4378f5d964f93a698ffdee77639c0dfc4ada7bdb52c5d1b0d2cba6dc892c7a0db42226681b26c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178240, "uuid": "b73875c4-9dda-429d-bf34-2a09bee6696b", "value": "T10E03E0AEE14C364AC6E95A7B64C862DA0E44F6F4379F5F8E73709C80A7440E53487374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178240, "uuid": "677dedaf-6060-45ee-b53d-4b78acf27073", "value": "768:UZc8OnDirGSTfBDY26TySXgXiEmB6gLQw7zo+15bLWS:TMG+BY2VBOLQwHbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628178240, "uuid": "accd9546-3f30-4d4f-8f0b-f76702a0cdd3", "value": 37988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628178240, "uuid": "a3500438-540d-420a-8a8d-ead1c1d0589d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178240, "uuid": "6e823aa2-5303-4cb5-b9b2-29473da768c0", "value": "200aa74906a7bb5a3d3dccdfe93e51d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5c227c-f5f5-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628171974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171974, "uuid": "393816eb-043c-43cb-8467-52c6cc5d1dca", "comment": "Malware payload", "value": "7f5b73f875f7eb6444f724e8c5ebcb04", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171974, "uuid": "dd574679-efae-46ac-a6be-72327fa1a212", "comment": "Malware payload", "value": "135436cf2735f3fb5642711e7077e2642d4ce8d17aa1c7bbefaf44c938961db6", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171974, "uuid": "ce28a95c-8e6f-4b02-88d8-255379ade81b", "comment": "Malware payload", "value": "70c183f3ee12c220d39d64ec5b77ad65b05e93c4", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171974, "uuid": "6b157b10-1e26-40a4-86aa-b10ca4d6245d", "comment": "Malware payload", "value": "9323aebb4df8e8818ccc3bd0dbfc28f268e39522527b160cbcc117813a8683faa8177fe7a20c9f16237e20f3a8fd3654", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171974, "uuid": "787d27c5-29d5-4197-bb48-bee6f7c9a892", "value": "T1F9E1F07DAB6A9ED893A2B8D8045D374F01D9CB174B589C69ADC80A73C03867F5FB901C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171974, "uuid": "74ab495c-e635-46bd-9e02-3c82d84558c8", "value": "96:Sq0d/+6/WXE+sUaEZBPB/IhCmaOgcHn7r+UBmbg3mdrmY:SB/D/NXUaoO+UBmbg3g5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628171974, "uuid": "fca5ea88-9385-4f8a-b891-a11208a74b2f", "value": 7305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628171974, "uuid": "acf00fc2-f8aa-4bd0-bc04-61d9ed4669fb", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171974, "uuid": "ae1ffeb0-c1aa-45da-a4e9-751ff9bab098", "value": "pdf_document_s233322.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebcfb8ea-f60a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628181233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181233, "uuid": "8c8a5aea-c19a-4b6b-b546-5038e39c3060", "comment": "Malware payload (Dridex)", "value": "a57984da725cc46a410982f5daf7d0a8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181233, "uuid": "1f9fbdb1-3dc7-4cd4-929b-ee77565c7357", "comment": "Malware payload (Dridex)", "value": "13fd29a172f41f378104be3d3b704afcce734cb8c1a5f578ce0db00de43613cc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181233, "uuid": "73d872f7-9795-4d19-a156-4e73a970de6b", "comment": "Malware payload (Dridex)", "value": "1e04b31dab9259e9626661c027da72f7cf82d66a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181233, "uuid": "12d0f756-8294-404a-b940-dec444eb75f6", "comment": "Malware payload (Dridex)", "value": "bea11f0b20b93e1270dea7e0dc2ba357c94a9c7c9b195050e4ce86bec7c51d7d9d6f72822d1aa6c996e84bcd5893c389", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181233, "uuid": "057f3eb2-9de1-4152-8eb4-483e5420e521", "value": "T1BA04D042E3CE23D1DC97B43248FC262924F05444D85ADCFEC995EBACD7E1F574A64A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181233, "uuid": "20add04c-9d62-4a99-9376-af2a33c4989c", "value": "6eb7ecc6c2e948f718b1179f888ea193", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181233, "uuid": "27c03142-63c6-4322-a624-843864edfdf3", "value": "3072:pcYhzpn9z75jWpmrL3gA99hXkKsorn+AOr4RjjvaT:pcIntom33RDvn+Rror", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628181233, "uuid": "29de57a0-0982-40e4-a1aa-a5d111236285", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628181233, "uuid": "442ba4f3-2f0b-4d9b-ba19-636f2ae63a08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181233, "uuid": "bb504ce2-a8d2-4982-810e-46aa0e14ff55", "value": "EsvYQN5GJn6rK1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3609af1-f5c8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628152818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628152818, "uuid": "3306ac62-450c-4f7f-8350-f429b5453c5d", "comment": "Malware payload (RedLineStealer)", "value": "d7ee260636251b156b7d677da928c0a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628152818, "uuid": "af4c8bb8-6d21-46f5-aaac-b985290cf1c6", "comment": "Malware payload (RedLineStealer)", "value": "15eb4fea982c823ac9580f4e61ac4b0c0c49d72444cc570b395c3033cfa40b55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628152818, "uuid": "ec65ae95-7be7-44d0-a508-a9a53ec9b13d", "comment": "Malware payload (RedLineStealer)", "value": "f8505b62f25edd238b5a80c429e9752dc1990e72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628152818, "uuid": "f635fe54-6685-49c3-b1b5-18641f530dab", "comment": "Malware payload (RedLineStealer)", "value": "3bb76155f6b57b3a3246f6e54c7fabfe4be0beb77ab18a5b1cc442a80efdc516a0ca2528d0ffd2fd0d0a6f1daf5202f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628152818, "uuid": "1426753d-cbd5-4a3a-be5a-a5e446e4122b", "value": "T171838C403118DCABCA3C07F601A29580A77B656710B5F7CC1FD962CE5DDAF86ABA1363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628152818, "uuid": "b670be90-d93c-4e25-8871-9a457f5a2a9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628152818, "uuid": "b68ba3f7-f2fc-4306-aa24-09241cd34ea8", "value": "1536:wbsLOngqqM3eJG53G73mxdvdx840c9MtFan4/bPN0mTUI0n:nHzM32GhNvL840c9Vn4/bPN0mTUI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628152818, "uuid": "65aeb388-5a30-475f-90be-f67a9312f5cd", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628152818, "uuid": "463f6a7a-c515-4c99-bead-90f167d547f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628152818, "uuid": "c4b6711d-6e56-4d7b-95fb-ca89495ceb42", "value": "d7ee260636251b156b7d677da928c0a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d10e4a-f5e3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628164256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628164256, "uuid": "1c9aec26-2ed0-460a-a0f3-6664cc10e64d", "comment": "Malware payload (Loki)", "value": "5448f1b0f4d4c63e7bce17e82fc2247d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628164256, "uuid": "f87659fa-bdad-433e-8711-2982f0e49b0a", "comment": "Malware payload (Loki)", "value": "167b81f2c8ddc9893a0211f8585b86c8cd2b6934255033fb4e480885f7f993a0", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628164256, "uuid": "3f7bd991-b0c7-4c30-bba4-c34b48c203fa", "comment": "Malware payload (Loki)", "value": "7fc2271736c0794fe2b0fb7e81b1f51a88d94405", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628164256, "uuid": "331ca87d-09ad-4c22-a792-0f643f01e09b", "comment": "Malware payload (Loki)", "value": "488b1bc30ebb4088d44f7bdb9cbe71ee1ae69de4eae59ad7cfaef3185ec8e2d37901c073e020c01e2e071476f0721350", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628164256, "uuid": "1c6e3133-9a23-47b5-8714-eb19427a15e1", "value": "T1E4F4331B82E7DDCCC996A79EA75C31B6731476615CF00C1B2B9198BF85B08C822DD35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628164256, "uuid": "8267677f-f4bd-4f25-90eb-6f02bb2c5b08", "value": "12288:1Gr7X0i8649Fb6CRe2e6h2XLRjfMHp5iJxqU1rVh9gE/HajHUtpj27V0YRlZ87Vx:1Gr7kiEJepi2XLRjwLiJxqggE/H8HUtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628164256, "uuid": "8ebcb7e4-45ea-4502-9b4c-ef936736b92a", "value": 733851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628164256, "uuid": "d8dea1cb-e8b7-4a10-a225-418567434b58", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628164256, "uuid": "bab0697e-3677-40ad-a6fe-fe24078b85a6", "value": "Purchase Order dt. 050821.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7f3745-f5d4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628157670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628157670, "uuid": "b47f03cb-8e39-4783-86ae-d383873aadc4", "comment": "Malware payload (NanoCore)", "value": "a443968b762bd748f76a77e10315726b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628157670, "uuid": "a247f897-1e56-4497-ad99-43e651e3e957", "comment": "Malware payload (NanoCore)", "value": "173acecbcd8426c799d1e7229bab6eec9394002e8555fa72bb2e8811c10c6c2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628157670, "uuid": "14ee64fa-71bc-47c7-9c18-53ea2e534980", "comment": "Malware payload (NanoCore)", "value": "4ad0ca35aaf3b91057f069a9906bf0efaf57be9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628157670, "uuid": "9b095b5e-e729-46f9-822e-344b9b290eeb", "comment": "Malware payload (NanoCore)", "value": "f23576a01afe841f9091f1c1a837f51c020b5779b415c09f07d3178f58cc4bd4563864f6b2620e90eadd3f0c86a21faa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628157670, "uuid": "b38bf398-8936-4502-a208-d36c46adcc83", "value": "T18EB4F011B5D0D032D83A0B3149B2D8348639FC29BD74869F7759726E2FB22D1292FE5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628157670, "uuid": "434eda78-2d9c-4cbc-a5e9-9ef9cb5234c7", "value": "ea8de473df0698dc330fdb95b5eda1f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628157670, "uuid": "02df1ba2-a399-4d87-aee2-faf3b5a154a6", "value": "6144:EPH+MbiH2r0uaV6+X5RvoIQ/MZYDEV4eMRWZp0JCj8EpSCEUUXLfiR/RpLKK:E/+MbiW+J5oIQ/LEV41RWjbD5UXDgQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628157670, "uuid": "d484e32b-192d-414a-a4f1-bd153a8ea837", "value": 531535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628157670, "uuid": "1f87c836-88ba-4c09-bcf4-5941048abc0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628157670, "uuid": "c2600fea-6188-4e16-8904-959df279fb26", "value": "SecuriteInfo.com.W32.AIDetect.malware2.28027.18256", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b45e799-f5ad-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628141047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141047, "uuid": "a5ef5e91-abf8-4e53-b0dc-fcad47e89073", "comment": "Malware payload (AgentTesla)", "value": "f2041a9ab4cb5317a7a563b711463a94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141047, "uuid": "ba4f77ee-2df8-4d6b-ae1d-673b1f3e3ba6", "comment": "Malware payload (AgentTesla)", "value": "17b5d1c0ba36bc24ac297279e0388d57b8bf5e5cbdbf408e7592627af8f0bf6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141047, "uuid": "05eec3f0-d24f-4920-a652-4d294c5151f5", "comment": "Malware payload (AgentTesla)", "value": "d557c11f48154169120ae8bade0d7f098b4649ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141047, "uuid": "876d2735-658b-4def-8fdd-6d80f84092ad", "comment": "Malware payload (AgentTesla)", "value": "b289613d3d24ba37397644ab7c297be67fb829727024a47527be00941b04c94aad59dc63d0d260e60c28d7c10b1e71b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141047, "uuid": "eb2b902e-e2be-440c-8bb2-2156690d74ec", "value": "T1C6D4239E7E8F498CD87EC4E81BA84D42FB276769621F5E00A0A7CE274F391FC615C581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141047, "uuid": "d0005cd8-388b-4e1b-a9a3-2248b85eb7b6", "value": "12288:Pk+EyvndHN1XgOM1f4g9UphvT1JvOUZXBE9o23JQJljVCua2cOd:c7yfdHN1cgg9UfpxOUMa2ZQ/jVM2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628141047, "uuid": "7bd8c1b4-c620-4da4-8272-4ab5cbe51254", "value": 633405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628141047, "uuid": "fd3ff0ff-1745-4996-a8ce-aac4ecaf42a7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141047, "uuid": "ce9cf88a-ca18-444f-aef4-d7794a3a41be", "value": "21.08.0260.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54b54cf-f5ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628146862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146862, "uuid": "4603d1d2-4671-4cdb-b67c-444fa2be2629", "comment": "Malware payload (RedLineStealer)", "value": "a2b9c670d16437073eb791a641aa4bae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146862, "uuid": "414d02f7-1047-4134-8738-182a59705941", "comment": "Malware payload (RedLineStealer)", "value": "17dfa2e1768aa1ef822527eec763f22090807a4aa4a674e8924090e7bc37bbef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146862, "uuid": "4a741eb3-afec-4bdc-928d-ea5837e41daa", "comment": "Malware payload (RedLineStealer)", "value": "43ceeb24af9507a106b5b246a511c80b2451a3ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146862, "uuid": "c83de921-1fb7-4ecb-942a-d2911ce72496", "comment": "Malware payload (RedLineStealer)", "value": "d4ba2970e8254147b9ade38b15ef5619c60c8dc35fa189df748732237c768a67ce7690b1a5f2488281891199fb2a771e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146862, "uuid": "4e323ec5-239d-410b-8a05-f63617fc19f6", "value": "T11745026E32948E02D59C1871C1D7D53453B2EC937631C2A63AB6B3AD4F722A8CD563CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146862, "uuid": "a5b663c1-2b3b-4ee3-bd3d-27dda3d8d004", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146862, "uuid": "31ae0341-837f-4938-9c79-d63b28fd1ad9", "value": "24576:3N63RwGa1GGCROxmitDkJhZg7umffxIxOlKZh:3s3SGaBFLtDkbZg7hxCOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628146862, "uuid": "dfcda2e6-c5bb-47e9-9d75-a89fbebaf250", "value": 1229568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628146862, "uuid": "38f01660-5042-4ac1-84fa-4a1d20f41d1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146862, "uuid": "c7d8db22-186a-4f14-a8c6-39958dce9fd4", "value": "a2b9c670d16437073eb791a641aa4bae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0a8512-f5c9-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628153077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628153077, "uuid": "b25300fe-70b8-46d3-8b46-4ed1a6d7f773", "comment": "Malware payload", "value": "ff6c93df678d66495a9c261ef925219a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628153077, "uuid": "79f8035c-3187-41f7-985c-1d6bf661ec23", "comment": "Malware payload", "value": "1888a3e862aaa34a04db995d2f1ef6f71af9442ca54511e0d7c8dd18f1a11a02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628153077, "uuid": "ce62f6f5-86c3-4d08-86b4-64470f41fc84", "comment": "Malware payload", "value": "14b00033d71b5d6a93b82b987038e76f43604e12", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628153077, "uuid": "0cf8557b-ecf2-4f32-aaf6-71c63a396d72", "comment": "Malware payload", "value": "7e08945eb69884025bc8c97af7d8fb9e6a4c601ab57aad38b2aca405820db2e0eef6b03e19aae86741b05823d19ca1d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628153077, "uuid": "0809c19c-859e-4b53-9d1b-ee36eda0875f", "value": "T1B783B7367AEA556BF272EE7187F0760B9D2AF6733402D54E1446038A4913F82EED163C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628153077, "uuid": "430fbde4-5982-4ca6-a58e-b2d4f3fdfa8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628153077, "uuid": "cd61c9b9-8233-4868-88a1-a8b2a870ac8b", "value": "1536:c+0WoUDKnWQJ47ZeegioBCIVCS68yl/LDlcB3VSdDU:c+0WoUuW20ZeerzIISSl/LpA3VKDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628153077, "uuid": "f819abf5-23ad-452b-817c-9650f399adfe", "value": 85504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628153077, "uuid": "b1be3558-04f3-4ba2-ab8a-e5776a5cb78e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628153077, "uuid": "f3090ff6-96a5-495b-b8e8-89305f74a38f", "value": "ff6c93df678d66495a9c261ef925219a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e142be56-f5bf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628149003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149003, "uuid": "2d1c3cb8-23fb-43b2-9190-040ff63c641e", "comment": "Malware payload (Loki)", "value": "27c33e96be7c7e1d76077e391bd6836a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149003, "uuid": "28807959-3056-4ecb-b76e-71902f8fe6f7", "comment": "Malware payload (Loki)", "value": "1935d61544f21904debb294ef949593b886ab06b97bb2a3f4f850bd2406a28d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149003, "uuid": "3f44d195-212e-403b-9b48-0bed6f65f893", "comment": "Malware payload (Loki)", "value": "2ed5757b3a8bc2d53f903b2c33d284effc08b008", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149003, "uuid": "cb7e445b-14cd-413f-b8ee-5b66f44be671", "comment": "Malware payload (Loki)", "value": "5f50ed39549163b0efecfa61a6657ba3de6def3143d632253be81a7359bdbee1ae46046cb34be73c865f8f105b00ec7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149003, "uuid": "65f39971-8eea-4ff3-aed5-3cfb2b49f28b", "value": "T13B14BE123AD1C477E52306B148ACCAF57E663C750E35AE8B3BC552ED0F77292AE25306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149003, "uuid": "7231547b-280c-4da9-9ff8-b679203b5528", "value": "2a9c1ca66125aeff7a1c36242be63d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149003, "uuid": "40b5f975-7d2e-4d66-b3ff-1727380d24e5", "value": "3072:PTNg5UQjLWTG3OcpROtsd+4Nqc2ZtlB3F+opyBjwPbm55H5kzTpK:5gvLWTG3dRq+/GtlBV+0PeZkzT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628149003, "uuid": "3d6737d0-fe56-4ed0-9240-f47c9e53fb4b", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628149003, "uuid": "0ee4b113-70dc-4f5b-af4b-83d3e749ff9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149003, "uuid": "c863aa58-043f-40cd-9846-30b1856813e4", "value": "27c33e96be7c7e1d76077e391bd6836a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f24f15d-f5fa-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628174205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174205, "uuid": "0ac88d0c-c182-480a-9302-73dc8ecd6078", "comment": "Malware payload (NanoCore)", "value": "6f303f1191e2365b8ae45db510eae28c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174205, "uuid": "8fc45e44-a46b-4836-b18f-4db09292f99c", "comment": "Malware payload (NanoCore)", "value": "195929923f5068d260150448a6014f34906033d64dc6d463015a1cb430bca604", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174205, "uuid": "e37bacbf-d0f1-49a7-8270-27b2fb8361e0", "comment": "Malware payload (NanoCore)", "value": "18d87e14f29a19e1f7abaab8d2eaaf208602abf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174205, "uuid": "817bd9c7-cb5e-4d72-87d2-722bef45f0ac", "comment": "Malware payload (NanoCore)", "value": "2eb9b67161c893756c35b1b6a9148b297b2e91450298c758c4ef1a93ff2ecaabf8cefae52a8ba3c9f2220cc623604d92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174205, "uuid": "9bcba4c1-9bc3-45d8-9bf7-6ceda58653dc", "value": "T1EF157C2229EF145DF3B39B760FC4F8BF5AEAE577570AB0B638910B8683229408D51735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174205, "uuid": "0366b32f-a28f-4aa7-98ba-ea31f923d514", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174205, "uuid": "6fc9128f-c286-42fa-ac2d-636c7e6c909f", "value": "12288:aEKGoR65AXwgFvuSSCDXvOwtna8g/SVw95Rilw/sr82j/A0W4CUcpJD0YHN39:aooR6qgTw0K65ilwc80I9XLD/HN39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628174205, "uuid": "f598c068-77f5-43d8-8b72-44476f377aac", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628174205, "uuid": "524285e3-da68-4fe3-be16-4ad925f7ba10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174205, "uuid": "fbee09b1-040b-46dd-bf21-431f66e0138b", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bab65a3-f613-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628184964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628184964, "uuid": "8241d444-fad7-4670-a85c-882a43d705f5", "comment": "Malware payload (RaccoonStealer)", "value": "154230bd25c3a3c50c8aff4613b37312", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628184964, "uuid": "3d6cb9e2-bf6e-41eb-b761-23a3fa5b0eca", "comment": "Malware payload (RaccoonStealer)", "value": "19c61914925e59e3bab08f3fa457de8064bab1e48b61d15af350734a3abcfc69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628184964, "uuid": "94f55755-026e-4088-9da5-224ded9cae16", "comment": "Malware payload (RaccoonStealer)", "value": "ee03e9a4aeb333acc7b28592154addde7a1a50d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628184964, "uuid": "08bdd4d8-1fd6-4838-a1ef-295289bfadba", "comment": "Malware payload (RaccoonStealer)", "value": "932c9b6f5b6d96a94ef18491d3a506cfe7a5183382b7b53bb8b9f942115577ff4c8f65060870633c3fda559f69d8cdba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628184964, "uuid": "fa4cad36-6e63-4640-8528-203fc88d73b5", "value": "T1CAB401213541CC7AF1607BB08866C6A22E67FC74DD269A4BBB91938E3F312D66F74305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628184964, "uuid": "66d4bb11-ef9c-4c74-aa3b-1f7192362b61", "value": "c36bba2f7ed1360c17671decb7b1e9d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628184964, "uuid": "1ebd5d81-a906-459a-99e5-7d484e170f51", "value": "12288:OZHgGUHkgemk8DbsW7ksfsJeHdJ/cqfO3WnWPxBYL:OZARzO0yR4cqfO3WneHYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628184964, "uuid": "22857e56-692d-4bd0-88d6-097939eca924", "value": 510464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628184964, "uuid": "57faea2e-a1db-44d8-9d16-9882e23038e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628184964, "uuid": "da56fc48-a183-4639-aafe-054da419d623", "value": "154230bd25c3a3c50c8aff4613b37312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0070b6b7-f643-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628205319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628205319, "uuid": "a5e13bf2-ec53-4b8f-9a02-120d8d68bc0f", "comment": "Malware payload (NanoCore)", "value": "a5b7a2266d4da6fd22e5d719a2abf9ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628205319, "uuid": "00d334f4-8f10-4f5a-a9f4-6a0df1ac8065", "comment": "Malware payload (NanoCore)", "value": "1acdc78e037fc8506cc2fb9b9031c33cd23d33a3feffff24d24d80157d488206", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628205319, "uuid": "166ee303-5130-46f8-bb2b-a6489f6d7dd3", "comment": "Malware payload (NanoCore)", "value": "495c8ce78078160a83491e5add68c53985b961e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628205319, "uuid": "28d80e22-f912-4bc1-8aee-312cb8e9a6d9", "comment": "Malware payload (NanoCore)", "value": "92b91362ad9fce8b0364241d608a2008b71ea23a17bcf5ac652aef21949485559996ca6d5041b66f68314331e6fc6c1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628205319, "uuid": "50022b31-dda5-42ef-9b11-ae050fc124ea", "value": "T13115F0127690DD45C3BA6736CDDF80084BF8B9023663CF5BB89E33998A523B359069CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628205319, "uuid": "ad65732d-3638-4cd4-b65b-dcdac75f0fb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628205319, "uuid": "e06f1a5f-19f4-45e8-8ea0-772c1b188983", "value": "12288:XAMtUFWxJFsjMF5KhfD/jGjNuBMyB4aZrGxQWxvzWhSk/3dN6t2NjF5:XAzMnefTmv+Z6OWBzkNN6MNjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628205319, "uuid": "11a58d34-dbc0-4d88-a755-0854a6e4540d", "value": 931840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628205319, "uuid": "68b875e9-4ef2-46a4-a6c4-4f2511551a7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628205319, "uuid": "7d323145-342a-44ca-bdc8-f509612e5e6d", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf93b55-f619-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1628187355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187355, "uuid": "11de8e96-ed53-427f-be15-d18a18f85307", "comment": "Malware payload (njrat)", "value": "7fc510a92848ec9ffc92cdaff897de0c", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187355, "uuid": "d50cddf8-4c46-4d22-9274-9da7262a307c", "comment": "Malware payload (njrat)", "value": "1afb690159f041ce4f0af3618ebd1cef4597d3d94bd249c4644b8e359f46199d", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187355, "uuid": "67566873-06ae-4741-93a0-18baa335fd1a", "comment": "Malware payload (njrat)", "value": "9aa0ac66bd849643a64682de6247acb129e51b01", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187355, "uuid": "85f3ce8f-c1af-4004-b939-9a34cd27d61b", "comment": "Malware payload (njrat)", "value": "a40df318c6a0c503362cc179b2d603eff26eafd75addd463427d4aa9eb7cec45fae334412a5cdf0083a9174075cea12f", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187355, "uuid": "99653f8a-5c00-45cd-927a-e917915662f9", "value": "T193B52300FAD588B2E2B31C325A696755267D7E311F34DE9E13C83F6D9830190AAB5B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187355, "uuid": "5616070f-f291-452a-a6fd-b85d7e3b529c", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187355, "uuid": "64d14d7d-fb58-4065-b9ba-4073bf5d1a66", "value": "49152:55jTJc8kbMDNU4ZCj05XMjHo5Hna0rJq2R:55vJBkbCmX0wHoRaOHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187355, "uuid": "036c5061-38ec-4beb-acaa-d22e69189427", "value": 2323655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187355, "uuid": "6e0e2c75-72df-4bb2-ad44-e9b5f7a3262a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187355, "uuid": "b9dbeffe-6b49-451c-b7a1-96211407319a", "value": "1afb690159f041ce4f0af3618ebd1cef4597d3d94bd249c4644b8e359f46199d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2699c4d9-f5dc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628161145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161145, "uuid": "7904426b-6804-4cc7-9dd9-d3f583fad40e", "comment": "Malware payload (Formbook)", "value": "b98efeee0211863273f50d8029b0f19b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161145, "uuid": "0e207237-4867-475d-aff9-12a07f287419", "comment": "Malware payload (Formbook)", "value": "1bc91158db7c9edb77fa2d26fda6efd017b8aa70c3bc68d5542059e3f44b9e77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161145, "uuid": "6b9cad7c-ddf2-4789-9e3f-c268aab1e52c", "comment": "Malware payload (Formbook)", "value": "83014340b653b3697a7f026a10f181e7412ab2c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161145, "uuid": "5c1f7909-3534-41d5-9c98-707725419c52", "comment": "Malware payload (Formbook)", "value": "600960d890fd5d447b455bbc12ced29f3120cbcc74358e2fd9a218a91e42b766baa78d2bff2af17a858711000da41961", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161145, "uuid": "aaf9bb7d-b800-49b5-b35c-cd094fdb8ef5", "value": "T1FAF4E0358A591EDFC178A47A60052A1429F7C1BBB7F2F7063DE02CEA24D63D44BB960D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161145, "uuid": "c090055b-6719-4462-918f-5532e9fd1da0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161145, "uuid": "dae87608-d705-47af-807a-c5b1ec976baf", "value": "12288:jV7hjtQiPEx1mz5v7hD3qkpxmJApgmh8RQ79KB7AtN37k69JtcWZMSLHXx:jG+r3qkSJ0H8m7qAtFJbZR3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628161145, "uuid": "d9d96c7a-0763-4941-b6dd-57e276d28e9d", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628161145, "uuid": "ca22aa6d-862c-4ab7-841a-be709b1f27d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161145, "uuid": "6cee29b5-d196-40a2-a4fd-e90fc9ae1430", "value": "INVOICES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3b3994-f5b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628142604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142604, "uuid": "483eb1a0-f15a-4af2-a61b-2368db0c341e", "comment": "Malware payload (RemcosRAT)", "value": "d71f2f286d937ce775c3a3ec91293c6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142604, "uuid": "14651b94-1d15-4748-a670-a8e2c3ef2d78", "comment": "Malware payload (RemcosRAT)", "value": "1bf82794b7a65dd38c5f0f78813b1f882a9ff838fa94543e74a3a29a22307032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142604, "uuid": "ff6db271-20e0-44e0-ae6c-c66bfa63e642", "comment": "Malware payload (RemcosRAT)", "value": "96d376b679677568cf7209bd6787258a1cc3f78c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142604, "uuid": "b9fa9d3c-b4e7-4f09-8dd6-d8a7a2b16535", "comment": "Malware payload (RemcosRAT)", "value": "a07af74afbb91af1255992bf344c8b72d40eed2536b36c1e106b24c59325657463c036542f18b256c91fb7a80e7c3261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142604, "uuid": "a4772884-b227-4eee-aaf5-67712feff090", "value": "T1FFF45C2166434C3EC13F3A394C0E9F8E692DFB11551B9B4A29AC6D1D1E6978339281FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142604, "uuid": "9fcc7e14-3563-4f28-8772-02ecfc84e6f0", "value": "5d5434596ea18ae43a7aaca0d4518a1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142604, "uuid": "dcb9cf53-9f7d-471f-b9a8-4eb8ac5ebbaf", "value": "12288:63obX9TMexlCF3fcwsqBH+fkmgUztnuHGIJb3:Pz9rCF3fcwsY+fRgUdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628142604, "uuid": "7e60281d-fa5e-4816-bbcc-fef99b899ea9", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628142604, "uuid": "d85325d0-7529-4f36-866b-3a2249f993f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142604, "uuid": "dcec20f4-5007-42f6-a8ed-d8b535218db3", "value": "Urgente RFQ_AP65425652_032421,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a26d03a3-f600-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1628176815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176815, "uuid": "48533b77-171a-451a-8407-b8b6ab95e34b", "comment": "Malware payload (ArkeiStealer)", "value": "2f3c78ba57e682a5f4ce3632b1b2da20", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176815, "uuid": "2d63d0a6-695a-4fbe-9314-e9a2570b9ce5", "comment": "Malware payload (ArkeiStealer)", "value": "1c8f1643dd2d7c1c8224caa017aeb9f4447370e3849862d25b19844def08f384", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176815, "uuid": "806f0aa1-1946-4699-a22b-9f8db52aeec4", "comment": "Malware payload (ArkeiStealer)", "value": "c174b5314e9c3df9ce1d4a15228d05f88abbcac6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176815, "uuid": "b60d6320-05e2-446e-b0ba-4b80e895de4e", "comment": "Malware payload (ArkeiStealer)", "value": "2369e02d0e3dac8e0f4c1fcd6948bf34ec9a85e1a766746b9faa1bc885abe3fface22ad4187265199e7176cfcfb95b18", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176815, "uuid": "0d93ec9e-4fdf-48ca-85d1-74e73f78e3ad", "value": "T15BF4120131C0C033E4607A758957CA7E5A7BB862D9E48F5B7F860BAC9E12292FF5634D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176815, "uuid": "31426965-17f8-4a8d-91aa-0f020d6f58d8", "value": "2a9c1ca66125aeff7a1c36242be63d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176815, "uuid": "29f7e946-86b4-463f-9c82-7ffccef4d793", "value": "12288:eeGHQ+4tLRtu4AtWUZngf8OawfkoNDbTzlpYRdlVeWbzBCPTKsHJXmYiiS73:eeB+4pRtLAtWUZngfXTkopfWVe2VCPFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176815, "uuid": "2bbad990-3adf-4806-871e-8e34e763339f", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176815, "uuid": "13b40c63-368f-4bf0-a267-ca8e1fa93b6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176815, "uuid": "c6524c40-65a7-4569-b6c7-0adef2c6ad05", "value": "2f3c78ba57e682a5f4ce3632b1b2da20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91e4a93-f5b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628142547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142547, "uuid": "b3ee3813-01bb-4783-85ce-0fa76ef85e98", "comment": "Malware payload", "value": "240c52548a89e1be89b05bb6a35f157c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142547, "uuid": "e4f5156e-eaf8-4e67-83d7-da4d80f2421c", "comment": "Malware payload", "value": "1d52a901a8792bf7f140f658221096945039f85005395426d343c022e033144d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142547, "uuid": "e4ae354f-12ae-4bbe-a321-7c47aa74da38", "comment": "Malware payload", "value": "42622a8b997d592d2daa0040bbad9988fa8c8250", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142547, "uuid": "a26ea5ca-b9cf-43cc-82b4-c17680a34347", "comment": "Malware payload", "value": "127af0c6dd7f7903cf45bc58c652869522163fa82eaec060d9167269427e273dd1b12a2f3070a294935bafeaec7f1b88", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142547, "uuid": "cb08a050-985f-43a1-8884-d1721aca60f2", "value": "T1EAE540F8AC31DAAC3885F597E9D0B84558C37CFC717F8E544518B6BA34A34909B8889F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142547, "uuid": "3a24333f-3b68-41e7-9a9e-b14143214ee7", "value": "1536:FlqqqpEWqP3NUUSmLUWtpPrp89BqnpJDADY1ua3zbl4z0HFepWW91DTZfHcRuyeB:FlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628142547, "uuid": "9972d470-85e2-4c87-a1b6-f25765d3b62b", "value": 3294561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628142547, "uuid": "09b1fd20-0011-426a-a2ff-f600a9099bbb", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142547, "uuid": "b6e1b937-221d-4f66-8380-f6f73737a5d5", "value": "PO 655659878866.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591522e0-f61b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628188288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188288, "uuid": "d5ae340c-fb10-426a-a879-27ad50961683", "comment": "Malware payload (RedLineStealer)", "value": "8f49f9693b38e5365cb7e0681da47e75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188288, "uuid": "6bf8ce0d-8ff4-4e6f-9c5c-1406eee97dc8", "comment": "Malware payload (RedLineStealer)", "value": "1d9eada32c618b3d4a5038df5c82579a96af13b19d9da995c46153d1a3253825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188288, "uuid": "85d80cb3-28ce-4117-bd6e-7b9bcc5b8dac", "comment": "Malware payload (RedLineStealer)", "value": "901e31decec262d23b3765ac95fb9191f6a781d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188288, "uuid": "aa01b4cc-d01b-4b1b-b979-5d40ab86e88e", "comment": "Malware payload (RedLineStealer)", "value": "b74dbc7eb03eb1f4ef9c929be1fd9245c194da9b50eafe377a3ecfcd574ba2ded50614fb338b3bc75cd747c0e0926396", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188288, "uuid": "95a5cf25-dc49-4cbd-bf10-1c384c22962c", "value": "T178D402953081CC77F0A276B3DC15CA51563AF824D829DA4B7B859BAE6F317E2AF30341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188288, "uuid": "11945c13-f547-4b50-8194-183772dfc9c4", "value": "e905b204d022a4a3f9803ba3895bcbd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188288, "uuid": "d7229f1a-1735-4343-9281-f06d58a82746", "value": "12288:GyIxmAXyMUQbGR/OH+pOCcKwaN8DtNzjMHJHFiPH+:VIwPM7b2EKwTrXWCH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188288, "uuid": "7be15c60-7da3-4d07-886d-0f6339ba54af", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188288, "uuid": "acba9a3c-e368-4964-859b-522c9aa6b6b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188288, "uuid": "f8a7a879-11ff-4f76-8ffd-95991d96fea6", "value": "8f49f9693b38e5365cb7e0681da47e75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa4ea1a-f618-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1628187252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187252, "uuid": "6a0f2dfe-d5e1-4240-8b9f-a7c4a6e543b6", "comment": "Malware payload (njrat)", "value": "7cbc3b6a36f71c584b08fac91478f033", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187252, "uuid": "9c594e8d-68ee-44ad-a9ed-37d39fc2ba90", "comment": "Malware payload (njrat)", "value": "1dab360111d8a0f59674bc5c725b88edac598dd7e0171ab7c3bc5416d45e6e89", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187252, "uuid": "882b0198-b107-4197-85fb-fc859beb0767", "comment": "Malware payload (njrat)", "value": "e1b3fc39592cc02aa8b40487c827bc96fb3c830d", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187252, "uuid": "29a4f248-39d4-4991-802d-35868559378b", "comment": "Malware payload (njrat)", "value": "9010d12b9158dd8f03733af472fb8feae404a52a265e8467329d7bbb653c941f4969a01211f875bf915b6dfc78e37389", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187252, "uuid": "686b1f9b-d3df-4f41-8ba4-65795fa40e6b", "value": "T130A2188E7BA8CA25E3AC1AF64CB3A31093B6D2878551DB4E1DDD909B6E733804508DF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187252, "uuid": "e1379bed-ba97-488e-ab44-73b987ffb3d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187252, "uuid": "31d0650f-602e-4bb8-991f-6d845d0467f0", "value": "384:0HVGj4DnU+P24h/WHuvZVofpML+m9tTdcF/Q34Zo2STD6:0iEKuvZzdty40H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187252, "uuid": "7a9e2290-40e6-4096-8353-af2c82a9299a", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187252, "uuid": "dd9f86aa-31b6-456e-9f00-f9ffc67db30b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187252, "uuid": "9571d8d1-59b9-43e4-b9ab-5281c7931589", "value": "1dab360111d8a0f59674bc5c725b88edac598dd7e0171ab7c3bc5416d45e6e89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629b3de6-f60f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628183150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628183150, "uuid": "9e16b302-907f-491a-a619-773adcf2cc79", "comment": "Malware payload (AgentTesla)", "value": "6d14e1f37311d358d1babf4daf94c038", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628183150, "uuid": "661b4b8c-e8f1-46b1-9262-5c23604e337b", "comment": "Malware payload (AgentTesla)", "value": "1e4efcd576c34d1af12971bf6274286b865a5a3bfeaf9adc1fc35ecca449d23e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628183150, "uuid": "8fb55908-cad4-4b13-80a2-7773fafa7d6c", "comment": "Malware payload (AgentTesla)", "value": "6d76fb4d3702a8abb53259abaf0b5bf0354fd190", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628183150, "uuid": "f9073921-b29d-4be6-8f68-b2f1533c8c34", "comment": "Malware payload (AgentTesla)", "value": "b5835cdc8d46733cb17bc8cebc1ff49bf569fc6bde99607495ab13087e2142c5726d6eab7d3c6ff9ded4f66ee583eee1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628183150, "uuid": "29eb7c55-a6a7-4929-95ad-564986a67c04", "value": "T1C1F40114B3680B64E83A57741A71005427F4FE0D9B37EA5E7FC4B1EA8AF37254297B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628183150, "uuid": "bd6f2952-89d0-4bf5-9e26-1b39f962b409", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628183150, "uuid": "38a244ed-5ece-4ff4-8f78-ad92a38766b2", "value": "12288:n6pPNxAnyWhUECdeKRxjNXkPyD7TZgk2zp+pAGSBl3DHxl940it2NjFK:cx2TCdeINXkqOFixS3t4TMNjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628183150, "uuid": "49397c4d-c96a-454d-8fac-c01b16832f70", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628183150, "uuid": "df5af951-e65e-431c-ac33-5f29fe709cb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628183150, "uuid": "24f5f12f-cad0-4253-ac7d-61fd553bd353", "value": "payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1f7d5b-f5d9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628160055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160055, "uuid": "fa18a9b0-3903-4e26-91f9-096d66af4cf9", "comment": "Malware payload (Formbook)", "value": "18856c5e2a81b29efb2e77dec6b50387", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160055, "uuid": "b0007dce-06e6-476f-8573-85836c0e0d23", "comment": "Malware payload (Formbook)", "value": "1f9b5c120efbd32491158582492dc17322b805c955626fbe43f2136a77b1812a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160055, "uuid": "e1bf1b0f-823f-4a86-8691-971da2c4b686", "comment": "Malware payload (Formbook)", "value": "27a42dd0e7d2711bf0cd8a96159ff521542115d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160055, "uuid": "54456519-f916-43b3-a065-d32139f24b22", "comment": "Malware payload (Formbook)", "value": "24097b6ec6da479e26a13fd3a752ccaf519758f346edd18d4e18fb917ce955184ea71e0dd8d2d6c75230366651d4fac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160055, "uuid": "89230b29-9ed7-43f7-b598-1d1396523944", "value": "T136057C2229EB154DF3B39BB54FC4F8BE56EAE5735B0AB0F638910B464322940CD61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160055, "uuid": "35e3f83a-1d5b-4e4c-b6d4-6c394bb7ef5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160055, "uuid": "4f502843-3bbb-4442-9ea7-ee2bd467ebe0", "value": "12288:lBoR65AXwgFvuSSXsDgtwsMntNEqf4ZHlQMaeJREZ+Lx0Js8OPmbX+eeRpzSLlCc:noR6qgGMPMnnyZHDJwNsWnEpxCLY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628160055, "uuid": "60eb79c5-562b-4eef-b0e0-9ade5383f3d2", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628160055, "uuid": "ecf77789-9e3a-473c-a6d1-f97ed092e74e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160055, "uuid": "94aaff71-a235-4eb6-b6c3-d88b13112177", "value": "Request for Quotation-BV-76435020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9d3796-f5bc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628147738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147738, "uuid": "96ca81bf-296e-4a74-ae1c-46978dce8378", "comment": "Malware payload (RaccoonStealer)", "value": "f3c395d591384a863e235c26d6160fb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147738, "uuid": "d1fa931a-d2eb-47df-8b2c-d335ca8eec63", "comment": "Malware payload (RaccoonStealer)", "value": "200c2a1b721eba61f3dc8ce6105d331c55f5c9c702425007e5f7ab0791f3a0d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147738, "uuid": "986dc286-f064-44e3-a7e5-3e6a4a09f65e", "comment": "Malware payload (RaccoonStealer)", "value": "e6a3ec63c532641a59476c76d75df99843990333", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147738, "uuid": "8818b1b0-5d2b-499b-aa02-8fe76db353a2", "comment": "Malware payload (RaccoonStealer)", "value": "d7294696869255403b0266c539896a93abdb4569aa7fc7c12fa57bf42be4f6929ee24e224788aeb6a351710906aec879", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147738, "uuid": "b74d348a-bd98-434e-aa49-c49b27729f11", "value": "T1F7A401217654C477F81145705C64C7A5AF667CF2CB344A8F3BC466EEAFA22E2AF25302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147738, "uuid": "0fb46c89-cea6-4a6a-8e93-f6f5da0d8404", "value": "2a9c1ca66125aeff7a1c36242be63d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147738, "uuid": "2f19ec1b-e7a8-401a-8c5a-6238db7cf897", "value": "12288:tL+FGD/23ongv247HHmw0CX3yLFKm8caF:t123ongjHH53yL4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628147738, "uuid": "994c8810-b547-45a2-9aa7-6716a1fa307d", "value": 473088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628147738, "uuid": "a911604a-bad6-444f-9a3b-eaf181c890ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147738, "uuid": "db5858f8-a8ed-452d-93a8-aefb8dcdb102", "value": "f3c395d591384a863e235c26d6160fb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af190bd-f5f2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628170574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170574, "uuid": "38393f89-044e-497c-b6e6-dd701b46c545", "comment": "Malware payload (SnakeKeylogger)", "value": "2db427f1c8cf8fc78ff2b57633172dd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170574, "uuid": "4cf6ca95-bd85-489e-abcd-fa50594a719a", "comment": "Malware payload (SnakeKeylogger)", "value": "201f00f16d55d7f53aa2d9136b00c2d29a9c70d88c7cd69f67a8d18aa3d939c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170574, "uuid": "0f12ae4d-2e29-4a4f-93d6-ac0f5e03ea77", "comment": "Malware payload (SnakeKeylogger)", "value": "fedde3adb5c7770ae7903e825ed128b6f5e374f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170574, "uuid": "03602974-5161-4893-8934-de5257b2a197", "comment": "Malware payload (SnakeKeylogger)", "value": "f40304b13f0c314d1a9a3503249635d08a802cd702609091da838de04d9840590b8fcd099583a879a2c20ed723982646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170574, "uuid": "9ab9c7fc-fa8f-4209-88ba-295cd3e7b6d4", "value": "T196C45A2439FA501AB1B3EFA65BE475DADA6FB7733B07A45D1050038A0723A81DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170574, "uuid": "ccbc8254-9b2e-47e9-8224-709a27d0668d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170574, "uuid": "7a5f2732-af50-4367-81a3-b6681a7121c3", "value": "12288:+2HS1J7zovhgrhBqnJBm/GeRV8qH59U4XyXQfV7RMfWYs:wemCuOaUHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628170574, "uuid": "fafd302f-a4f5-445f-bc9e-d7f44b368ce4", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628170574, "uuid": "077c4557-8a0e-4167-b91f-1fefc191d115", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170574, "uuid": "f5cb1dbd-4018-4bb4-bc8b-63644ccec1f9", "value": "PURCHASE ORDER-PDF-SCAN-COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87eec4ef-f61f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628190084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628190084, "uuid": "35e6f873-d0f4-47e7-9d16-d467993fbadc", "comment": "Malware payload (Mirai)", "value": "c5f826bb3aed0fb564cc0365e6fd773c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628190084, "uuid": "cc6b3d41-785f-4ec3-ad97-a342efeac700", "comment": "Malware payload (Mirai)", "value": "206cc28e56c2fe7a9330b754bebc814e330f7f99da0d6314b8f40a43ebd42c85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628190084, "uuid": "c4bcc060-0577-4307-bf4b-cfbacb74b9c8", "comment": "Malware payload (Mirai)", "value": "63cb0b6254554ec4ee30669d2b212ca61728a62c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628190084, "uuid": "4ba02ba8-d9c6-4250-ace2-d1656664aef5", "comment": "Malware payload (Mirai)", "value": "0f86de4f140e0d3668e6f1c8d126b3ab23104a4c04f3387f167cd0619863bb655903d9ec0fe0da8538d85355a1e7e7ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628190084, "uuid": "efdd9196-16e2-49e4-a235-31bf730c173b", "value": "T1DB64029BEE627C5FED074FB021570B5627F8D5DAD3875980B328884839FE242A3606CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628190084, "uuid": "dce01b96-a47f-4ab4-a292-a9fc4ae82ac6", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6coN3Q:7O/QJHZweEL/NOjCHm7FZZncR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628190084, "uuid": "a853f8e3-db0b-4241-a5e6-5b302b6a77ac", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628190084, "uuid": "8d6de24a-4edf-436b-856f-aa6513f48251", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628190084, "uuid": "57d2b970-3060-4ac6-9f57-6fec66c8c637", "value": "c5f826bb3aed0fb564cc0365e6fd773c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368ee8ad-f604-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628178352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178352, "uuid": "f57bc923-f1fa-4277-a8f3-709d4f30d77f", "comment": "Malware payload (Formbook)", "value": "dcf861a4858cc95b9d2e9ec60969933e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178352, "uuid": "d449e818-05d7-40ca-9086-d029bbec163e", "comment": "Malware payload (Formbook)", "value": "21903a861055a5164a0b7ac7b6383006aa3f74308c2cc0891e5815f0e5d72643", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178352, "uuid": "3fed0622-507e-4056-8490-1235ae97656b", "comment": "Malware payload (Formbook)", "value": "44b0594b5d911a7743c014c882641adc5592772c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178352, "uuid": "981edf15-20bb-4dd1-8727-85565d7f2aca", "comment": "Malware payload (Formbook)", "value": "f87eef89bb654da688d05a618d58f8da93bd6c630d5f43d7e4633ea527fd3067bf438159c0fa0f068a0db4f453dbee0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178352, "uuid": "f97d85dd-8e67-427e-9e6f-6348e4e48fb0", "value": "T12A157C2129EB210DF0B69BB90FD4F4B24ABEE96516CEF1BA38C04B474739A91CD51731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178352, "uuid": "fea1242d-7d6f-4055-82cc-68ebf498994a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178352, "uuid": "6a195a5e-28e2-428b-9a90-3be3b0c4ee16", "value": "12288:esstYdODLqJmNuoLfZBm9MeOoWaXuhDfG9LQsIiUmbVysKRTTIpjxTHITnhDtLjJ:PstY4PTfOVSfI0D16MpRTkpjpHCBZX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628178352, "uuid": "80629072-3c3f-4895-83c7-2f8ddf55ebf6", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628178352, "uuid": "0cc588f3-f7ea-4ec9-9688-5329bd713dd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178352, "uuid": "ef7ad612-10c7-4a69-b814-1894578e9167", "value": "dcf861a4858cc95b9d2e9ec60969933e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8848f02f-f5de-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Heodo)", "timestamp": 1628162168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628162168, "uuid": "72e375c2-ae90-4f26-a388-9c3f7d88e27a", "comment": "Malware payload (Heodo)", "value": "09a3804d0e49252e70bf047d5899183a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628162168, "uuid": "c031b7b1-ab2b-4861-b46a-5bb9ebf11a11", "comment": "Malware payload (Heodo)", "value": "21b4634e17ab1de4e533f9b1a82c0dfdf53cf1ecf9eb17979dedd0cd78ceadba", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628162168, "uuid": "42ea2900-f59f-4160-91ac-c24e9a0d5252", "comment": "Malware payload (Heodo)", "value": "0fd3d687220484268c6b3098ec5ad5e22a74414b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628162168, "uuid": "3132bb99-0811-4aa9-a20b-82fa048857e6", "comment": "Malware payload (Heodo)", "value": "3c4ebd87485dcb82cdec4dbe5c3e9d42fe73ddd4c632143a8cd8085c22c7faf67f93975286c9a312e1ad6999eb44f0ce", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628162168, "uuid": "1c3b0a8e-93a4-467b-a1e4-e56a6ff8b5d7", "value": "T134B402113555C673E15241318971C7929B6ABC743C305AB73BF3A6DEEFE22C29E28386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628162168, "uuid": "25e82e51-c530-46f5-b2f8-c9f9d86c12c6", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628162168, "uuid": "8a82a2db-b721-4b2d-a5da-f731eed95197", "value": "6144:4kCgnN+Oaba7kOdnbftcJKfRyiYwyZp/6lSkGeewUrbCoaMlm75bDlEn0JaAIOHf:dh+Oau5DSJdX/6l4gemvQ0UAIOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628162168, "uuid": "cc575b4c-65ca-4074-a3bb-4472f05f58c8", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628162168, "uuid": "3f1010ef-6a7d-4474-8595-0be3080ee255", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628162168, "uuid": "8b5f22d1-057c-45ea-a6b7-4b2933e21d6a", "value": "09a3804d0e49252e70bf047d5899183a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e776f417-f62f-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628197117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628197117, "uuid": "4d84f1b3-f5ae-4d47-84b0-b04980bd739d", "comment": "Malware payload", "value": "6b351a94a1b2da234cd920dfbf7499af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628197117, "uuid": "3cee8a68-bdfa-4db1-812e-682ad516a73f", "comment": "Malware payload", "value": "225aee453b9568adc4ebb27ce98fd80feabf144356196aa1139f08f4fe10eadc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628197117, "uuid": "ed16450e-83ee-49d3-8275-dbe6a63113de", "comment": "Malware payload", "value": "57de9d9b5450747d66d43b16985004c85566af3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628197117, "uuid": "db6c733d-cd10-4ed6-8b5b-2fb4e42525e5", "comment": "Malware payload", "value": "1ff6b31a54a333da306d6e68dad5f01f6d296f24bef4a5958ce111b15d209093c57ceb20745ab9d030dea0777d77b7a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628197117, "uuid": "e6f56643-cfd9-4b24-a883-1af13baeb56f", "value": "T1A9F37B66B2E41088DBF581F6D9921706E67174761B15A3DB2B7813B71B1B8CA8F3C3A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628197117, "uuid": "4868c013-8e7f-450d-809b-4ddcdf7f041e", "value": "7182b1ea6f92adbf459a2c65d8d4dd9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628197117, "uuid": "1b7896bb-9b9d-4bfd-af99-c8a51fbd32aa", "value": "3072:N2sMWkzbJh1qZ9QW69hd1MMdxPe9N9uA0hu9TBfcXW2bOlDGhek/:0bJhs7QW69hd1MMdxPe9N9uA0hu9TBrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628197117, "uuid": "1860aafd-6508-4783-aa25-01f21d8d3b97", "value": 166400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628197117, "uuid": "0b39e974-9bc8-4304-9d5b-fb2114d26f35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628197117, "uuid": "80e7998d-7daf-4178-86dd-e3015e0c9868", "value": "6b351a94a1b2da234cd920dfbf7499af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a497fe62-f61c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628188844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188844, "uuid": "30b27726-cca7-4be6-a45c-5c05fc79ab0e", "comment": "Malware payload (Formbook)", "value": "028af3720307d853716bfa0f438a0746", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188844, "uuid": "4eb5df50-41b0-4dc1-9d98-3dfd4d32aa5e", "comment": "Malware payload (Formbook)", "value": "22f8bd6d14f40adb264992b23b49be37feeefeb00ff0702bfea5662b401ff8d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188844, "uuid": "e4523d5f-e008-48a5-b392-bb7223570a9d", "comment": "Malware payload (Formbook)", "value": "505fe3318184ded249c82772cd6f3a2b61d4974a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188844, "uuid": "8d13056a-60b0-42cb-8ad5-38031fffe62e", "comment": "Malware payload (Formbook)", "value": "0a62834c19b959e7740c256db35ebb384b7e353d77d336939547805d0f42880abc6657e5b6af25f5af95f79765981ce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188844, "uuid": "7a7f4cc5-5e96-46b6-bd78-0a54b8ff5007", "value": "T192058D6C23FEA619F637FF31AF94E7489FA666B94215DC0E18C4020B5421D82BE67D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188844, "uuid": "3c2fcdde-8cb5-423a-b5fc-74f9bb97244e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188844, "uuid": "b65c11ac-8ec4-4bfd-8cd0-e335bc19a656", "value": "12288:PBKxvx2iNyC/UaTRhdWoecpeKOERq4oZ/8N6/nfYoQamRHJqDV356Rkqh2rNls9x:EX1nnR4cobsqI6/woCHJ6J6vhAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188844, "uuid": "33425e81-1133-4f96-8680-1bfa271173a0", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188844, "uuid": "43e1ddcd-6a6a-4196-94c7-63e7ac430fd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188844, "uuid": "9e5c1973-c631-4047-a7f9-a3185ae2163d", "value": "028af3720307d853716bfa0f438a0746.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3aad8dd-f63d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628203123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628203123, "uuid": "0bc9e28a-782f-4622-afe5-bf7ad4513ebd", "comment": "Malware payload (NanoCore)", "value": "eaa02f016600ea506894cc21edcf5cbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628203123, "uuid": "ba36b1cc-0571-4fe0-9fc9-fd1c29dd5bf4", "comment": "Malware payload (NanoCore)", "value": "232bb8d7922a7b0feb571593ecb3ccbd24efdea0673704e437ce684f5185a604", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628203123, "uuid": "1242dc7a-807b-48fb-88f9-7563dcda1d4d", "comment": "Malware payload (NanoCore)", "value": "5b849b1517e8caa35fc0b2cf28e6ec999e4787b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628203123, "uuid": "b06eff62-46cc-4d2e-981f-4ece43b135a0", "comment": "Malware payload (NanoCore)", "value": "5553e6be66a3e42280234adf88dadbab7cd8b783bbb7d53f32501c69fb8c50db075cc7d9e0dea74401f1e41685eda61f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628203123, "uuid": "fcc4abbe-6336-4277-af6c-405193641cab", "value": "T121D4BF823145DCDAE04329F258AFD57050B97D9E8165CA0E3783BF2B95E734234ABB4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628203123, "uuid": "fdf08707-a910-4fbc-8bb6-1767dd395971", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628203123, "uuid": "ac955c3c-9316-41c1-a9a9-9f6e8afabee8", "value": "12288:YymwOejZ4mERmSDLj+UvUP1uia6pzEqcSi8dkK:5uwZ4momQ+AiamYHdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628203123, "uuid": "a4d80829-b2ad-4aa0-aafb-1dcee6a00a96", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628203123, "uuid": "61508eb8-f50c-4265-a2d1-d4d7942b74b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628203123, "uuid": "ba666aba-d131-4a60-9441-22b0ddd22a96", "value": "02_extracted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d6a05d-f5b9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1628146059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146059, "uuid": "dfda7a3f-f486-4da2-aeea-b45a7688a6a3", "comment": "Malware payload (NetWire)", "value": "7ce0b9ede7956ce43eed5605c01be944", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146059, "uuid": "d74251e0-9213-4b17-8fd7-11ab4f4439a8", "comment": "Malware payload (NetWire)", "value": "235bcc9dd72de0c5ee65fce42857fe4e341915bb53a731efbf5e986f9cdd4434", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146059, "uuid": "51a55264-9fad-4862-8a06-ea79fa7213ae", "comment": "Malware payload (NetWire)", "value": "d66b1f3c31372a2abf4eed0ff163b9d1b1228aa7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146059, "uuid": "0e5c5865-e3ea-48cd-a530-2a696a736a6a", "comment": "Malware payload (NetWire)", "value": "1b436586aac00a8b33fd712edafecd465745deb553735a4b1e75ec962872113cfa288b7bae0f43f3a2d2611e285c6d54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146059, "uuid": "b44e6a38-4235-4452-a1a3-68fe8ef01478", "value": "T1D134E12327F45E32E14E8AB629E28F64D536FCB15555CC076284BF0C6EB2F81AD12727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146059, "uuid": "8dc9d61d-01f0-4594-982a-a24329af196c", "value": "4e0230218d44198d72f8950221b8a209", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146059, "uuid": "ea409349-fccc-4af1-8caf-6fff3522130b", "value": "6144:8gDjEcHIBTYYkxm2WNVN4YkOHaoe338IE:8HIfBroVN2meXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628146059, "uuid": "6e38661a-9acb-41ef-bc8c-10088acf0d15", "value": 246440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628146059, "uuid": "bb1d70fa-64ef-4057-a991-84483e938e6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146059, "uuid": "8464d6cb-82eb-40c2-8afd-53ce4698582f", "value": "7ce0b9ede7956ce43eed5605c01be944", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c887e42-f58e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628127654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628127654, "uuid": "609a9ba6-5050-4e9b-842f-66f152232636", "comment": "Malware payload (RaccoonStealer)", "value": "5f105f49a19638195ab9c660454d86d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628127654, "uuid": "966c1fe7-2182-42b6-b60f-77aff8f683f2", "comment": "Malware payload (RaccoonStealer)", "value": "2389fec9a46650f8bb5b5da588e32636b8725fa6e6bca5a962110a834a2383df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628127654, "uuid": "6635035f-b4f6-442f-b7ec-e755878c77c9", "comment": "Malware payload (RaccoonStealer)", "value": "c489cd5cd9e1751c607b12fabb1d21b356c9d8d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628127654, "uuid": "f15fc4c0-82dd-420e-bb4f-446f5fd84e6d", "comment": "Malware payload (RaccoonStealer)", "value": "9141f9cf91d1cc504240b0376baf6396957c7361c0f868fd8b18e739ee3aff24fcb18ddbc12f43f70040de0be1ffc8e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628127654, "uuid": "046c9cd1-f709-4135-aee1-606aa4b64831", "value": "T1DBD4DF00A6A1C035F5F632F89A7A9368697A79F19B3040CB52D5EBEE16341F5ED31323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628127654, "uuid": "3040f271-299a-4ed2-ba7d-a19b0b110e66", "value": "762eb19010c0700eaa21fe941afb9920", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628127654, "uuid": "4a23421d-bb48-417c-8eab-4806c44eebef", "value": "12288:acCDFrUUPuDZYX9niKSIQM5jO2fqamw4SiqHhP/5:IDFrUhssBL2f1mw4Sia/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628127654, "uuid": "0a32b9b0-07e4-45dc-b582-9e4f97d0cd79", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628127654, "uuid": "6f5b5b83-1cb2-4554-9856-7c552156949d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628127654, "uuid": "3440ade5-3b9d-4e95-87fc-6d99036662e0", "value": "2389FEC9A46650F8BB5B5DA588E32636B8725FA6E6BCA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7074233-f604-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628178567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178567, "uuid": "30583519-3364-4193-bf23-c62de364caae", "comment": "Malware payload (DanaBot)", "value": "0f188430addd42481937c39756c45b26", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178567, "uuid": "a324c8ca-2830-4877-b083-ed14eea85046", "comment": "Malware payload (DanaBot)", "value": "23d57a913a8c60630d1f26d5f7eba55d8437d7595f562b1dd81b2ebc8d69751c", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178567, "uuid": "ea7fba88-d814-4615-be3b-21eaf2eef0ca", "comment": "Malware payload (DanaBot)", "value": "b4b74e182129511ef280fc7646d0e0122ccdb01b", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178567, "uuid": "2bac2c2b-b69e-46a8-910d-8e57cd036fe3", "comment": "Malware payload (DanaBot)", "value": "bd32b675702fecf42ee19d49de95f9b9a80fb789c690a9aa88f49f27543156088d55376d97e15361b132d43cf6af2b7a", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178567, "uuid": "d30c18ad-f55f-447d-8246-defa9c1af584", "value": "T1A5351226758DC277C26D4D304834C9995A2B7CB42D61627B3FB267BE8F213924EB520F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178567, "uuid": "c0d45e4e-fb85-46c6-9f2e-233627eb9f60", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178567, "uuid": "670c7ca4-c79f-471a-86c6-2e4b41afa297", "value": "24576:4WWDjj7ZwB8faqsLORHsrPk/rz/Mzo7Ao6hjk:4/b7G2aV6MrPk//if", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628178567, "uuid": "157d0f7b-0013-47bb-97b6-7b05329bc9ee", "value": 1122304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628178567, "uuid": "6cbc5688-0ff8-4c02-9d2e-5091bb9e7d98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178567, "uuid": "1e8e162a-d54c-4754-befb-95c14d195149", "value": "0f188430addd42481937c39756c45b26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21834b34-f5b1-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628142668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142668, "uuid": "e0805442-0b5b-46a9-91c9-21f58713cc7d", "comment": "Malware payload", "value": "4a53c91d743e8f9b6551893011d04966", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142668, "uuid": "c7a58ea9-1348-4a99-990f-2a366e9f2b19", "comment": "Malware payload", "value": "243b5b84bb63e98fb3d54e4e1d8592c367540a79f677a464f2c2ea5491f4c90f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142668, "uuid": "175e8125-4182-4adb-ad9e-4efb3116d1c1", "comment": "Malware payload", "value": "04e949d7d92e86c07a1e0bc72ae39cf2f950f0d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142668, "uuid": "6a5b8ca8-7872-49e5-85df-94d51e29cad3", "comment": "Malware payload", "value": "a3b87f3c1a3ac9e47c2b95d38fd21a560bf6328b02dbe11837e782246a4363aae735bc89078b233f8390a107227fa5b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142668, "uuid": "d11fac8f-b766-4f01-9861-23470a00f3f4", "value": "T14BF36C0B67F82066E4B5937059F202D359327D615B3982EF13CEA97E1E336E0A631B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142668, "uuid": "48229e98-ade6-4672-bcab-6e13e752c30e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142668, "uuid": "32dd7e3a-f2db-48b3-b3c9-d7d901fc3251", "value": "3072:9ahKyd2n3135GWp1icKAArDZz4N9GhbkrNEkbY2rv:9ahO7p0yN90QEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628142668, "uuid": "70512dd6-cbff-4b24-843d-d048fad2ca91", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628142668, "uuid": "6a9ecb18-6330-41f1-92ca-75a4e5c55853", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142668, "uuid": "7e89af77-4ff2-4fc1-81f2-6b1566351dd7", "value": "4a53c91d743e8f9b6551893011d04966.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cd7542-f601-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628176985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176985, "uuid": "4a052de5-6c70-41ed-97ac-ba38358fcf5a", "comment": "Malware payload", "value": "5d8ab59f88072ec1809a796288eb5608", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176985, "uuid": "4fe5ed3d-7a6d-4846-a1eb-4f3025ddf529", "comment": "Malware payload", "value": "2441ea88dba5c9433265b260738cf94091b74646756ffd4e7c8e88d9e92e94fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176985, "uuid": "4da1cae7-7501-4366-a8f1-7ae6b6261f82", "comment": "Malware payload", "value": "127e90edb2604d680649a314c96119278950aaef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176985, "uuid": "38fce8e1-be34-4d51-b7b0-5c52288cdac2", "comment": "Malware payload", "value": "3023ed478005288bee7f671b7e6a99576587fd42d468a30d7cb59192a3c9577bd5d6c2b8df561631d64a82df0080bd20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176985, "uuid": "0b1372ee-2fd5-4ee9-addd-39c7407da8d8", "value": "T1DA063302F98559B3D9719C32567AAF41317CAC203F21CE9BA3C45A29D6314F1EB32B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176985, "uuid": "9b4ba670-51b6-44d0-9dab-4010174cf136", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176985, "uuid": "48b5e2fa-045b-4cb1-b2f9-49af1cb4e9f5", "value": "49152:J84DDwhTnHNPgNL/GMgaWyGyj8C2XI6l0iqkJ6cO4EkkXqbSYBUCvm9ogQc:JFDwhTnN0SynQ54m0RcOgs3Cv5gQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176985, "uuid": "926dec36-1cb6-4099-8a08-31a9b3df8075", "value": 3671212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176985, "uuid": "82c968f0-4ddc-424b-8fe2-b5ca6c595acb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176985, "uuid": "c8c24c10-30ba-43af-85f5-57d9aa1c5560", "value": "5d8ab59f88072ec1809a796288eb5608.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d2cf40-f5f8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628173243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173243, "uuid": "d868f35c-4a8a-4bfd-892c-4e2095d45c4e", "comment": "Malware payload (NanoCore)", "value": "a22ae90aeac4eecc7448b7d96a55b774", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173243, "uuid": "c25ae1f6-4d66-4286-b7b3-702defe1db2f", "comment": "Malware payload (NanoCore)", "value": "255401f85f45db9733e50f83b033cc84a8e3fcb5888232bb5428e2434050840d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173243, "uuid": "14b94a2b-ae80-4fa9-a3bb-d100e8fd345b", "comment": "Malware payload (NanoCore)", "value": "03e8b629724d37528ffa2fe7da1b27d1c4053e73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173243, "uuid": "899940cc-a0b6-41f6-bd43-8fe47bab8b8a", "comment": "Malware payload (NanoCore)", "value": "8213770b5115234d9f60bc9567171ba76fbb030bafa3099ff9e0a6a68d828699a03d8848037defd35ecb83ddbd5356c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173243, "uuid": "a2d74298-4add-4ff4-8164-f3b6c4a4080e", "value": "T1C714C01677A84A2FE2DE86B9A12212139378C2E3D8C3F3DE58D415B78B267E546071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173243, "uuid": "cbb7e6a6-87ef-4af9-a9da-d6e69c3afbfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173243, "uuid": "8f260d02-be17-4173-a75b-6cc720fe4c68", "value": "6144:sLV6Bta6dtJmakIM5qc0kTgdXi6Wv7zoE5:sLV6Btpmk9c1cXNYAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628173243, "uuid": "9e000588-e86e-40e1-a402-21c503cdf830", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628173243, "uuid": "5cec94b8-025b-4ab0-991f-e3a04e9042e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173243, "uuid": "3137fe8d-1406-44be-8755-068efed1cc41", "value": "a22ae90aeac4eecc7448b7d96a55b774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8dbe106-f5b4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1628144318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144318, "uuid": "baab9178-3837-4404-b3f7-045815d0f4f0", "comment": "Malware payload (TrickBot)", "value": "14e049a9f6cf9749165621c26365931b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144318, "uuid": "0cc530f3-33bd-43e4-a4c8-69ebda502782", "comment": "Malware payload (TrickBot)", "value": "25939f03c43151ec5474f746fc71510fb6abe8b5e41da44fef74b6bc806e26b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144318, "uuid": "38f58b0a-a973-4564-bff7-6924290498c4", "comment": "Malware payload (TrickBot)", "value": "7644a353908969fa261f656c79c6050ef8b76eb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144318, "uuid": "2bddb8db-9335-4d01-9599-07037a3efe9b", "comment": "Malware payload (TrickBot)", "value": "77b8ed511dfab5bbc0e2f77b510e80b954b679771a231d524c2b976ddad7c3fc6807f34103ff3ab3c31b5e1f8612030f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144318, "uuid": "52a74de1-3b2f-414a-ba47-0036fe4f6d10", "value": "T138D33A0AE6C3C2B1EE8601B0137FA37F6D31560567169EC3CBA45C20AD516F2673EA6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144318, "uuid": "a5a10e16-c5a9-46d7-962b-bd7a456a056b", "value": "3072:wkLCLbqCqcf8113RAAzVfa2L+RK4hrB7FS:JKbq713GAZx+RK4nE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628144318, "uuid": "39e9bc66-d11e-401f-8758-05790f68ca38", "value": 135680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628144318, "uuid": "aa5e5323-03b2-4f8c-a6c0-a5d19058619a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144318, "uuid": "a59a99ed-7423-4ca6-a0f8-5f4ae78eb471", "value": "unpacked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e064a794-f618-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628187226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187226, "uuid": "889445e1-d40b-4fd9-aaf1-ea64159bd284", "comment": "Malware payload", "value": "6743e3521bb2e738ae850e6d270057b9", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187226, "uuid": "6b982d6a-2a0b-4dd9-b3c2-4e4ce82b3088", "comment": "Malware payload", "value": "259e0acea693e80af641925c2f881842e8aa979d770cc34a1769065028dd9d74", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187226, "uuid": "275d5b9d-27b1-49a6-a2ba-e2dd2ffd0f06", "comment": "Malware payload", "value": "5eb7b51a86aaf17fbbede08b426c43146fc6ffb6", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187226, "uuid": "eb40d4bf-b213-4a8e-9210-8895ea0c13a1", "comment": "Malware payload", "value": "96cc6f57e8ddf08ac038f5a6550d790bc4e21a9dd346f0459b0e6da423280858b4f1aed38d2b262968188a77259388e9", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187226, "uuid": "a5e65779-f134-470b-9671-f8340186f8f9", "value": "T192631D243EFA102AF073FE765BE475E69D2FBE623617D89A604133468A32A41DDD013D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187226, "uuid": "964c6195-3442-4f04-be9c-964e0e5f9602", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187226, "uuid": "294c1f03-0d20-4015-b444-fd74bd22dec7", "value": "1536:twW5v5ShTLys41asnXrkn8vaUAPJ6AlNQDAo6PU4C:twW5h4TLys4Bn7kn8CUAB6AlNQDePUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187226, "uuid": "cb4b7b11-8527-4d1e-9796-bfb1d4401724", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187226, "uuid": "0d64616b-4215-4579-bb18-36010abd940d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187226, "uuid": "a1bbfb4e-10ef-4b97-93a3-114eaff74069", "value": "259e0acea693e80af641925c2f881842e8aa979d770cc34a1769065028dd9d74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea0d7f1-f600-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628176835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176835, "uuid": "ee7ec048-d353-4ada-bef5-ff0c803a3efd", "comment": "Malware payload (NanoCore)", "value": "60fab863eb84d153dc17cccab2a0e9b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176835, "uuid": "60b49270-7d87-4a53-86a4-06b803ccc680", "comment": "Malware payload (NanoCore)", "value": "270fc0ac5e2115a5e3f30ee9cb30146886d08b938ac27559d2d452bde8175b14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176835, "uuid": "42c6b070-5e89-4e85-b188-4f1ffe5c3959", "comment": "Malware payload (NanoCore)", "value": "e88ab38aa9eeb99f2f120f64f872c8dbbc45b816", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176835, "uuid": "37ff94d5-9d5f-415d-94ab-672b70b8fb1b", "comment": "Malware payload (NanoCore)", "value": "fa9635ab1b47fe38a121f553e7a8eff670bfa16afbbed030cf2be54e59d0a5ebb5607b6989897865926d2ceab8ba9bf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176835, "uuid": "a5d15a01-bb16-430b-902f-ceb4d886cc5e", "value": "T18D056C2229EF114DF3B79BB50FC4F4BF46AAF673560AB0B638921B964322940CD51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176835, "uuid": "65d5660e-9956-4328-970b-2443f383cf83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176835, "uuid": "18e8acd3-c420-4de6-ad89-c8a7fb6b3401", "value": "12288:cheDWjMGAqZ+oR65AXwgFvuSS+IMh7RIsWZ58AAHazZRuoPnUUocG/0irSM9blCO:ch2oR6qg47RIhZ5nAHat1xWbNgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176835, "uuid": "8eba493a-5874-4ff6-8e86-2d4d451228d1", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176835, "uuid": "5540c091-be72-4699-8402-9da8b40fa367", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176835, "uuid": "db704199-2f6d-464d-83e1-87ce9de6ec70", "value": "60fab863eb84d153dc17cccab2a0e9b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9b555a-f629-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628194337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628194337, "uuid": "1de57e07-a1a2-45ea-a184-f13bd8d30ccd", "comment": "Malware payload (Mirai)", "value": "2fa6ed53f89c6d8207ea93b4ed4cf224", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628194337, "uuid": "31067ad8-662a-46e8-947f-eaf6b5d3feee", "comment": "Malware payload (Mirai)", "value": "27cdf630f75bc0253b7bc9c7efb3dfb454f9cb81daff99c9a8a6f21640e2d9eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628194337, "uuid": "76360567-2db1-413a-9adc-6e25fea3fb6a", "comment": "Malware payload (Mirai)", "value": "06179224d3fdb6a1df1111fa4fa36eb48b2fe278", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628194337, "uuid": "17a51b3b-04f9-4aba-8824-d27d95e43709", "comment": "Malware payload (Mirai)", "value": "0d199ca7d7c3973e2257204d20211efb3585ed66f71c307b71c108933f5f1800723ae5d4c4e0acaa93d741fbd5a9d8a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628194337, "uuid": "e3b0125d-7c52-460c-af57-92761a345767", "value": "T1B3534A01B7184E47D1A31EB4353F27E193EEE99120F4FA88355FDB4A8632D32454AEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628194337, "uuid": "fd1469d7-8a7b-441f-b42b-b178090f52e5", "value": "768:7xyU9SWabiNqn0EI5JvQz9y3rFRjbevXTi5z2Tkhdyw9+p8qT0tnMfjX5ttHFX8R:7rqe2BwF3rFq0My+OWGnMfvtJ87YoV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628194337, "uuid": "6014fc16-3318-471d-be73-8bc1053013d2", "value": 63860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628194337, "uuid": "37362f96-4e3d-48b5-bbba-0cf8261a7fbc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628194337, "uuid": "e6c4cac8-1b08-44b3-90c3-4bbe571f91ea", "value": "2fa6ed53f89c6d8207ea93b4ed4cf224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ae1493-f61c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628188871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188871, "uuid": "eefa8975-2979-4c62-ae96-853fbfffa762", "comment": "Malware payload (AgentTesla)", "value": "7c5e5f9ba055d8124f78cc32cd02d70f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188871, "uuid": "3380b345-ed07-4e46-ab62-914fe63dfbf4", "comment": "Malware payload (AgentTesla)", "value": "28e9c4ad5816632edc837be54ccb120cbb6206e888b6671bc3ab935f1684e203", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188871, "uuid": "871f2521-4b96-440a-9a2e-8d98cc610ece", "comment": "Malware payload (AgentTesla)", "value": "25a5bc05d8e3c60bdeb0161176be10c3ace478ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188871, "uuid": "fa521837-48d0-4f7d-b9d3-96f893bd0b80", "comment": "Malware payload (AgentTesla)", "value": "9afe7a454000971e911c58889048f3d4d5fa95edc0d3d713dc05cae3b519a37bb06544c2580a0ca9930a31ce08c38e3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188871, "uuid": "82ba5639-2f25-44af-a609-1e26dc27919c", "value": "T1C055013589CCDBEACC9C03B51B4C03A43EF19896B1B0E5B53E5A96B0F6C0D29E579742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188871, "uuid": "1f7afe4b-5285-4360-9a0f-95f8027d99fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188871, "uuid": "b414ab44-fc80-4f6e-ac76-6de645d4be68", "value": "24576:2tNS/d3bYdkadXVcZnGpBcJp8bjzC8IndPn+mwRGPoN7vdiTbnFM:SzlVcILc/8bjkF+m/PoiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188871, "uuid": "aaf85037-b03c-43f1-87bc-a7132d227cb2", "value": 1357312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188871, "uuid": "c0f148ab-fc3f-462a-b6aa-c90434ff7eab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188871, "uuid": "81dcf097-d0bb-4d8f-9a29-911fa8554513", "value": "7c5e5f9ba055d8124f78cc32cd02d70f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b42267-f5d8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1628159456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628159456, "uuid": "a6a70799-58e8-43bf-bbab-0b48b0e0c667", "comment": "Malware payload (AZORult)", "value": "7fb10b8ea68c1e0064730018fca3cb39", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628159456, "uuid": "1523dca5-6264-4f0a-bc3a-ca4c2e3435ce", "comment": "Malware payload (AZORult)", "value": "29cf2aec62c3504b1914484feff17ae470b51229b1df06f1a30334a08b6db12a", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628159456, "uuid": "a4f01946-8e6a-4967-9024-e6edd75f1cb7", "comment": "Malware payload (AZORult)", "value": "41c371b7053bcf1b7867aeada51e716650afa19a", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628159456, "uuid": "c5f7c30c-fbaf-4cea-99a1-c894277700fe", "comment": "Malware payload (AZORult)", "value": "e47ca1729560777ca9f694d6788c57488548cde2831fdb4a7a75962af36e2b1d672a3d2b059a591ca864030434818869", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628159456, "uuid": "9eab80cc-f38f-42ba-903c-809f7b227bcd", "value": "T1A025F11BBB66054BF0CA0975566064F61F7E9C7372852C1FEB829E0C44F2686B8E07B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628159456, "uuid": "1cc836bb-255d-44fb-bfa8-4eec12527bdb", "value": "fb0fb8edc31fffe9bb05edbac608d5c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628159456, "uuid": "a49ee941-a019-4146-918b-2241daefd8ab", "value": "24576:/E0lHcgqgh7/0tgIugNw6GQlGDI/NKs/Y:/Ew8gXYzVtGQVNn/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628159456, "uuid": "ffa88859-1052-439f-9f0e-27aa7df35c76", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628159456, "uuid": "f430e069-c91c-4e0c-8e31-332f2f349fa8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628159456, "uuid": "58ffde07-a514-4856-9990-163ab0e8e6af", "value": "7fb10b8ea68c1e0064730018fca3cb39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f443a69-f5af-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628141805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141805, "uuid": "1d986d26-1c5e-4ef5-8740-9c42e9fa324f", "comment": "Malware payload (SnakeKeylogger)", "value": "497cad6bb8a5a173d1de40158d17e880", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141805, "uuid": "31b06386-f670-4f21-ac3f-02ba0b3cbf27", "comment": "Malware payload (SnakeKeylogger)", "value": "2a94b70b3e30d5bb002f48cb8ae7855d060f71c0d79ad4be4117f3024810ef12", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141805, "uuid": "436959da-1475-4fb6-8c39-ed33d20fd059", "comment": "Malware payload (SnakeKeylogger)", "value": "664026ae4205ada740307aa277d3f37215329b2d", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141805, "uuid": "b60c31a9-d9c5-469e-8315-8331621b4754", "comment": "Malware payload (SnakeKeylogger)", "value": "1cc0f37de6f13fe7dcb647fe4a702aa24b7be4c24df838cc012d72a60707a88a6fd99b20e7667fca827b24e089b0fdf0", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141805, "uuid": "271b7c66-5731-4ace-be32-8f45e2b88063", "value": "T1279423DA09D65923479B2FE99B92FB1AA9503C10843DB5E75FF1226B0891D43F3FC860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141805, "uuid": "93394ce6-2856-4d30-bc34-460aa53b473b", "value": "12288:wwXgThCCFgbY4nZKsIay3YrfnKQWnZdPK9Vo+87Q7mgI:zXgTYCFgTZKqoqfnKzjK9i2mgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628141805, "uuid": "6df25dd7-3b2d-4c82-a098-f246076a299e", "value": 440883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628141805, "uuid": "4e90152a-dc09-46ca-ad94-71af2a3c1be7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141805, "uuid": "85acf4b9-b68a-4492-8c55-f42ce6044577", "value": "Evaluna description.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8343d3-f5f1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628170285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170285, "uuid": "8b5603ef-7dd8-403b-83e9-a25745dbc4e8", "comment": "Malware payload (SnakeKeylogger)", "value": "e29c7b5122f5ec7bca035faa936bfc02", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170285, "uuid": "6599bcdb-472d-4851-bf54-0c01f38d4b80", "comment": "Malware payload (SnakeKeylogger)", "value": "2ada03cc7424b371b671f5c63e3c5644d747368287f6c68145e76de163967286", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170285, "uuid": "f30ed42a-46d9-4825-a6f6-eed0e30f81c6", "comment": "Malware payload (SnakeKeylogger)", "value": "2b2ca88d4f6a2d1ead1cefdceb25f194b27e0c7b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170285, "uuid": "c685de1c-5948-4067-bcd2-0e3efdf76991", "comment": "Malware payload (SnakeKeylogger)", "value": "bb0805e5aa107e8292cc1cc1063b8e34af14d53c9c99bf4c15045103bb8a7c75da3897108789334503d5d255f64d459e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170285, "uuid": "62bf83cf-9632-4b2e-807d-59e4fa922c91", "value": "T152931FADD42706988F89ABBC2B276E55109D3B6EF384593271BC577423D6E3E502383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170285, "uuid": "fcf9b44a-42ff-4881-bcf1-f589919e54e9", "value": "384:G/Ogxu/xU58HgZYJd57UD+JWuguuyuqz4BEPFvsvhXWA0NKFYpFfK/chKSVp:GGYupbgOWpuiqzwYnrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628170285, "uuid": "0750d0f1-059b-4088-9fa1-610aa5e3780b", "value": 96958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628170285, "uuid": "696399e5-c569-47a3-9314-85de72a1f9e4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170285, "uuid": "a1a6b5b8-5310-43ad-8769-98ea0581c7bc", "value": "Order 3000070469.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9164517b-f62d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628196113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196113, "uuid": "c00340a5-43c4-4840-bb28-43b78551e997", "comment": "Malware payload (Mirai)", "value": "3676dab0c0a2fcd937868dd37d03e49c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196113, "uuid": "0af130ef-0290-4cb7-beb7-7b0b47f26986", "comment": "Malware payload (Mirai)", "value": "2c7131e5df5867eb02af17b17a5c049646c5fcf65a98612619b7d221e32b4e16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196113, "uuid": "bd514c42-32ac-4fe2-b122-6181a71d6369", "comment": "Malware payload (Mirai)", "value": "39de9aa89ebb45d0bad9c9c6895c3c3a65b5ca8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196113, "uuid": "07496484-5c67-49ce-9df2-a837f2bcb890", "comment": "Malware payload (Mirai)", "value": "34ce2d9639e6aa13732e9f17e6dc24cc1040d5ca1395bff1345070d4749453343ab5ba4eace3ba7850447e5c50339bd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628196113, "uuid": "90308cda-4308-4b31-9c06-4cdbb4ffeb27", "value": "T1CB435BC5D5C3E5F4DC160E75207BEF3387F6E93A2118DB43C3A8A432AE65A02D5162AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628196113, "uuid": "aadc1d46-12f7-45f6-a7f6-e491bed9bc8e", "value": "1536:YPv1W2nVF9wMDiBTQxisB7PHxT9IcriSQZK+:YHBmuiBdI75ZxrkZK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628196113, "uuid": "8eed0936-bfb8-414f-8ca7-2fd7bb630ca3", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628196113, "uuid": "166e66bc-b8cf-4d07-8882-6e2689a617af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628196113, "uuid": "f5c5cf4e-86c8-4845-9107-4f5a71f7819d", "value": "3676dab0c0a2fcd937868dd37d03e49c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2ae14f-f5b6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1628144889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144889, "uuid": "32a896cc-225d-49e4-b751-9aa347fa5180", "comment": "Malware payload (Cerberus)", "value": "d8c06445e9d07ce80c8a1b135b2f7cbf", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144889, "uuid": "27a1de80-0c32-4262-b768-44dc46918bf4", "comment": "Malware payload (Cerberus)", "value": "2d1370802093457d7bb7b151278ff6fcd2e8944e56d87ffc483422bef2f6d8e2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144889, "uuid": "ccdc7001-bcb6-40ad-86c6-141fef5550ec", "comment": "Malware payload (Cerberus)", "value": "8aea297967bb110cc33db3c1d2cfd00091d68a7f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144889, "uuid": "24b69f3c-dc32-423a-8bae-227e51716674", "comment": "Malware payload (Cerberus)", "value": "3e151f18a91820cfdbcd18b2fba1eb9443d052c4cd9064d87570f7e149e43cde173077b994fd62bfcb05a56b167548e7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144889, "uuid": "670bc236-1663-4163-98cb-fcc4271a6c75", "value": "T1C42633457322E95DEA078530BB53E307F6B41464C990EEBF15FB4CEA69AC8488F07CA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144889, "uuid": "ba4613fa-9109-45b5-94b7-728c13535b39", "value": "98304:JL+vTaX0TIPgz7WItf0U1yvL2wJVTuanOgs1mCe1w4/Pgo:JL+vTaX0cPQ7JJr1yvLDJV6aOz3M/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628144889, "uuid": "d40d6659-9fe5-496f-bf56-257c0e5ed674", "value": 4748836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628144889, "uuid": "3d755fc2-0404-4e09-a250-18418a8d81f9", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144889, "uuid": "e94e76f1-b8a1-4272-b27d-d50053de754f", "value": "Android_Guncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f2d973-f5fe-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628176101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176101, "uuid": "b8f228b0-ea60-44d2-99b0-dabe423bd2e1", "comment": "Malware payload (AsyncRAT)", "value": "abeb86fdec0060ffb80f364cabd30b1b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176101, "uuid": "52c20942-bc4e-4d2d-90aa-0a389be52003", "comment": "Malware payload (AsyncRAT)", "value": "2d5d1a4d6bc5abb1e0ad26c3d9801a44317d0a50a370db5de488763b98fc766b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176101, "uuid": "07efc465-1e6c-4ce1-a028-f204028bc451", "comment": "Malware payload (AsyncRAT)", "value": "3c9c7b3ee66ff071eb32848ad5a62fab9683427c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176101, "uuid": "7033ec9e-21da-4b94-a1bd-b3f01e32578b", "comment": "Malware payload (AsyncRAT)", "value": "ae01ecf63074c35c4acdf0724b3ab876fc2ffcbb46cefc3ee838b336eabd627865fb6ce02c20dad1dad7209f81ec5db4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176101, "uuid": "a2617260-82da-4f96-85dd-a12f3fbe50f7", "value": "T185A47B6B3650616FF87AC43D6E581D16F524EEE3F2CEC583E4432188C93D9879A841BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176101, "uuid": "9590838f-5c09-4841-a857-538faa10eae0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176101, "uuid": "5088d617-aba0-476d-9bd1-344b50226c5c", "value": "12288:zgiBSdDYggiZJUiCbzHoUGuNOty2rkb2q2ZBQDf+qE:zgiB2BgiZJUzzHorqMyckb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176101, "uuid": "c6d33247-da77-47e5-8d15-496cc6632fdc", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176101, "uuid": "bc730ce7-c5d7-4a51-bc1d-75f5ff660126", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176101, "uuid": "627037f5-a567-4fdf-995c-1dff78550fc9", "value": "abeb86fdec0060ffb80f364cabd30b1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc563cf-f60b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628181293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181293, "uuid": "6bf73006-c7f1-49bb-87f7-49093c1e4069", "comment": "Malware payload (Dridex)", "value": "29f17d13233f545328e693f4683fb59a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181293, "uuid": "ff08f7a0-7377-49db-83b4-eed76a1154dc", "comment": "Malware payload (Dridex)", "value": "2d8fc4056652b882deea6ea1a27a26c8a28db2dca49b9c647c940fd787b8e556", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181293, "uuid": "454bcb99-c71e-4337-be90-90c114c67f53", "comment": "Malware payload (Dridex)", "value": "a18c4e6bb2e31886be652b74a86ac95c35bce7f7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181293, "uuid": "43f4081d-e7ff-4909-af33-a551b3c0c47f", "comment": "Malware payload (Dridex)", "value": "bf3e9e6fb1e451fb2bb4a090a32c156db7c1cfe886c0ed0c25bca5846668482367ce0ac78f7c2414f0f47602f22fed4d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181293, "uuid": "b8f5e603-d97b-4c94-aad2-659ade26daed", "value": "T13F04D042E3CE23D1DC97B43248FC262924F05444D85ADCFEC995EBACD7E1F574A64A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181293, "uuid": "070cd925-cbf6-42e0-8bdc-88b2d3d0d124", "value": "6eb7ecc6c2e948f718b1179f888ea193", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181293, "uuid": "1feb1deb-7b84-4d36-afbe-bd22c9cbcc7b", "value": "3072:jcYhzpn9z75jWpmrL3gA99hXkKsorn+AOr4R9jvaT:jcIntom33RDvn+Rrmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628181293, "uuid": "3b3d4675-f19f-4781-904d-ec81a127ca9e", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628181293, "uuid": "4b4453d2-5879-4268-942e-b042462693b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181293, "uuid": "16e4c566-1f3b-4973-a451-9839a8f2ebe7", "value": "SS3Ae1IlpvzP.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf28c228-f5e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1628163575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163575, "uuid": "d4d6859f-2cda-4c7c-bb30-2e8bec9da007", "comment": "Malware payload (AveMariaRAT)", "value": "67e1ec1c8b18a93fc4022716f7d16ebe", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163575, "uuid": "6104571c-5ac6-4ace-9513-b3654fc42e39", "comment": "Malware payload (AveMariaRAT)", "value": "2e10481c61f217bbc42147262a054dd570c58a083ec0d8ea7af36f3a0cd4c3c6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163575, "uuid": "86d877bd-5200-4e0c-bf11-d9a8e38162c6", "comment": "Malware payload (AveMariaRAT)", "value": "bea08342d10db26289faf456e38154ef267abf90", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163575, "uuid": "d576f373-2b93-4a5a-979b-5b3dbf5c63bd", "comment": "Malware payload (AveMariaRAT)", "value": "5ccbbb3537d3e2409da66857366390f61c6d22cd5a7ddd39c1733a96c585dc8e091cf0cbf12e5009321fb479f087328c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163575, "uuid": "c0bc19ca-e91f-4032-aa8e-5fa171cac8f2", "value": "T1D915B42115EBC049F3E676F60BD6A4FE67BDFD232909E0BA3561364642259C28E0373D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163575, "uuid": "d9b6ad07-ab74-40ab-acbf-d89565ca7f56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163575, "uuid": "558af04b-5cb7-45c3-a38f-ed4e1be4ec36", "value": "24576:GoR6qg7RE2aDrR3SDuyFky93/nIxmbZv9vr:ls+2aDrR3SDu299/IwbFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163575, "uuid": "8686ca06-b076-4b6c-af51-66e34bc8ad28", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163575, "uuid": "a59a4e03-04f0-4c12-a8c4-d4321a6acfd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163575, "uuid": "6e90d5e3-a386-4d08-b7c8-f10e51ec0a6b", "value": "THANH NGUYEN TECHNOLOGY (VIETNAM) - INQUIRY LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef654f47-f612-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628184675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628184675, "uuid": "7e5c5147-51f1-4081-936e-d23696a7df67", "comment": "Malware payload (AsyncRAT)", "value": "d405d6fb211a31946fdf6412516e2b30", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628184675, "uuid": "60bd390c-5781-4225-af3c-98bdb810ceb4", "comment": "Malware payload (AsyncRAT)", "value": "2ef729f2dea49ea7657c932812b60491b78316dec488ea605bd911cf4f0f80d5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628184675, "uuid": "bd7b30b0-37da-402c-b1b3-f6840a68ce30", "comment": "Malware payload (AsyncRAT)", "value": "19a45603e266b4f57250766e8dc2c8303ffb93b7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628184675, "uuid": "9a9aa6f5-888a-4eec-8097-d6b5970bb578", "comment": "Malware payload (AsyncRAT)", "value": "ef796cb9234f8b39460a3b96e0fcdcd8cc58806199e8b2e3839615287547274f49b72f47863a203577995c22713305b2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628184675, "uuid": "24cb9a5b-3773-4d1e-b311-dab414700614", "value": "T1DDF44A2229EF158DF3B29B764FC4F8BF5AEAE573570AB0B638910B464322940CD51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628184675, "uuid": "7c79a5c5-51ca-4dde-8ab1-afbffc18af2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628184675, "uuid": "3af16640-c990-48fe-be25-1e47ba421374", "value": "12288:TSoR65AXwgFvuSS2sg6EtOsB9uYhFbg0tClyzxADFr/o+e9JeLDm5Lc3:2oR6qgy62B9XFbg0tcKMFbo0LDm5A3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628184675, "uuid": "955b54ab-1b40-493d-a44b-cd6e0e29a4ac", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628184675, "uuid": "f912603d-efdb-4744-bcc2-23d169c71038", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628184675, "uuid": "0ecf53cb-b96d-4ad2-a705-f135b209ed23", "value": "Confirmation transfer note Mt103-Ref#00126170.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7326d6cb-f5f4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628171581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171581, "uuid": "a7aae294-2653-458b-bb25-1ee5b508b1f2", "comment": "Malware payload (AgentTesla)", "value": "ce2839d5810389d04aeb47e616072cfc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171581, "uuid": "3b1de07a-8338-481e-9be6-843444d2823b", "comment": "Malware payload (AgentTesla)", "value": "2f37d734919c8770d17cb857e98dccabc65ba1255ead57bfa1623fc7895a9274", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171581, "uuid": "59e0f3c2-c976-47e0-89a3-e503863ea96b", "comment": "Malware payload (AgentTesla)", "value": "3eca169accdc343cba392c2e2ccc8586fc969e68", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171581, "uuid": "191975ef-16bc-4133-ab52-cc2831aac48e", "comment": "Malware payload (AgentTesla)", "value": "81fd95b1c1b642ed67ff938cee011f947de9665efebfc96df31aeacd6350b580458ba184c7d830f5d8eef15f13cf6ae7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171581, "uuid": "529c9d10-a9b2-476c-844a-5e581fb3a426", "value": "T19A32B0C8DF1DA28EDB770633972B43B17BB8D24D09D1AA075C50D4940EA4AB51F63B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171581, "uuid": "1d12083e-0fe7-41e9-9643-0f5f2ad197a2", "value": "192:j7XqGltslZUYQ8RgFHsFX4VQGDQ5WdbFWC7e1AciasRuWOHY9fZ5w:jxmLdQ8aSFX03zkCiSascWOku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628171581, "uuid": "eaeffcc9-5a4a-482a-bcae-43cdff5a3e14", "value": 11212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628171581, "uuid": "26ae7bd7-e5eb-42e9-8c70-5ae4bf84050b", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171581, "uuid": "44cbe0d5-fbb8-4ef8-ba54-ab5c259f0b1d", "value": "bonas.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561b9489-f5aa-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628139750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139750, "uuid": "27f386f0-bf28-4709-87cf-0a47995fc9b9", "comment": "Malware payload (Formbook)", "value": "748646de2a6f09e35e043eefca32c6b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139750, "uuid": "403f2191-975b-406e-aecf-eecc1d7f2f21", "comment": "Malware payload (Formbook)", "value": "30c70e6852155344b71c74dc919b365847a12ef299cda58501051f706e7bbbf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139750, "uuid": "c86e56fa-f548-4bb0-ac8e-894d16c5fdc0", "comment": "Malware payload (Formbook)", "value": "0ba5a84af8177a4300bbb7f5be53c6401743a2b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139750, "uuid": "efbc7af1-81bf-4763-942a-2bd25316cb70", "comment": "Malware payload (Formbook)", "value": "00b318aedb17b5979335b16462a7a64b22df1363a65a27ff5eb7ddabfce2c8b9657a47dc1f1618c4eca38942d140dc8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139750, "uuid": "10437e5d-c2a1-4779-bfdb-3d3ba1ba2736", "value": "T19715285F6AEB008CF7E69E75CFC4B4EE455AE5E3160AA0B538C60645C7E19F08B1073A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139750, "uuid": "33989a0d-4580-4f54-baed-20585bd2a78e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139750, "uuid": "11874670-ed9c-4f7c-9849-e53ee2a4df8d", "value": "12288:zmjdtAfZJoR65AXwgFvuSSUIomtXFu4wM2t3fEEIVwT4XBlm6tE1wJyafwLut:doR6qgcmhF4/3gSkXBlctafc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628139750, "uuid": "669d1b22-dd61-4dc1-b402-d11b602ab53f", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628139750, "uuid": "b470f390-57eb-408e-aee3-8bfc290db764", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139750, "uuid": "e81b21ce-3713-489c-823b-7277e2ab5879", "value": "MR# RFx 21-2035021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df076c13-f5d1-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628156730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156730, "uuid": "a9941e04-84b9-4d1e-a02a-0e128b3a6532", "comment": "Malware payload", "value": "bb1c9ee4cbf5420cab22a1e7d99a7b26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156730, "uuid": "2fe51198-a961-4a11-b052-c1f788c8065d", "comment": "Malware payload", "value": "30cb921e390d2803e09b9539c667392add61365ecd0d3ff6dd1f2641884891d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156730, "uuid": "745954a7-a394-4739-883e-01a6de399f2a", "comment": "Malware payload", "value": "a6160ec79741e60910b6f5644db9b6213cc82a59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156730, "uuid": "1a0a4a26-26f9-4b5b-b810-5ce32d6e0178", "comment": "Malware payload", "value": "c40e8a097aaf9606d360e2a9970c0c362d07b801991391df8e25e8d88063658562ee17e25700596afd654967579067ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156730, "uuid": "cdc4eb96-61d4-43d0-86d4-9f0cdba16740", "value": "T112E47E2BF8E49831C10368B44DA5EEBCAC1EBEE15D2954B723F43A5D9B74A8035160DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156730, "uuid": "fe652350-4b1e-473a-8506-ef5dcc93ce4d", "value": "f1f21c88e9cb261ec581191bb4c538e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156730, "uuid": "02705d49-f642-459e-92bc-f5e1a64b5298", "value": "12288:cLJ8IaEF3CbhMemzpeVhpEj7c0DFtImnuG9:cLJRaElQMePyNtIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628156730, "uuid": "91a9865f-50ea-453b-a41d-7a3c4531e099", "value": 707074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628156730, "uuid": "0767b473-a955-4a97-8da4-3a955964419c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156730, "uuid": "7cdb1e6f-27e7-4d99-8bb8-039948b56864", "value": "BL-INVOICE SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6ff0b7-f621-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628190954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628190954, "uuid": "62b14804-1012-4a91-be5d-3a2660233fb2", "comment": "Malware payload (RaccoonStealer)", "value": "9d608f62f2130e8f70e24ddacc86a141", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628190954, "uuid": "ce63cb25-85ae-4759-a3a9-cd8ced95b237", "comment": "Malware payload (RaccoonStealer)", "value": "3117e765891dbd1bcbb36e186b76f3da40777afc9f09448f78588aac63230fbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628190954, "uuid": "0ad35305-ff8c-4697-b654-b1fff5e2dc8c", "comment": "Malware payload (RaccoonStealer)", "value": "27a803533583b60bd7d4c1e006278179376f8198", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628190954, "uuid": "31468a72-2569-45e0-857f-d7797f7bae64", "comment": "Malware payload (RaccoonStealer)", "value": "fe0e63cf033581d3b8143a37277483baa6da724ccd3f5b1f8986c3eca4b56e8637c8c1dd5b44afcef7fc902745a5deca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628190954, "uuid": "a5c027c5-414c-4d5c-ba6e-631df88a6deb", "value": "T1DBA41240BA00DD36F16134F468A6C75266ABFD50CB3C8A07BA1A235E3F631D16E7D366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628190954, "uuid": "34a98a1d-6368-46b7-b5dc-2911930e6c8a", "value": "6809132c99c8b7d8b68eb68186d7f67f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628190954, "uuid": "c758b256-5dcc-4253-adef-dfd066276b11", "value": "12288:aJRd7NcK+wcYcwEEEfdB6huIShSjRejYL:kSK+u5Efn6whSkjYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628190954, "uuid": "6b56b5bc-36f6-44e5-8251-880ec7964d5a", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628190954, "uuid": "fdfba715-5154-4d3c-ab84-9dae738c7cdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628190954, "uuid": "95b99d96-cc85-43af-bd9e-37e8639e62bc", "value": "9d608f62f2130e8f70e24ddacc86a141.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b44fb0a-f619-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628187379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187379, "uuid": "e2e8e778-9b24-44f1-a9ea-9051d5076f1b", "comment": "Malware payload", "value": "eb064b310c1d0e526a54b0ed99a95a12", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187379, "uuid": "40bb0881-99b0-4726-bb53-72f123d63cca", "comment": "Malware payload", "value": "31564bd50713e63a6d4cb749048f7908b5f7629d2ef950b7240f85d734a32ceb", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187379, "uuid": "ede022c6-8975-4732-98ae-522703596944", "comment": "Malware payload", "value": "7abd4206b8fed743d265f4b388e7b4a0af0ce077", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187379, "uuid": "22a01033-3e4c-42d3-8563-d5d5d321df6b", "comment": "Malware payload", "value": "fbbb5dc710ef3d119d89518a395fcab7f47e0f5b8315127f2f4d243886836f04ccc47bda556feb460cfe5519432a0928", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187379, "uuid": "809d80c1-6bfd-4fe0-882f-7673132ac3b2", "value": "T1BD52FA00ABECC429F1F76F3169E5E2D956B9FB126A47459E18D00F4EFD02A04DD2293C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187379, "uuid": "9528cf0a-5a08-4d1a-8675-b523cdf5aeca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187379, "uuid": "478baaaa-caf3-444a-9c4c-9a1dd3e5e09d", "value": "192:dImJJzuFwG2AAndOTTSaGStyKoxMXJroEr7dzoWJszBp6l+1OFBRNl3fqFaM+D8:dTJzuFjeybXFZ/d8WujkgOFEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187379, "uuid": "8acdddf8-60e7-4ac2-ab1f-3d79b727d684", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187379, "uuid": "5e42ad8e-09fe-46a3-86fc-2500c9e8efbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187379, "uuid": "afdfce93-d2ea-44eb-a69a-a9e6692984f9", "value": "31564bd50713e63a6d4cb749048f7908b5f7629d2ef950b7240f85d734a32ceb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063471a4-f5f2-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628170539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170539, "uuid": "3bb8e2d3-4684-429e-990a-214c495b9e30", "comment": "Malware payload", "value": "36a45d2a7f17103ea27d6d3c7f07f6e7", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170539, "uuid": "6e61137c-3b32-4cf5-802f-d9d8df8f6f3b", "comment": "Malware payload", "value": "32191c55ba487fff6e0c8daa7cc0e75143d8bb8ef55f6e6a5a0cfed8d4a5ee92", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170539, "uuid": "0545352c-8c33-420a-a094-3527e4e7d2e2", "comment": "Malware payload", "value": "e4fd69343138a7aa48b4956cd1b25c03cf30b508", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170539, "uuid": "1b12e6b7-3bc9-4286-8ff6-adc3b248b08f", "comment": "Malware payload", "value": "2cd6b2f1298dc8743b446cebf64a98fa3b7960bda2c4679480f93bf88d8db1cf3d8b010c525873c0f8ea7cbff2a2ae95", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170539, "uuid": "08d00333-ba78-492e-b67a-e96351d81ee3", "value": "T12B45232E7DE04B5FE9C504B80443CB29BA6CDD492590DBAF13B83714227533A67D36AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170539, "uuid": "3961b2f7-ae00-4c8c-8396-6b10e4ce71c9", "value": "24576:Q/FADwwjFokD/AR5zkaOqvWnYig8DyrzsVpIoGqJ9DmDHDt06eQGukja1e2:Q/FADUkD/0KaZWnYi7D7VmoZiDpYee2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628170539, "uuid": "9b2730db-d534-4419-b1c2-460e9b735d49", "value": 1277880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628170539, "uuid": "c9804c1b-11ee-4147-809e-39716246e035", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170539, "uuid": "6bc1805f-d5c1-4348-95c6-6638a335e9bc", "value": "56INV PL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3e0321-f5e8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1628166659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166659, "uuid": "4029d2de-7629-431a-806e-856b76501621", "comment": "Malware payload (Adware.FileTour)", "value": "a625ba3207c1c553e19d8796e5d1467f", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166659, "uuid": "adbfd0e2-8494-406e-8542-18b1c8633492", "comment": "Malware payload (Adware.FileTour)", "value": "3221c7c857b80fab3818cf1ea9435cef9626d84bd308d7a365e4e5089e5ef413", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166659, "uuid": "d422bf76-b53a-4dc5-bfde-3e40dd748d91", "comment": "Malware payload (Adware.FileTour)", "value": "698b29225121755a24c31d0b9fcac08c04d81a63", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166659, "uuid": "c5a20d35-78dc-4fe5-9873-9049da473520", "comment": "Malware payload (Adware.FileTour)", "value": "ca2e5485fda2d3c81f0d3f8f087ae0e3327a303cf5bfdabb5e511c2d330121a3b69c883d7b1170429fb9ec6b5afbc8b0", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166659, "uuid": "3774d927-ff81-40f5-9daa-e999d4187323", "value": "T169A63340B8E45DF5D1B2193008216F58A9BDBC2669158E8F6BDC06ED4E221C1EA73FF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166659, "uuid": "ef6e6120-6d3f-4108-836e-7fcdc7cc51c1", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166659, "uuid": "70639b64-4e6c-41e3-bd6c-b8c56073da7d", "value": "196608:UAE5DjxH45GZo+ppolBFKlCMSQATPe/Tt:9E5Dj2G2+oqSQEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628166659, "uuid": "62d13be3-b385-4f59-99de-5a13dda45ea1", "value": 9583687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628166659, "uuid": "c31bd773-6b12-44a6-92bf-2d9e97603788", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166659, "uuid": "814d28dc-2644-4d11-a20b-e0394636a8a7", "value": "a625ba3207c1c553e19d8796e5d1467f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f962c4-f5f1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628170511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170511, "uuid": "00d9f281-8ade-4b95-9b2c-28a2baddb2ea", "comment": "Malware payload (Loki)", "value": "c2b1685b5e9b13acce9943d22088082b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170511, "uuid": "fcccf779-a3d1-4639-8701-d22740d78f7f", "comment": "Malware payload (Loki)", "value": "339c8dadf233a39452a1cc590962ec52df9bff9e19e8697d78c98afd510d206f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170511, "uuid": "fc60517a-811d-4b36-9b67-2d5d7d7836f7", "comment": "Malware payload (Loki)", "value": "106ed53e2f9c273a7bba8adc0efc5993af07acfb", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170511, "uuid": "85069ccf-2ca7-482a-ac36-e086cf1da669", "comment": "Malware payload (Loki)", "value": "516ad430f64e23488911f22a71a177b19bfb94ec5fdedde5baedd52749179542be8a5c9402fb54f5769f1a2d733e53aa", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170511, "uuid": "4500be2e-c78d-4030-aeb6-97a4aade1d2d", "value": "T15D5512A228AD5DCFC3C6B5B8C40A98D4092D9E28C92EC1679E2F7D3739B1E5951473F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170511, "uuid": "4403874a-341b-4941-b625-9bf4959d5b01", "value": "24576:1haHQX5+9JHcAi0ocIa+OV/PyzwrgQKf8Bhny03ANytcF6WWl7H+0C7WjR4h:1hawIJ8XfcIbOVyzACf2nn8ytcF6B5HG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628170511, "uuid": "aa3d89f2-a557-4c70-b519-8a052d211426", "value": 1286144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628170511, "uuid": "2878f72b-2600-410f-bb8d-4cbbeea728d5", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170511, "uuid": "575e2f96-6010-4059-812f-084e64f96032", "value": "systemNew.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b03d5f6-f5fc-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628175030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175030, "uuid": "2f67492a-8f11-4b05-8bdd-ebb4ee9df5bd", "comment": "Malware payload", "value": "051a0f05a8b632ad3e5e3a477f0e47e5", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175030, "uuid": "b56847e1-fc73-440a-bc49-130f3b44e3fc", "comment": "Malware payload", "value": "356adbf7f0829dd94a1fe3ac2e5fa29d0055dddd3d9b026695987381b9c306d5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175030, "uuid": "9316495f-68a7-413a-8bae-a68f21594b2a", "comment": "Malware payload", "value": "8f3931913e1502d0d0513f4521cf6461bcfdb9a2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175030, "uuid": "9c58721f-a08b-4f1b-8736-137dd3e6795e", "comment": "Malware payload", "value": "22ac00fa5b5418c64b00bebeb53e502c459e6271de9df4851d8bfe0811b251a918c3a9e664c3314b38d76ee5f8226149", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175030, "uuid": "f4125c17-dc97-41ae-ab3c-0affbe590f8d", "value": "T1BB3341A9B90A86C64E19B1D7549E70ADC7B0CEF55874B4A0BB30C5CF2B2037667C429F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175030, "uuid": "49529e57-3684-46f9-a174-0ce6535e6a5d", "value": "768:9W9bnqnGig10kkoK4Iq8bcWyI9uC4gJMR7NQU2kZF62R757zaismCLS:9W9bqG1Tkcbj+mRQUhxRnCLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628175030, "uuid": "77702c00-9141-48b1-9690-d9e2b74dfdf0", "value": 54122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628175030, "uuid": "ab672aa2-43a0-49c7-be69-719176188be4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175030, "uuid": "9caef16b-5c1e-40f1-88d1-de12a3c2b252", "value": "Factura__Pdf__Electr\u00f3nica__2021__02__FSJCTERIAOJQHSDWCLZJXFSJELAHHADDJASDHKLZJ.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6cc75c-f616-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1628186039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628186039, "uuid": "da47fb64-b17c-4d18-b94a-cfb7b6f4e172", "comment": "Malware payload (TrickBot)", "value": "c78794773a20cbfee3e12d8c60251599", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sat3", "colour": "#556EAB", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628186039, "uuid": "df4f2abd-7f30-447a-b284-a528e3f5ecd6", "comment": "Malware payload (TrickBot)", "value": "367cd9c4f987db35c45539316388a22110adff7b0d0e51f63ceb4034a0037bfb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sat3", "colour": "#556EAB", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628186039, "uuid": "4d1bba3a-88fa-4658-93f8-c265b71a0c9c", "comment": "Malware payload (TrickBot)", "value": "5dcdc624d060a0042f69015c7950d2ae9d96544b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sat3", "colour": "#556EAB", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628186039, "uuid": "23ffa9fb-e99d-4262-bf42-1e8e58f6e654", "comment": "Malware payload (TrickBot)", "value": "735476f806efc62920d528637134638ed74c32bd0cea2f21679db5e08d82d6392abba9fedae374c5f92055e16a75b79c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sat3", "colour": "#556EAB", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628186039, "uuid": "512574f4-54db-42ff-87ae-4a63b87f26fe", "value": "T172F48B3371958073DC6A2574F92D277872E9AD604B7B8AC7D3C32A9E28F56C1C83560E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628186039, "uuid": "099d4622-b187-41ee-807e-195c76e80b33", "value": "c58acd1a7324d600ff8070fca15fb4ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628186039, "uuid": "aeff15b7-bc58-41e1-af47-7c39b8ed2351", "value": "12288:hDDAkNIAa/wqt/Lzh5qRUPH4WM8nYryvTHMPDsKREXBbW:RPKt/RN4fpuHMPYKRUBbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628186039, "uuid": "882e1ed7-64ed-498e-9d80-e42158d95e98", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628186039, "uuid": "d61d4242-4def-4cfc-900a-582b5af4929b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628186039, "uuid": "30fef25c-232b-4e76-998f-1d5bc47be74a", "value": "0.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573c2c86-f5ff-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628176259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176259, "uuid": "638eb283-55bb-46d7-a2cb-a0ac4d197587", "comment": "Malware payload (Formbook)", "value": "24bab0423c662cbf0c24982fd53caac3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176259, "uuid": "ee47271a-4fee-461b-a3d2-f396c6f96c15", "comment": "Malware payload (Formbook)", "value": "368b6977de3879f6399b1199a740aea7457cbdc53aac44823d3d3f704fac1d7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176259, "uuid": "7eacb332-de7f-46a8-9be9-8442224360a8", "comment": "Malware payload (Formbook)", "value": "444f89bd061afebc4b9bc6241def6de825bf32d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176259, "uuid": "2548a26c-b437-40ae-b9c3-67fd33e3581b", "comment": "Malware payload (Formbook)", "value": "44c44bf89b1d2d8fcce5a0a7202d864e11c962b4e3b7c7d396728b648ae4fbe57384e7aad4fa0814472dbfb5651fbeff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176259, "uuid": "6dc151f5-1377-4f97-a18a-e3d405be69ff", "value": "T1DD64F15270C0C0B1D835293185B49BF59A3DFD305E70DEAB67A412BA9FB04E11B3BE66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176259, "uuid": "979a1ea5-d213-4a25-b80a-a286094dc433", "value": "ea8de473df0698dc330fdb95b5eda1f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176259, "uuid": "05dbd42f-bab5-4d0f-89c4-87dca77470f6", "value": "6144:LUH+MbiH2r0uYEVnjl/VQKRZqiwUya3e+QqocTob+PTWJGrR:L++MbijEVjl/HTqiwVapjoaKJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176259, "uuid": "c2333238-d527-466e-bab3-26bbc4fa6076", "value": 318061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176259, "uuid": "faafc3ee-367c-4378-b2a0-03f7b96d8393", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176259, "uuid": "50e46b82-710d-4d2a-b6f1-99ec80740515", "value": "24bab0423c662cbf0c24982fd53caac3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b13d531-f609-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628180507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628180507, "uuid": "3e3f1bb9-2bb3-4e47-a513-e1a1f5e49259", "comment": "Malware payload", "value": "5c8b1b0d88414006b7fe036730c95e9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628180507, "uuid": "896e5627-2721-4314-a3db-6fdc486b37fc", "comment": "Malware payload", "value": "36b9146fd7d45954b83a4da982270bc9274240acf44a683ef71e7387f784053a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628180507, "uuid": "f887a242-aab4-4a22-97a8-7ab3b13a65f2", "comment": "Malware payload", "value": "085a18cd475c4d8a4f0320b06e4c994ca6bc6124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628180507, "uuid": "c49b4ac9-8e77-4ff7-b19f-e1b25ad8ca27", "comment": "Malware payload", "value": "d3f99855dd7ea5c6da08ed32486f201a0883455e9e1217c9c034a6c469bd1af3e5ff92c0cda514abb69827db903ec65e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628180507, "uuid": "c501afff-800b-4e93-b22c-d1099615e41a", "value": "T11195E02229EF154EF3B39B760FC4F8BE56EAE673571AB0F638910B4543229408D61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628180507, "uuid": "57d6e13b-e3aa-49b3-a88c-1d14af9aa362", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628180507, "uuid": "05dd2748-94c5-4574-b7fd-19d08ce3c47d", "value": "49152:usmjhY2ZyBf1wGWXMvyzBLR4Crmoi2ivr+f1U+mRjDyW:gjhYAyVOGWXM6zBLR3LOr+f1UVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628180507, "uuid": "d49471be-c94c-4e3b-b723-27592be50625", "value": 1985536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628180507, "uuid": "ab82de33-706e-4cf1-bcfa-fcf3a2ec7f19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628180507, "uuid": "e8074cee-96c6-4b22-be28-108a1a7a9cc3", "value": "securebagzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29db845a-f5cf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (FickerStealer)", "timestamp": 1628155567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155567, "uuid": "6dcb62b5-3417-4d12-b089-3a8ea1128a91", "comment": "Malware payload (FickerStealer)", "value": "8c4eed6cc282b95bf2f9111ec302b0ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155567, "uuid": "99ebbac8-2f64-4950-bd4b-cb69c8aa87bb", "comment": "Malware payload (FickerStealer)", "value": "3721f9d79d516bd3a1d702d080188e0474a965d66677e1645bce6bc318e238ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155567, "uuid": "75d66996-b6eb-485e-bb9e-e34bcf3d405d", "comment": "Malware payload (FickerStealer)", "value": "f35fb25553e275650ffed48d3c14928ab0672c1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155567, "uuid": "ac852e6e-9fb0-446b-b52a-ecc299e1eda1", "comment": "Malware payload (FickerStealer)", "value": "23969090985e534547745465362faa0d60c6307da95f761cbbb4d17d01365acc0ca4b3cf8974f2351343bb5273cde8de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155567, "uuid": "cca001d0-b8cf-45b6-a9bb-240d879f5ebc", "value": "T1ECA48D2064E81D2AFE46227C48AB8356A73E3DF15D32C7D36A366575CF532C3E9A4342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155567, "uuid": "446e5ec8-136e-41bd-8a8c-01600537705d", "value": "e905b204d022a4a3f9803ba3895bcbd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155567, "uuid": "10a17179-0527-4300-a739-a4a407638ab3", "value": "12288:hXmr/ivI/koLcGnrovCNpdE9fA8XaW0rN3:hXmCA/rovWw9ff63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628155567, "uuid": "64a57e40-ba01-4a55-97a4-03ca73d16053", "value": 479756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628155567, "uuid": "ab409849-faaf-41b1-865a-0949f91d9622", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155567, "uuid": "f90f65c4-478f-4385-bfd9-e239258aa1ff", "value": "8c4eed6cc282b95bf2f9111ec302b0ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7598d191-f5f4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628171585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171585, "uuid": "cf2be523-420a-46c7-8034-0baea7db5e56", "comment": "Malware payload (AsyncRAT)", "value": "b0937a4994e3d31632fde2de2fb8cff1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171585, "uuid": "52161f3a-ad59-4342-8c54-72f8cff361df", "comment": "Malware payload (AsyncRAT)", "value": "376abcc92dd2e830a9192168264c0f58f01c22127bc148bc612440edab76b808", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171585, "uuid": "49011f2c-cba4-4007-863c-8fd6195d7c8b", "comment": "Malware payload (AsyncRAT)", "value": "166020664160c8f35f383ed849c4acf18879dd55", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171585, "uuid": "8356410e-1a8a-47f0-85da-f98491a42544", "comment": "Malware payload (AsyncRAT)", "value": "5115285d239e1cf6042bf6fc18e43bdf5f1bf4529dfde8deb54655098e4a086f4ee353529791a0d5dca798614851efb6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171585, "uuid": "42ecc292-7702-4452-a0d0-60459f3e4848", "value": "T12801999284DD62C8E3D0CADF45F88815E853B3066219343E14E6471F9807AC3138FCAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171585, "uuid": "641d37e9-6480-4058-a643-f9645e11cb11", "value": "12:X5AgSRYWo15T0Bnk+/9+iM9+DOOyv24uxz9+vM7ITkSSsaVz:J++t54h1hMpOS2a9TPSsaVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628171585, "uuid": "c1edc900-3d85-4fe1-8c5b-8d8ff3120fc6", "value": 662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628171585, "uuid": "a27e921c-812e-4b03-ad4f-62cf516cbf8e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171585, "uuid": "b0ba88b7-5c41-4cc9-bab5-f3818d677af0", "value": "ALXP506.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef093427-f5fe-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628176084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176084, "uuid": "615fe660-e1cf-4e4a-89f4-3b4f88304417", "comment": "Malware payload (Loki)", "value": "b412a5034fe0386f138c5e9064643d17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176084, "uuid": "aff2648f-7912-42a3-aee5-498ed56348f1", "comment": "Malware payload (Loki)", "value": "38fa7af4a9c0cb9102017ef9b666fa74604f6d54416575f59db506106941b85d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176084, "uuid": "25985204-7fd2-4734-b1fc-786ac7aea7e6", "comment": "Malware payload (Loki)", "value": "f97d5ac514730939461919721535c94468787839", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176084, "uuid": "ec5e34b2-84be-4ca9-9a67-40105ae267eb", "comment": "Malware payload (Loki)", "value": "1b19eaedf4f8f4c6bfae9fcde0e2280a087e8be0de36856c87745c08c7cede053fa2175941f15cd77365114ba09bcd18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176084, "uuid": "eff4b2f2-e97f-41e5-a94b-7ad6b6593bc0", "value": "T184C4AD2B16E44913F93CC23C2A95D266F138DFC2B1DDDA86ECC76C46D636A9325801BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176084, "uuid": "abf5298a-3700-4389-9f57-60c49d4864e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176084, "uuid": "4e1aafe0-02b5-4042-9936-4e5c7a94cb0d", "value": "12288:HraOH7BLOn7AZId3pVzVz9t2qxA9pCOAE5xoG:LRVL27O6ZlTtH8pxAQxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176084, "uuid": "6aa967e7-bee0-433f-b52b-0e06d1129256", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176084, "uuid": "0365bb5c-3930-4dab-992e-29c3cec5fe8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176084, "uuid": "f1a13357-6f04-423f-bddf-53e0f2e62721", "value": "Factura comercial.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0695bfe8-f5f4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628171399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171399, "uuid": "d74cc490-2904-4791-985c-b5deb4431f3a", "comment": "Malware payload (Loki)", "value": "58d1d92cfaadfc7969d71bc56270555b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171399, "uuid": "82c5c701-734f-45b5-a16d-900a40bc0fc2", "comment": "Malware payload (Loki)", "value": "39f3c234507061d2b99efe08be1b29aeb3d0a0e699c733f5460172e3681b45a8", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171399, "uuid": "be497a44-6851-476f-8ee9-ad4b8915267d", "comment": "Malware payload (Loki)", "value": "f68e5fa35a2b556ff389a3cb27aa78fce485c82e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171399, "uuid": "204d2698-c6c8-4d83-ab69-3018490964b1", "comment": "Malware payload (Loki)", "value": "bb8582b89dd32a46fea6adb64983b5f92b5bb1e69d5e5f3d4bb851c0a587941ee25e09f7dee9f9858265041fe349705a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171399, "uuid": "6c60c540-6a82-4934-b42a-bfafe31a4a57", "value": "T15D451157CC0A6E93D529C3FCBF130DB96B1E560CE99677EB01325E872F601A21D4B06A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171399, "uuid": "4713f4ca-93c7-4e7e-b422-7d6aa4588e40", "value": "24576:cMtl5VGxJGRfBDCqkLF+wceTn3vq27ZXdPoel1LR4xrnw1q4xKOsiTnbIm:djNRZ2VF+wcg3y21NP1l1LKZwAYwiTnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628171399, "uuid": "0c1592fa-7471-4105-a339-8b04fd02946a", "value": 1271866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628171399, "uuid": "3f87907e-51ea-469d-9542-8afd126208be", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171399, "uuid": "07ee5e89-dc29-4866-bd3f-6e2d23627645", "value": "Automated_Payment.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697a54b8-f61b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628188315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188315, "uuid": "47f73c8f-629b-487e-a8d3-6ded859f9dc6", "comment": "Malware payload (Formbook)", "value": "44de2471096289379cf30cef69e2d35f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188315, "uuid": "0fb04676-410f-4e16-9469-4302c06b2797", "comment": "Malware payload (Formbook)", "value": "39f7d2aa6bd4b9aa4854434d59309e3fb16bf91b6b204bfbaa1fc0ad6d452f8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188315, "uuid": "a4c346c4-925e-40a1-be4d-dd34e2aff2d8", "comment": "Malware payload (Formbook)", "value": "6230352078dee3716f6d95eb8cd3a91963e458c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188315, "uuid": "4195c62c-e141-4414-b463-bbd5d6c5ede5", "comment": "Malware payload (Formbook)", "value": "93a68d74b3a5c8e6698060915bb67a803c5150a0a3a6775d566b74366bc6eb226cb210faa1efcad8dc9a0fd496c1ff60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188315, "uuid": "146195eb-c36e-4c5d-b4bb-f0a4580c2630", "value": "T1DF15F1263227A208DC3587F55C24C1B17BBEAC2A926CC6782DC8ED7F7D736B85AD0541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188315, "uuid": "409731e1-e6c8-4243-ab6f-2f4d03efe3d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188315, "uuid": "f55359c0-3747-4075-b8c5-edea912bc114", "value": "24576:NvDBlBPIOBPHmkToc/ia9oFRw+tfkzfRLNJ:5pPDPHXscaLFRwyfWRRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188315, "uuid": "0ae62a35-5bb2-4c58-9300-d91fc6d02116", "value": 924672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188315, "uuid": "c13d6044-2dad-46de-9299-d3f8049daefb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188315, "uuid": "3d784638-0af1-4d4b-843e-03c6b1cc4ced", "value": "44de2471096289379cf30cef69e2d35f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734bb902-f5bd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628147959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147959, "uuid": "336fbf5b-4153-4ddd-ab69-48dd0db4815f", "comment": "Malware payload (AgentTesla)", "value": "033414ac7aaf12fb02a49235a26b0041", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147959, "uuid": "0740b61a-f2df-451a-883f-a122932fab4b", "comment": "Malware payload (AgentTesla)", "value": "3b766f27093b9dda1879bce4686455a5b622a7ca8616179025f44f922ea62c9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147959, "uuid": "4badc624-b3cf-47a2-ac31-82f5fd2547e7", "comment": "Malware payload (AgentTesla)", "value": "cdd54f137928139a45730123c4bcfe7ddae0786b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147959, "uuid": "fb4c9fbf-14c4-489b-aecc-09c39cfa115e", "comment": "Malware payload (AgentTesla)", "value": "163ec8f3e0349e9014c27a00ded8ccf360b6f1690c6481fdcebd26c29480142980495a9d035966e08badcd6c33cd26ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147959, "uuid": "f57766ad-be09-4f52-9d97-32716a1af5c5", "value": "T1F6F4AE6F3640619FE47AC53D5E641D16F524EEE3B2DEC583E48B3048C63E9939A801BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147959, "uuid": "a77a21a2-50ec-47e3-86cd-3449d3d1b40a", "value": "12288:92BYgWi4SouEhvC5VWQgBO6x1rD7HzPI7T8sdcX32icv34ApHZaOxi:9T5SKvC5VWHrXrTaYsd8Bc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628147959, "uuid": "1fef3d82-b0da-4045-813b-996c676f9314", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628147959, "uuid": "899a10ad-7362-4cdd-9ae8-af82bdefd0b7", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147959, "uuid": "e8e072a8-db00-43d0-8141-1e999c273fea", "value": "Quote - TXGU6068670 - MSR , ETH & SYOpdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6ff42f-f60c-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628181881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181881, "uuid": "1473c93f-e04d-4edd-8597-010b905adb94", "comment": "Malware payload", "value": "b9767cc11feac41b87531f5228a80af4", "object_relation": "md5", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181881, "uuid": "a2e838ad-cc44-44c9-a605-eb5a336470c4", "comment": "Malware payload", "value": "3b8358a275d72bcf382de351deaf97693670f35358e9d3036ffeb74cf09918e6", "object_relation": "sha256", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181881, "uuid": "aeb65f75-f7d3-48e0-a636-97a880b93b34", "comment": "Malware payload", "value": "978235dbf3419e21e815e87f2ae774ff96bc3026", "object_relation": "sha1", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181881, "uuid": "14fea144-4d38-4e2e-996d-cc84eab902e1", "comment": "Malware payload", "value": "3e50a6ce9b99116601e3f59f8536a18daa35a9974e5f9895822da95d4a9f80bfb2a521e7b1d2eab7dbbc51f234e31ded", "object_relation": "sha3-384", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181881, "uuid": "deb28968-331c-4cf5-8cff-e2130e73ec6f", "value": "T1E263024E2CDE721E40F011EF18C2F6BDD251E4A62688DFA535196EEB2539F01CF839A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181881, "uuid": "72cc39dc-d83f-41a4-9cb9-d23f36320c60", "value": "1536:EbZqj9ILYjMQfAdmbRyThSUn52UG1J7F91R155abA6N46VAH:39l8sagU5y1Jh9DD5SV46VAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628181881, "uuid": "3e9edbfb-22b7-4e74-a5b5-5fc94d17d0d8", "value": 72233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628181881, "uuid": "2a5a9ea2-3494-4009-9018-f520ef2b04cc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181881, "uuid": "bc44a91b-3933-4c8f-8fb8-0cb8132c509d", "value": "Doc-Inv_1985.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0caa6a01-f5d4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628157665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628157665, "uuid": "c9fe09ee-f326-47c0-95eb-d12b6338b8c8", "comment": "Malware payload (AgentTesla)", "value": "72cac5bead8d08eed862b17bc7eb2ee3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628157665, "uuid": "c1f6e425-e4c6-4806-aac2-ad74bbb9aaa5", "comment": "Malware payload (AgentTesla)", "value": "3ba4fbce96a30b462422510cc8c3b772cf5f171e6968bb704e2465e66b3e8ddb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628157665, "uuid": "c64ab1df-1bf2-40bf-9742-d2b0be1291b4", "comment": "Malware payload (AgentTesla)", "value": "5f43daf1659035db9567b335b7901d3a6a2ecfe3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628157665, "uuid": "93a7761a-a544-458f-bca8-40eae3583389", "comment": "Malware payload (AgentTesla)", "value": "d6f57769a96030a0fd4409da5d8138043f8b71f35e314a89ea3559e52435517cd1768ce46a02532fabe52c729741aefd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628157665, "uuid": "383d7cee-0a99-46b6-846a-19fe364ca851", "value": "T12A157C222AEF154DF3B39B760FC4F8BE5AEAE577570AB0B638910B458322940CD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628157665, "uuid": "fe541725-643b-4c7b-b01e-a89323234546", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628157665, "uuid": "14c2fdf8-2b1b-4be6-a6c4-4a2c18819ec3", "value": "24576:FCooR6qgba6PC2l3Z3cstuzBQoCbO1ciT:uszMqu2oCbO1ciT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628157665, "uuid": "1ed68fa6-d8b7-4e0d-be9c-14df35154204", "value": 896000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628157665, "uuid": "2303a436-884d-4c44-83dc-2d0b34f85482", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628157665, "uuid": "9a6fea01-2e5a-4a74-97fb-a2fb29cf487d", "value": "SecuriteInfo.com.Backdoor.Fynloski.A3.17871.22363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722b3d73-f60a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628181029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181029, "uuid": "4d0b90c4-e01b-494a-95ee-5bdd647fee26", "comment": "Malware payload (Dridex)", "value": "da31a4129a2c936357906ff1003c3286", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181029, "uuid": "91bf9b99-af2e-4059-85d3-b217b3430679", "comment": "Malware payload (Dridex)", "value": "3c20bb376dc29063f3554c6b45f7e2528b70c24d3d4b1916b51d97d05f2e08a2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181029, "uuid": "6309ed90-dded-47ab-922d-a8044b0fcc3d", "comment": "Malware payload (Dridex)", "value": "211b563bf1bcd8b69362d7d57a13c26d32c0a278", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181029, "uuid": "01507eac-959e-41ac-81b1-c94125ca0798", "comment": "Malware payload (Dridex)", "value": "de3ca42d11d4851057faf1b4ab0d1160318ab6eca1d658124fba963ffd75f8bd70dcbd6e0f23f7c8e3a0e628ea62d07c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181029, "uuid": "a0cdd964-82d7-4c63-aca4-8a799123fcd9", "value": "T13C04D042E3CE23D1DC97B43248FC262924F05444D85ADCFEC995EBACD7E1F574A64A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181029, "uuid": "e63730fa-84dd-449f-9363-4cb257ae9039", "value": "6eb7ecc6c2e948f718b1179f888ea193", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181029, "uuid": "96e08abc-fc31-47c5-bf64-675cb1169735", "value": "3072:EcYhzpn9z75jWpmrL3gA99hXkKsorn+AOr4RnjvaT:EcIntom33RDvn+RrAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628181029, "uuid": "fe4143c2-08a8-4bb7-a5d7-93b739a7dfff", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628181029, "uuid": "b59fc6fc-43b2-48a5-9984-b0d10ff5ed99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181029, "uuid": "af7e5035-731b-4adf-af81-41cfc599a43a", "value": "iBvxWPMc5m.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac90914b-f5e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628163947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163947, "uuid": "0aaf4e17-7388-4a09-b96b-41e24d3b3716", "comment": "Malware payload (AgentTesla)", "value": "88c8b690ee47c5a7239262c00d097b22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163947, "uuid": "71f93d77-672b-45bb-be9a-ac961af3814d", "comment": "Malware payload (AgentTesla)", "value": "3d2072884a204169f0dbcd37a690ca9166402f5ff2ad235d2b29f766224514cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163947, "uuid": "834ae0ec-ea6e-4973-a615-d75fe3a111f7", "comment": "Malware payload (AgentTesla)", "value": "105faf6892c9acd3d30607a8acd8c7aab77d66d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163947, "uuid": "a489f16c-6db3-42b8-b544-152875b24677", "comment": "Malware payload (AgentTesla)", "value": "8827189fed7f002eccda1705be50c7e67b7974512ca2aaf6845dbda80d1449564542eb5e49f6d2b97174ef45d4668a7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163947, "uuid": "2e8c85a1-57e4-4653-8bb6-5c35f257161e", "value": "T100B42322065D918FE9D14794602398BA52BE27181BB7383FF2F7C09E9164232FED9947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163947, "uuid": "5149c0ec-ca44-410c-9db2-1ea39f09dc95", "value": "12288:ZLuaBpXZCY9bI+DBR9mR6YrnAbfKyIFaCfhL4nN:ZLPBpJlU+EVnA7caaLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163947, "uuid": "2bed6f2a-0b37-495b-abb6-af8cddf08ad2", "value": 516282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163947, "uuid": "c0f65e53-cd96-4c6b-9bd0-8983fb7d4664", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163947, "uuid": "7283c698-83c9-44bc-be47-56c0e4b1575c", "value": "proforma invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8899b977-f5b9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628146277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146277, "uuid": "e5595a91-8254-458a-a87e-c5c335b5cc9d", "comment": "Malware payload (NanoCore)", "value": "b5e1d4ed4938fbee029e0d8657f0f679", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146277, "uuid": "34f4f28c-3bfd-40be-8f1b-8920f72923ee", "comment": "Malware payload (NanoCore)", "value": "3dc2f97a8feb95f9e7f2b9bfe997297ca48b8d872e52671b5a6bf3c994a6037d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146277, "uuid": "9d91fc14-7774-4e9f-9b0b-ca04575ca19c", "comment": "Malware payload (NanoCore)", "value": "c06e75bb68b7b67fac98bed69a11e269d7e85099", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146277, "uuid": "355fec07-5e85-41b1-8662-c52f0688e17d", "comment": "Malware payload (NanoCore)", "value": "898fc0a36a9ead0bd9bae394dff7c36d17268a4d9426ae6eb2c7c7e8668af0072430ae869202929d163fe087d8644e69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146277, "uuid": "9165bd27-1be0-4e0c-99f0-1a2912892206", "value": "T1B6E4AEAF3650619FE47AC43D5A581D1AF524EEE3F6CFC583E4832048C93D9879A841BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146277, "uuid": "28ee83aa-677a-42e4-acf3-6af840b3d2f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146277, "uuid": "7d24e41c-f7f0-464b-a34b-ba4099fbb040", "value": "12288:mifbH1CJdFjyT7H6SzLGsKAXuIEpQ+s/xz1sROPS9jY+vnJa:RbKq7ancujQ7xzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628146277, "uuid": "6e200f1e-e58f-4ea4-85c9-989a586404b3", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628146277, "uuid": "188814fa-60fa-440a-8804-bf3b7b7543e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146277, "uuid": "d4dcf5b3-b361-4e75-bc13-048f13bad1a8", "value": "c9dafb9e9ed6ad79eae544839267f262.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c996b5-f645-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628206293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628206293, "uuid": "58a01c30-5190-4b52-a275-7ec618ae0587", "comment": "Malware payload (NanoCore)", "value": "f86ef62f427fd85ace9c19986c187f4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628206293, "uuid": "15eac40a-b7af-4dd8-b6b9-e3b839ad4784", "comment": "Malware payload (NanoCore)", "value": "3fa3f8ac6ca4642ffa2c18b709073e70044f769a022003462b14bfea19318665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628206293, "uuid": "6c3fb0a9-c8be-44e0-8250-e3e7afd8c94c", "comment": "Malware payload (NanoCore)", "value": "7565d099d40eead764dbcc0bda362d11c00d45cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628206293, "uuid": "32ec89e9-46a7-40de-a5af-b448d2eaa156", "comment": "Malware payload (NanoCore)", "value": "e28ed554434f2a77d7c08bd6e9ed87136bb890a34485ba6e5d861807323902442bdf4f6bb4565368f7ef602c39f01781", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628206293, "uuid": "e1985db2-a2c0-4124-94e8-04d4381636c3", "value": "T1BD653A9D7650B5DFC867C932CA681C24EA61BC7B431BD207941332ACAA7E59BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628206293, "uuid": "c68c6775-caad-4696-ab76-22a59a2697cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628206293, "uuid": "4e932200-ae4c-4b4f-9f63-55593d81dcd9", "value": "24576:H8Nm9xWhFyP7aX3ydbQ84jZIigAahgakJk6NmRw5h:H8NmUrBnydc84jGrAahgakKPOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628206293, "uuid": "55c60d52-cde5-4812-945c-5e2b1066379a", "value": 1497600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628206293, "uuid": "916b109e-b93b-44ed-b8f5-cc752ea6631a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628206293, "uuid": "6538ebee-b89c-4443-ad58-68cc6724846d", "value": "f86ef62f427fd85ace9c19986c187f4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5996bb3-f5d2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628157090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628157090, "uuid": "091f007d-6478-43d1-b12b-2d0223e1da8a", "comment": "Malware payload (RemcosRAT)", "value": "ea1c39e72ae5c05ccb6caf2d94db2235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628157090, "uuid": "f9c99198-f8cc-41ff-8179-c529defe66c6", "comment": "Malware payload (RemcosRAT)", "value": "40ef0ea8d499ef74760da82a71c8cf548149e01826b62767c75431cc4cdad67f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628157090, "uuid": "09f07616-f854-4ddf-b629-ad5aeecbbec4", "comment": "Malware payload (RemcosRAT)", "value": "3746a3696094d98a4f91103b045b894c38b04d37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628157090, "uuid": "9fe4f41e-9399-4a02-aafa-fbb7d3a56d85", "comment": "Malware payload (RemcosRAT)", "value": "7101cf796989aabb6489b9d3e480ce30cb60927e85b0a50ceed4213d085412ad22c192aee9e2b5672c680da5e2379fd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628157090, "uuid": "e8bad791-f8da-43b4-a330-0c841a3e1ae4", "value": "T18C35AD2229EB158DF3B39B760FC4F8BE56EAE5776B1AB0F638910B454322940CD51336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628157090, "uuid": "7a90f909-5806-42f8-a799-19c4a89a62d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628157090, "uuid": "f87b2182-5b2a-48d8-9e21-2d99073827b4", "value": "24576:CoR6qg50vgAsnYNaKK5eyDA86LvoCPNjJmG0NmV/4Nz:BsFegDm0eyDXQPTzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628157090, "uuid": "e0c473fa-6e4a-49f6-b203-43547d5bd17b", "value": 1086976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628157090, "uuid": "b36fd13d-38d2-4fac-81e9-750544eb10dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628157090, "uuid": "c955fef4-a14e-4ad4-9512-0757879d2971", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c32621-f61b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628188552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188552, "uuid": "fd53bd6e-6da3-40dd-bc62-19673f766923", "comment": "Malware payload (RaccoonStealer)", "value": "fc1540e0d2c2a362f822e713fc8dcd8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188552, "uuid": "56adaffa-0040-4871-90f3-da34e336b2c4", "comment": "Malware payload (RaccoonStealer)", "value": "4124f1b874e8d7b99bf59c36eb9ba36928018299a090e4eaf9dc0141551a8bde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188552, "uuid": "6570e54d-e762-4744-88ab-af0685e37435", "comment": "Malware payload (RaccoonStealer)", "value": "a6d01db9854a9fb20c36bee0868efc15d5700510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188552, "uuid": "8db769e6-df73-4b27-ba77-2c40f46d14ea", "comment": "Malware payload (RaccoonStealer)", "value": "da3947dd6150c59bec3ef10d79399293a3ac829d28b8aaf859be89974dcdece9b7d200d7af1492252be6f1ac535f2481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188552, "uuid": "73c997a5-f621-4b3c-9f91-e25c17fd139e", "value": "T15BA401133680FC37F045BA715916CAB15BABF869C825868B7F869B9E2F313D25B34341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188552, "uuid": "19ac1ad0-d2f3-4db9-b1e8-8e13bd2c0f1c", "value": "5db1361d34b46103924e72350663b6e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188552, "uuid": "1a1185a6-7b95-48c5-80ff-48db86ae0d25", "value": "6144:ArPaq6fENJIvcIEjshBZBWyF8e9N2cgX2V3dQg43taNgAV0mfCtPr5Mu798Hb:ArUMATBNWyqe9NG2J73N10mfiPrPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188552, "uuid": "821f6d83-e517-4ace-809e-38a590e131c1", "value": 493568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188552, "uuid": "a4aac885-3d3d-43d3-834e-51c7438707e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188552, "uuid": "4c79b829-7632-44ac-808c-74cc59b5047a", "value": "fc1540e0d2c2a362f822e713fc8dcd8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750e70b7-f5af-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628141949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141949, "uuid": "3e39dbd6-6fc8-4df5-b5c8-59475013a5c0", "comment": "Malware payload (Formbook)", "value": "fe33711a4b55ee419481ef8e2ae68d7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141949, "uuid": "dbbef89c-d9f8-4405-94c9-a20e4d789c07", "comment": "Malware payload (Formbook)", "value": "41426800f6abacfe11baaa98f532e48b152971d90958016a943e8e0fb7967b9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141949, "uuid": "7c3ec698-52c5-483c-998b-9662afeb43ab", "comment": "Malware payload (Formbook)", "value": "b9cc91a94c5067e1edfe7510d584cb7148299df3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141949, "uuid": "08281f82-b4de-486e-b83a-c6d08818222a", "comment": "Malware payload (Formbook)", "value": "148b3e5e017f4e694b6fecded08be68023332635f0c8781e487716deafcac6d9771c5e8cc589127d96cccc2e06b0f17d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141949, "uuid": "909414cf-b2a0-4546-8f68-1416f1621336", "value": "T14D157B2229EF114DF3B79BB60FC4F4BE46AAE633560EB0F639421B958722940CD51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141949, "uuid": "26ac3f6c-e2ed-4b37-9d9a-0db62c996f8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141949, "uuid": "d6912dc8-e9c7-454a-bc7b-3115f0bcfa67", "value": "12288:RMjUNh0AqZmoR65AXwgFvuSS3IOEcBp+Frsy3550OLjbGxTdWDrkNeC8EqMHa4YH:ztoR6qg9bQsA55/jggDrkNh3Y9Fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628141949, "uuid": "9713b2d9-97ee-40ab-81cb-363f07444b3f", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628141949, "uuid": "28e104a7-06b0-4365-a1bf-18c5a2eb206a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141949, "uuid": "260cc6e3-25f2-425c-a4bb-e2efef7ca53e", "value": "Swift Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77cb918-f5e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628163643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163643, "uuid": "84868db2-ec86-4aa4-b47e-cc74e8b7a1ae", "comment": "Malware payload (AgentTesla)", "value": "504d723f29d22889eeebb6a76671b03e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163643, "uuid": "5c1fe81e-1606-49e7-aea0-bfd1f11f82bf", "comment": "Malware payload (AgentTesla)", "value": "41576a4ea5b8e1d0c9a1ca017e2a5265c1d7ae9e32f2327871e8f9acc6219fa3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163643, "uuid": "e08e8adf-9c45-4b94-8404-52ea4eb46d27", "comment": "Malware payload (AgentTesla)", "value": "72ce1daef4af1ea9c2300cf200334e2d3932ea1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163643, "uuid": "183c695e-0e6f-4e06-8156-5fc5bb15782e", "comment": "Malware payload (AgentTesla)", "value": "59a6f6fbba2c3a8e179fc68749cf1e6bc483cb629c66970f4c4c4ff0056868f548551b8da38e74cb4823739acbc8b786", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163643, "uuid": "eddb69ed-dd74-4440-adf4-a58f404e36c0", "value": "T1B7A412127AE0D875C15978F180A27D30437A6E41C11AE80B9BBDFAF24671F6BCF54A1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163643, "uuid": "b023874d-4a92-4cbf-80bb-9ca8c42f77a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163643, "uuid": "4c1d08c3-c233-4f59-821e-7c7704cf6d92", "value": "6144:DJQkBQomEhkHLpkGBV0Tp7XSunwnVUB/fivO8IhWBt0LQcaFkAnR8:DCkOoPhwLdBV0lLnAAimrwSQvFXR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163643, "uuid": "8a2162b4-7f1e-48a6-8e21-f6788db3423f", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163643, "uuid": "a321e5cd-6660-4ec4-998c-4553251c70d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163643, "uuid": "c75f437b-855d-4306-b754-45574de7a016", "value": "Nr. 21000482.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be7dea6c-f5b5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628144649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144649, "uuid": "28fa68c3-37d3-4c57-a8cd-a0c3325fd778", "comment": "Malware payload (AgentTesla)", "value": "412e00b3cea9dd4d08804d47621f91fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144649, "uuid": "bd31aebb-037c-45b4-ba33-05b335f136cf", "comment": "Malware payload (AgentTesla)", "value": "41583e930d0f0eaaab2c2441655a5f45f77f3a8cf7bcb617b0f3459ae1530d15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144649, "uuid": "1ca24d3f-a2ba-42b2-88c3-d094a76df407", "comment": "Malware payload (AgentTesla)", "value": "f276605eaa18616f7cea8a5b55c93cfc327026bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144649, "uuid": "a73f9807-057d-49ed-91d2-701d1eab5c3e", "comment": "Malware payload (AgentTesla)", "value": "87e982c42e37a56b49bf8bd125398c8d86d82c795869bc88d8ac714ea981433721ef533068bab8de79b5e09c16f42670", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144649, "uuid": "2958d190-331a-43dd-99a8-046d35de9b65", "value": "T12D359C2229EA508DF3B69FB20FD4F8BE4A6AED73561A70B934D11F4397329818D01735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144649, "uuid": "d36627cd-b2be-48b7-acf0-69db80212af7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144649, "uuid": "5760c1b0-5e3c-4192-b105-22505ef10b78", "value": "24576:yo2A4dsjWLhmEcbsJxa1l15L/zV6jq/I/NJKaoy:Fbh9bsil15L/kj7JKly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628144649, "uuid": "558d33d4-7023-49dc-a4d9-304e7e8d0924", "value": 1162752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628144649, "uuid": "51868695-97f7-480a-b531-fdba5d4d7f20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144649, "uuid": "0181e76a-154b-459f-9db2-1bfbdabb110a", "value": "PO #63879JHJDY7T.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712814af-f5f1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628170289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170289, "uuid": "d1d32e42-9583-42ad-85eb-36302c60f3bc", "comment": "Malware payload (AgentTesla)", "value": "9914d25b90b6981c0b163854ab33072c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170289, "uuid": "f79f98c9-fc08-4d78-9907-4973cfa3ac17", "comment": "Malware payload (AgentTesla)", "value": "419478873ce76f1f00d4f8fd00f9f9a3bd7e9007e5c1cf60e4884ce2514df05c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170289, "uuid": "af232b04-56c4-43ed-b0db-8f50cc3d58c0", "comment": "Malware payload (AgentTesla)", "value": "1026303e4a0c8059186093153157dc259fe46776", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170289, "uuid": "2c0507a9-8983-4df3-b1bf-503bcf6f84da", "comment": "Malware payload (AgentTesla)", "value": "aec9183ffba7cf3cb097388efa9d0d2e3f4bf4ce87bfa96197effedfbc10e4d32735a5c8e413903f1adcac791c79f019", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170289, "uuid": "661cf913-d7b8-4422-8acb-6a9284cf2940", "value": "T1B4B3B4BCC08B4698CF86A7F82B0B5E45144C7A6EF789E136753863711BD1C7B810697C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170289, "uuid": "58a5aa74-0575-4ef6-8d95-192a52f2e439", "value": "384:Mk69pMsEp/OIIV+hXLowm8Vrq34/qNyKeteBqr7oN:Mk6w9BvXLXqISgeBqr7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628170289, "uuid": "2bb16d85-2623-4147-8c2a-2eb6000f1c4b", "value": 111345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628170289, "uuid": "c6274a48-3ad4-4521-91cb-255ed845d6e8", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170289, "uuid": "195e4f0e-9eeb-45a6-a407-d6fe5f57b8c2", "value": "\u0e23\u0e32\u0e22\u0e25\u0e30\u0e40\u0e2d\u0e35\u0e22\u0e14\u0e40\u0e1e\u0e34\u0e48\u0e21\u0e40\u0e15\u0e34\u0e21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad407543-f5f1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628170390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170390, "uuid": "d2584c20-dfc6-410f-a367-f221451d863b", "comment": "Malware payload (Formbook)", "value": "c00bb8a6dd6a8961b77abc75bd470c1d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170390, "uuid": "8f554cd7-1f45-4654-8418-d5f43f0204ee", "comment": "Malware payload (Formbook)", "value": "41aa359ecdec67dd6362b8082d3d1fcc37bcca016e8f8b491bdca26a3516a085", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170390, "uuid": "201d17ac-712b-4828-9c3e-b9c3b45914ad", "comment": "Malware payload (Formbook)", "value": "ca2769b84fec7bbbdc059c73510cd165666ccc1f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170390, "uuid": "e3ebecb1-18bc-449f-981e-013938bb5914", "comment": "Malware payload (Formbook)", "value": "b2d5be790bd17b94742c52d1a934e469eb16c88af15a70fc0d38055b57a8a11a639d3d05313cd97a694e5f44c0307b16", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170390, "uuid": "448e5740-cc9c-417c-a94f-622004312283", "value": "T1DC551218ED838DC4EE3BB87A624768026D388D043F3A9796396C778740357B989E1F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170390, "uuid": "3ad248d0-b28a-4363-aad5-b1b840d67e86", "value": "24576:FV4PaQt/LnIp1od84yxct1H1mQm5rOP2dZZsdhuTeOErQPYQCvgWX7z3O/6z:XqntjIp1UVHDm5iP2nZEu6zr1vgI33OM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628170390, "uuid": "7d05d867-064a-468a-921b-3b70e4d24b59", "value": 1315208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628170390, "uuid": "057f1bd8-8211-408d-878e-2fed67fd007c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170390, "uuid": "23963214-a3de-4b94-b400-8c802eced652", "value": "TT-Form-EUR57,890.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff83377-f5e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628163818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163818, "uuid": "9865a78c-40b2-49db-9462-eaaf689b6751", "comment": "Malware payload", "value": "6c99b9417eab7ddd2fd1f0ff5fa108e8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163818, "uuid": "3331ab29-1ab3-4831-af5c-f2da5ef4fd11", "comment": "Malware payload", "value": "41e79e195d4cfc2ef80bb0616c80293fdbe6f1bf09787bc3b4229c4d5f6b7a28", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163818, "uuid": "f2d0ada0-cf01-4e17-bcdc-72316b3d01dc", "comment": "Malware payload", "value": "77b2244e2880dd60b159ecd12759df7091f5d62b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163818, "uuid": "1b7eed39-7735-4797-a3e5-1734fe1aaff1", "comment": "Malware payload", "value": "b6aae38945647301e9a62017c4ff84afb4603ab0cb53e7f4c025d250316f14692ca274882286bf4ee3b8a0e7cd1c4986", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163818, "uuid": "29fbf39a-0fe9-4b97-908c-9dcbda4c69e0", "value": "T1C45423BFF21B081D6F58886ECF7CF4001A357D2116D1986F6A3A77C72B55E0EA029C4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163818, "uuid": "da19752c-3d15-4f38-aece-c31e1642eee1", "value": "6144:izJLUrot1Ll//tiGSe4L5qwZFgWuI13fg1lRNkoopHorP5VJJj:iztRtLj4c2CIdfgbRNkRpHorxVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163818, "uuid": "009d78fd-52f1-4597-a079-081aa7777f04", "value": 289772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163818, "uuid": "b4693613-e908-4177-904e-89462264ca66", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163818, "uuid": "f0e3af93-3e63-42e4-9d98-4d3bb09c2e84", "value": "BANK CONFIRMATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76e8b82-f5e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628163562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163562, "uuid": "f8734f3b-4927-4b42-9fe6-a5ba67e6f07d", "comment": "Malware payload (AgentTesla)", "value": "53856bac9dc0a87158b19a8cccaf2402", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163562, "uuid": "4e6604b2-c8f0-427f-9285-cdcd39534f9c", "comment": "Malware payload (AgentTesla)", "value": "422a90827df8daf7f0a7c17c33951ffc148d5c3d5d992416386399282509f719", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163562, "uuid": "09523680-a033-41ba-9d2f-6fe86bab3a37", "comment": "Malware payload (AgentTesla)", "value": "ef61e02d71f97daf5cbce7e659437942aed2af82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163562, "uuid": "0a9000a4-a943-4e1a-bea4-3dbc9137f161", "comment": "Malware payload (AgentTesla)", "value": "2ba5a458e2073672d97ee59e2d79ae2dee46955f314f841f621f96f79834ec8e8936f0ddaf64d5045f66222969e7d672", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163562, "uuid": "f45da21c-91b6-41df-95b9-0d6aab29dc03", "value": "T181056B2229EB104DF3B3ABB50FD4F8BF45AEEA33561AB0FA395217558722940CD41736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163562, "uuid": "03328aac-f24d-47aa-a03d-8189328488e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163562, "uuid": "9ebfc0e2-75ca-4ac6-9880-0a9b6bc785ec", "value": "12288:fijbLWArZqoR65AXwgFvuSSkIMve/vAXDEjWF8J1bL/hG75APAgOkjbqALE6Grch:UAoR6qgkm/mD7+1g5AYgOkK3gHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163562, "uuid": "6a009441-8bae-4836-be47-8c36f65d9fdd", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163562, "uuid": "2c86c51c-8cbe-403b-900e-44a5177fe043", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163562, "uuid": "4a0e7321-cd25-423d-aeb0-219ca4392993", "value": "RHB_BANK.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e69bc5-f61a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1628187981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187981, "uuid": "8441709b-8149-4955-9507-a8da1923f7fa", "comment": "Malware payload (OskiStealer)", "value": "2d827df1ee25674aac2060c37efa2fe7", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187981, "uuid": "e0c6c9be-712d-4985-94fd-7a79debe92d8", "comment": "Malware payload (OskiStealer)", "value": "436651743894169dc9cd4c7ef01734420a5ce2d6dcaf57825197e0c756feeee9", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187981, "uuid": "09d51473-598b-4d0b-b597-c9562fa0feca", "comment": "Malware payload (OskiStealer)", "value": "c3c6a82ee16f87ebacdd8be47018be38b6c98a27", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187981, "uuid": "7c9bada7-41b3-465f-be90-b2e57e11d723", "comment": "Malware payload (OskiStealer)", "value": "11dd586711cab1e8d9fea751730400b4e1d1e21a4b4b175feffe28db331cb87f49f1333e8dfa4525b2eab198fb74d678", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187981, "uuid": "c5de1f6a-c503-48a9-953c-a25b857d2bba", "value": "T159528D0EE753702DC377A43AC95815F8E51E6061A82A758A3844BB7D68432D753CFBF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187981, "uuid": "2a463fa7-0c98-4063-b7b0-b5c6af94f5e4", "value": "192:c0JgCGIUxP4NydRxeRIaFUlbVvevUqzRdgNi/ciE+c8++4Yj1v9:ZuI04NUgRFUlM9zrSpT8b99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187981, "uuid": "8208c536-d8d1-4281-b0a7-182f72cdabd4", "value": 13243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187981, "uuid": "b308325d-681f-44d4-b3fe-e0a0c9296aa0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187981, "uuid": "fdcf96e2-9e27-4976-b7fd-9c6e69dbc3c1", "value": "fileattached.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cb0bcf-f5f1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628170249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170249, "uuid": "58c1dfec-f42b-4b14-bdf3-d1ac93ed057e", "comment": "Malware payload (Dridex)", "value": "a1854382172275a7816869278a64178a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170249, "uuid": "f86bab0d-8d31-449e-a719-e986ca6b1507", "comment": "Malware payload (Dridex)", "value": "43ef2ed6c4ee2e7bdc2d73dcaa282ab908f8021636c47a0b8be83b6a135029f6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170249, "uuid": "5cb23183-fa1b-442e-a8f4-262e07b9217d", "comment": "Malware payload (Dridex)", "value": "40c8c4e16848e73593359cdb85e93179e1a35cf1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170249, "uuid": "768f1ae1-19de-40fd-9967-6516e6755b0a", "comment": "Malware payload (Dridex)", "value": "b0cbfb2ddf61e8d62b5287a97ee8cd4fa01d2f2387b79e404968302942e267a71226512acb8b38db3e72a7f789e3e888", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170249, "uuid": "7968bfe3-dd90-47fb-b602-caef0a373cc4", "value": "T13E35E0A2A568A9A1C41AF172DC99DE31E3B37C2E56B0100E36D53ADE75F33E100527DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170249, "uuid": "f7eeaace-f3de-4c4a-a741-5ed1de70f033", "value": "f69a7d1376e58df3e6c9906f6c1032c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170249, "uuid": "d8f9d1d0-2637-4741-b9ab-b39d72ded66b", "value": "6144:nK6cyPiWCgknQ/HuyIzuTVzsMM56519p+6yT3LvnH2QDP/ly+VQyMJ82vp:nM+ZdkmHubeaCo6ELfH2A/sUQBJ82vp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628170249, "uuid": "f0b38379-e043-494a-8e6a-81220bb49844", "value": 1138176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628170249, "uuid": "f85bf63d-6b86-40d7-a8ee-66b9948e629e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170249, "uuid": "4de23637-f4f8-4cec-8755-484de9f34531", "value": "a1854382172275a7816869278a64178a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97eab427-f5d0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (FluBot)", "timestamp": 1628156181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156181, "uuid": "7239a415-e137-4121-8cbe-4d6d61ad3055", "comment": "Malware payload (FluBot)", "value": "2455e88ae54546cea448f901dd8127da", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "v4.7", "colour": "#3CF96F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156181, "uuid": "df38a2a7-ef8f-4bde-917c-532eaf368906", "comment": "Malware payload (FluBot)", "value": "44ea6e68941e2f3716ecaa178775d5e81008edc7a969d40c90baf85a862a7a57", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "v4.7", "colour": "#3CF96F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156181, "uuid": "63f07836-bd25-481a-a084-d5c2a63a2f4d", "comment": "Malware payload (FluBot)", "value": "55114bedf297893bc3022414796515e2df79d5ae", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "v4.7", "colour": "#3CF96F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156181, "uuid": "48fabaf7-2c01-46bb-aa71-575bfd721763", "comment": "Malware payload (FluBot)", "value": "1596977bb069975110e7bf7936f248ffcf45bf1693b5a77ca9b2699e9c38f9ddae5f7641714528f601464e93d12d24ef", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "v4.7", "colour": "#3CF96F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156181, "uuid": "00dc3ab5-2d05-4dc3-8704-49a5740a41f9", "value": "T1B3F5220DBFAEF12BD007F1398168E99A540848588988FF4B2B35519C5EFAC44A747FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156181, "uuid": "5d132146-71d0-4eee-918b-e1dddafba53f", "value": "49152:vzsCuCrwYD57Qyr5nsqNz+yBcvPDCkUHXCHvNwu4f3MUyN7AYpDMaSwXZ4cos:vwCdD57QyrKZOcDrjGusyZAWRS+ZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628156181, "uuid": "0eb57012-95a9-4790-9cf5-dfb311055297", "value": 3498944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628156181, "uuid": "38b3552f-d04f-4a4c-86bc-a0e68f5e5ec3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156181, "uuid": "2f0c3b3c-62a7-4de2-bc37-3a93ea49a508", "value": "44ea6e68941e2f3716ecaa178775d5e81008edc7a969d40c90baf85a862a7a57.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5986de-f5ac-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetSupport)", "timestamp": 1628140567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628140567, "uuid": "be885f37-26f0-40c5-b58f-73f866eb2b24", "comment": "Malware payload (NetSupport)", "value": "c82f6b6c65e9617b6af32028c9d9b793", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "PRO SAT SRL", "colour": "#A2A712", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628140567, "uuid": "51f8b369-34bb-43b9-a5b9-8a3259817cfe", "comment": "Malware payload (NetSupport)", "value": "45ff625f17a1e9ad65dd94c376034148d6d8eee8a41b1209f566a907f5d6d6c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "PRO SAT SRL", "colour": "#A2A712", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628140567, "uuid": "9a059cfb-a737-4757-a887-d9ebc4fc52b8", "comment": "Malware payload (NetSupport)", "value": "4a0d251ed5db7ec8bf4f5334d11d0c35549eb4a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "PRO SAT SRL", "colour": "#A2A712", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628140567, "uuid": "89c66ca4-04e3-4077-892f-43a990a77bc7", "comment": "Malware payload (NetSupport)", "value": "79055e9f1513ea9de0e64e7248cfae14ef4e3e639128d6e78fd3a3d9e32eb5b909ac3a7e60b076faf2e8f455522413d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "PRO SAT SRL", "colour": "#A2A712", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628140567, "uuid": "0c9279d9-0bde-4710-9799-fcb053be935b", "value": "T1DAB533735D0C84D6EBD77870F00BE77169767EA20222C4ADA3B6498D923FAC24DB5097", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628140567, "uuid": "1bd9a2df-0ad1-40cf-87ce-e6b8b4a9c670", "value": "77f81ec12eacdb769388a8e410647817", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628140567, "uuid": "2126fce6-60bb-4389-96a5-be8e639ccc61", "value": "49152:reQeN/IirV+a2YCSdZeCP6OYKphcmX90ur7SnkGPgvNLc+:reh/DAa2VcbSOYUqmWurEkGPURc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628140567, "uuid": "faad07ac-d9ba-4b22-9ad9-1ff3fb628416", "value": 2307832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628140567, "uuid": "722b89b5-410b-416d-a189-df19f4f47bcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628140567, "uuid": "1f1bd300-20a5-4a86-b317-c9aebb88c894", "value": "C82F6B6C65E9617B6AF32028C9D9B793.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2c0b0e-f60b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628181346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181346, "uuid": "0e202a41-f7cf-41a5-bd86-58209fc6bf85", "comment": "Malware payload (Dridex)", "value": "ef2d0830916a8acc33402de761c37e79", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181346, "uuid": "d6ad60bf-a140-457b-9b5f-cdf2f366f830", "comment": "Malware payload (Dridex)", "value": "4677f1e144078256d846189d50113fa133ab8b971c9389bc1e302d89ae30dcfc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181346, "uuid": "3f2681c2-4b00-4b35-8781-b749e7555b77", "comment": "Malware payload (Dridex)", "value": "3019bddcfb83e14c081628d42ba9866dddaf4b0f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181346, "uuid": "230c4875-0cda-4fd8-84b7-d9582aff7929", "comment": "Malware payload (Dridex)", "value": "d34986840ec3ef65bd8f59b46b7cffc7acd0e47fd765b5469b45d8455652b5c4a0bf0a26bca22a12d04c0967cd5d1577", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181346, "uuid": "a4c329be-3fb4-4e52-9729-dc3a608c4820", "value": "T1A704D042E3CE23D1DC97B43248FC262924F05444D85ADCFEC995EBACD7E1F574A64A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181346, "uuid": "7f0afc8d-4b65-47dc-8ef7-d264159556b1", "value": "6eb7ecc6c2e948f718b1179f888ea193", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181346, "uuid": "e6b6e583-c42a-4a9e-a84d-6c1fbb4eb29b", "value": "3072:LcYhzpn9z75jWpmrL3gA99hXkKsorn+AOr4RdjvaT:LcIntom33RDvn+Rrmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628181346, "uuid": "70045f70-d513-413c-a9b4-48cdb37f3c51", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628181346, "uuid": "acf75b4d-43e1-48ef-8fae-49a52c79565f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181346, "uuid": "fd67f31c-5d57-4fc8-81cb-1fc04825749d", "value": "JwyqSpxvZCW.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6327bc0c-f5ff-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1628176279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176279, "uuid": "92a92363-2261-4343-9703-a7bd936008d8", "comment": "Malware payload (Smoke Loader)", "value": "0dc17a7930543d9bd7efde343ba4a5a7", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176279, "uuid": "61b35ab7-df58-403e-8a32-71d5fca22bc6", "comment": "Malware payload (Smoke Loader)", "value": "46913d3c837854eaf6e793c2b7cfc401ea00e3defba2bdab2f3b8982598e9903", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176279, "uuid": "bb6e7fda-0107-48d4-bcc6-8fd699cb3df7", "comment": "Malware payload (Smoke Loader)", "value": "0fe5ecaf84d7685237532892f308c071cd0009c9", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176279, "uuid": "c02f3ba1-a099-45fb-a020-962a5fb3795a", "comment": "Malware payload (Smoke Loader)", "value": "1e06125d9d6682c77e316419c8a0c0e5f2c49d6097de93443702c5faf3a9e757b9de05338195d68f987d0fa719fc7727", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176279, "uuid": "cc215441-d189-4f1c-919d-97fcdd0b9efd", "value": "T15414BE1135C0C373F07606708875C6F1AF6ABCB70D269A9B3BB5679E6F222D29E25305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176279, "uuid": "1025856f-59cf-4775-913f-c1734ffd2801", "value": "e905b204d022a4a3f9803ba3895bcbd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176279, "uuid": "bea7b94f-1d15-446a-a6e3-1da5f0a1660d", "value": "3072:0RXK+EckRsiUd0SbW2BbfcHRFP55oK1dFkSumb0hg4K:YpiUd5XdfcxJoAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176279, "uuid": "c0af7c78-5c20-443f-9ae6-13f1defbbe3f", "value": 206848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176279, "uuid": "2d2a8061-f359-4269-ae25-a766ad387c33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176279, "uuid": "d9c2ddfd-faf3-4346-90aa-0e537569004c", "value": "0dc17a7930543d9bd7efde343ba4a5a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b887af99-f5de-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1628162249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628162249, "uuid": "6966865b-f9ba-4cbe-916a-25bd23e25433", "comment": "Malware payload (Gozi)", "value": "d0ee68c983811d7e65059dfe0d6f2a35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628162249, "uuid": "aec11f0b-82c7-4a04-ad97-4fa501e35228", "comment": "Malware payload (Gozi)", "value": "471ece12506f05a08eccbe53fbdaf79dbd67af7dd84976b1f69d1c8efdf9857d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628162249, "uuid": "dc2443a9-9187-42d7-a5bc-fabf8d55c834", "comment": "Malware payload (Gozi)", "value": "d7c66dd1faa8653707d757e21d14d65c751f54a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628162249, "uuid": "e675ac18-b713-4be5-854f-69f866d6a699", "comment": "Malware payload (Gozi)", "value": "b3bdb85ce18eb28ffb4dcb8e08f7f7bc686413a08d60fe590f2e42aa2a9c2cf907e7db0e16a39280ba22be0c23dfa288", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628162249, "uuid": "d0b79ad0-533b-4388-b3df-a81d5b5bdffb", "value": "T14F346D6AE2A50A95FDBBD5B9CD93C617D7F234090A64C34F23B0CB965F43321B218386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628162249, "uuid": "d68c2fbb-ce80-432b-8902-c28b893ef61a", "value": "6144:arezMySF6ymJNNDgq2L4LlcwFhR2hMX/DWEWk4SKFr:arc4FxmJrr2LicwlcMX/DWEWCKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628162249, "uuid": "f7ce50d9-b970-4350-84e4-8125ad39f0fa", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628162249, "uuid": "7d6b6874-ef23-40c0-b5e5-dc020bf31742", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628162249, "uuid": "4888c2e6-d59c-446b-ab07-0348a67dcba9", "value": "22293fc0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ff619c-f5af-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628142051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142051, "uuid": "f7933f6a-dab2-4997-9776-741a94f84450", "comment": "Malware payload (AgentTesla)", "value": "3794526627f434412799c1c770df18a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142051, "uuid": "211b1532-c11f-43b5-8ec6-95755ad4edcc", "comment": "Malware payload (AgentTesla)", "value": "47240e06964716275c84e0afc9379c7bf1e253da8c1cf28c8ead8d5185814cb6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142051, "uuid": "d7ea0d8e-800b-45d3-99f8-c7f8f5ba6eff", "comment": "Malware payload (AgentTesla)", "value": "86639fd1dc21a71b40d61086762b177efaebaafe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142051, "uuid": "994d4df5-d99c-49b0-9a80-6893c2820d96", "comment": "Malware payload (AgentTesla)", "value": "dca6fb29ce3a37b504950e2a7571b08087d612ed4c4709d3c0bd7fc4a71e77ba5958ec44399cd464fcefc5398199ce6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142051, "uuid": "d185448e-f626-42ef-b40d-b4b5c8e5f0b2", "value": "T111E4232BB2A998ABD0206D1C4ED0FE2E492B5197DD1C15498D32C259B66F36FC1CB3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142051, "uuid": "62a7bcc9-2de6-4747-98e7-c58bad716ec3", "value": "12288:c7HvPOgp37OcWyQvrLgJLKFNxqKNh4RGjvbXCLD9i5h6QeQwH0hVnTDilPzrBGrh:c7HvPtrO/yQvfgRKFNxqADPXCLD9ioQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628142051, "uuid": "6661e42a-955a-4aa3-b039-06da51b4901b", "value": 660245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628142051, "uuid": "081b1654-af77-43f0-bff7-269e38b6312a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142051, "uuid": "8398b7d2-4e92-4f0f-9ded-8ffb50565b4b", "value": "70654 SSEBACT.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f6d5cb-f5e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628163670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163670, "uuid": "ada47332-44ab-4841-a6d3-2566d1407d99", "comment": "Malware payload (Formbook)", "value": "0745a91ca11c4c208560564ec24451d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163670, "uuid": "d19c17f4-8ae8-4df9-8170-ada54f523d0e", "comment": "Malware payload (Formbook)", "value": "4796e12d5a33b3b717b0ddc65286b9de7479e86bc91cc0bdb843722a5b62951b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163670, "uuid": "c654b6c5-9efb-4ee3-bebc-cbdd0c155059", "comment": "Malware payload (Formbook)", "value": "cd7d14c1b17841b118e4e1f1fc473612654f2f31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163670, "uuid": "8a807493-a82d-4027-8f03-b697ddf87141", "comment": "Malware payload (Formbook)", "value": "0a2e9769316f78933ec7c4bf1fdc40a07f86255ebe774006dbe6f34b653b2a377f77eecbe129008229a7a858d15d488c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163670, "uuid": "be4099e2-df11-4331-837c-767143d9d6d2", "value": "T1B564F11174C1CA72D5A349315874CA705E3EFE701F602BDBA79829BA0F346C2552AEFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163670, "uuid": "9fe2fbd0-ebf5-4575-91d5-1c74458a9bde", "value": "7f3a4a0e96d9bcc5b3425ad3dca611da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163670, "uuid": "e96575a4-a092-435a-89a9-f5c1a0382e49", "value": "6144:oBrf0xh3Hfr5YwuLpVtE/qpDVl2HwW429mdix4KRYLCeA8ntOOrdT0y:+rf0P3HD5YQ/qp5UHwWmix4TLCQXrd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163670, "uuid": "d6b7e0e2-5b8f-40b8-9631-7c406d315bb2", "value": 332524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163670, "uuid": "d27e11ba-49ab-4089-9da7-28085cb42166", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163670, "uuid": "141a8c65-d1a3-4b76-8f6c-f7a7a27d544e", "value": "CTM_50,000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a980968d-f5ff-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628176397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176397, "uuid": "91d1d1d6-7fb9-47d5-929d-c0b966f36dca", "comment": "Malware payload (Dridex)", "value": "aa83426bcc82c33e0fbc1ce96e0dfe95", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176397, "uuid": "3aaccc36-c4d9-441f-8d30-6ad6ca412b12", "comment": "Malware payload (Dridex)", "value": "48d267f875bca7301f079a283305cba11ec8106e9ed76758c780ddb2cf847a59", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176397, "uuid": "94befea4-286b-4082-92ed-5b56e417a3bd", "comment": "Malware payload (Dridex)", "value": "42178099287beffe1c632f52e1e6391b6cb75bca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176397, "uuid": "82622813-9578-419c-b306-842623eb86ec", "comment": "Malware payload (Dridex)", "value": "7c0e4841ed181fb45bc523ddd21582d8a6ae32f07dccd06b6c7563a2aeb383153a90ba2a9e225588f51d9f1799592a0c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176397, "uuid": "d6d89d98-1981-4136-aa64-9dc28f6f6159", "value": "T10604E0C042F7D2A5C3679B7C00B671BFF16929012B76D9588D85CD2CEAAFB91D360272", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176397, "uuid": "948c9b02-d806-4aac-a4bd-891d1076b449", "value": "39ea6703ace4f75b2e32f9bfc2ceb0a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176397, "uuid": "aa65ca36-fab5-46b0-8fce-dc3d6ccd8f4b", "value": "3072:9DZDVVA+DQ5JTOfEb18qFafjqvTwQJeWLq9NxbKejWGEjh:9zVAfqfER8qFOqv8eeWLqRb3dE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176397, "uuid": "6bb2ab21-0b21-4045-a4f4-22d35ce2260e", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176397, "uuid": "51853929-5930-4158-9fea-cf863669d106", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176397, "uuid": "72c61093-2a4b-4cc5-81a9-e7bb5d6e4440", "value": "E0JISV7xIHoSYfK.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90522f08-f62a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628194823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628194823, "uuid": "4eaa82e2-244e-4c91-b0f5-dfbf1ffd2ea7", "comment": "Malware payload (Mirai)", "value": "0fb8552a93d8f6a998f04e7eca99a0cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628194823, "uuid": "45ef27ae-a774-48be-9932-9ace4fe422a9", "comment": "Malware payload (Mirai)", "value": "49f086299342c0ebbeb2c3d6b81908ac70fe07c6d55099ae9505b8ad6430cd09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628194823, "uuid": "a2498dc6-12ab-4361-99b9-0ff62d54e022", "comment": "Malware payload (Mirai)", "value": "674c2dc452437264d77949d2d159b8f7685b2721", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628194823, "uuid": "2911f9ca-cf63-4371-84e9-cf21eb57ffe5", "comment": "Malware payload (Mirai)", "value": "6660cd1643cb9e535ecc8f383a31286dc5f29c221152cfd2abf54b5cf7694e7fbd5b4bc56c842d2a8253bebe1af8569f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628194823, "uuid": "772a60c0-d27e-4a52-87f8-a61eee8d3aa8", "value": "T1E8634C21BA751E17C0E4E47B12F38325B2F5874E20E8C72E3D650E8EBF2565026976F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628194823, "uuid": "51a3922d-4d4e-4c5c-a18e-a9a374251989", "value": "768:qPoOV5KxwGbrJpDgfxjqflh3iNljgyOK9nY/7omOlHO+75Yj3sDtP1txN3uIJ:qPtVGbgfxjq9ViNE9qV75L3txoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628194823, "uuid": "dace45a0-6502-4fdc-9a67-65c3a6ae6727", "value": 69200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628194823, "uuid": "0fbac34d-c430-42c9-8262-43022e780f60", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628194823, "uuid": "630577ea-db7b-4f12-9b8c-f6c2356a2179", "value": "0fb8552a93d8f6a998f04e7eca99a0cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23410089-f620-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628190345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628190345, "uuid": "d4f377ba-ed6b-418c-966d-4d3fad4531e5", "comment": "Malware payload (RedLineStealer)", "value": "9ad105c419054a02b61293f207069713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628190345, "uuid": "e4687b7a-bd81-42b1-b647-d40b5a2145be", "comment": "Malware payload (RedLineStealer)", "value": "4a56daeca371b82d57331570066f794b8fa56c514c9ad9ec4ca2f6a2613e6516", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628190345, "uuid": "13c2b09f-29df-4a12-b4cb-6bf388d84066", "comment": "Malware payload (RedLineStealer)", "value": "22e6c2304ffe55c14fc1c0a51b39e1c730393559", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628190345, "uuid": "031ec900-9a1c-493d-af47-8fec908edb7d", "comment": "Malware payload (RedLineStealer)", "value": "88a2a41a51f6758dc966769e32e77c714ba8f8d98f412539cad73bb085b81a96d097526e5e5e5ebd93770be41fa86214", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628190345, "uuid": "100bfd6d-7a40-4fcc-9417-4d2815cfdb7d", "value": "T11FD412127540DD32F66039B118A5E2A22677F878DD25CA077B89576E2F313E2EF30399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628190345, "uuid": "ca9b820c-7aee-4ffa-9a9b-6860e9989489", "value": "c36bba2f7ed1360c17671decb7b1e9d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628190345, "uuid": "7170af62-5abf-4bb0-9ad6-c1cdf2d4952e", "value": "12288:jimFdXU9ZIcY79xH7hR6HOw7F/3aLcP75guF4cl9VqEqBi6eNiPKmYg:j9cx6r736FF/xLF4sHqEqICKmYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628190345, "uuid": "69a2416c-d1c9-41a6-856a-116b050a2435", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628190345, "uuid": "d7bc2c7f-a592-44d7-b0de-87565a0e5055", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628190345, "uuid": "f692df2c-3dde-47ab-a48f-adc8414d7f18", "value": "9ad105c419054a02b61293f207069713.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fba8534-f61b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628188353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188353, "uuid": "694b4f10-5567-4a8c-8f7c-6d8bdc87f403", "comment": "Malware payload", "value": "3aa98571fcb0f1d734605cc6e2d8adf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188353, "uuid": "21c14cd5-f821-4eaf-8751-1c5c4af0b1ce", "comment": "Malware payload", "value": "4ac2dcd5ce04c588c08e4cd0350559bc8d5f7ff5c8302721619b74b39f61c786", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188353, "uuid": "475c2eb5-ccf2-49ea-b12e-1bb65f46b8c5", "comment": "Malware payload", "value": "b48853c9e2eabbb5ba1c62563b46081a539088e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188353, "uuid": "29d5337d-644e-4868-b976-7cdc056cda30", "comment": "Malware payload", "value": "cf1ad99dfb621eda35f14576c9649d9bb36643c7888fa64ce13c94a89c78daa60fa3b78d34dfa6cf94e9b6e6d2633b61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188353, "uuid": "e030d302-1bb5-491e-8eee-e212004c5843", "value": "T1F335E45DBDE47557F26B44BCB2C964E211B0BD0D8F18AEE7AD82F3EA019124AE537007", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188353, "uuid": "6900be8d-a8e5-409a-b144-6b7c3f0a4c1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188353, "uuid": "686a4cb0-50ee-49dc-a151-0c67c258dd5b", "value": "12288:O+jrpNOT6PI1Vp+ZdNr7LpQo0rEHlKKS6k6+JIELfLfaybj3lc+GEQqLiNBA6LT9:oVc+GEQuiNB/eJ9KuzVcIITSNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188353, "uuid": "067c1a20-1abb-4563-893d-3db92c208327", "value": 1120768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188353, "uuid": "515a111e-d1c1-4363-a29f-4769b7839d05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188353, "uuid": "43279236-23de-4a24-aefb-10419333b8b5", "value": "3aa98571fcb0f1d734605cc6e2d8adf0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2087f2d1-f604-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1628178315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178315, "uuid": "1e3ea2e3-7551-498e-a54a-e7d4b009d406", "comment": "Malware payload (AveMariaRAT)", "value": "bcfe186a833a0bd8a2e70c05fc4f42ad", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178315, "uuid": "4c16b091-93eb-4769-a36b-1897f5ad0cb1", "comment": "Malware payload (AveMariaRAT)", "value": "4b029f971c1570391aab11270a01357771fbaf2464801b7c0e5a471853bd0f42", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178315, "uuid": "f9373ed3-21ac-4555-bbd5-f611c13ae051", "comment": "Malware payload (AveMariaRAT)", "value": "47cc732e684e8bb3a203a31e85cd91ec8b863d22", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178315, "uuid": "4ac8e852-afda-45a9-ab09-0defa4a4096c", "comment": "Malware payload (AveMariaRAT)", "value": "3e8962bf677be03aebe9430cc0a26bf2a6827dd9d3a448bfbaef08246e4ae3ed2d5317e2f1ab79774f2beb15c1413e55", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178315, "uuid": "a4802174-c4c0-4e72-a847-ed0a577118ce", "value": "T192056C2229EB214DF3B39BB50FC4F4BF46AEE573560AB0FA39511B958322940CE51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178315, "uuid": "4a91e5cc-6e6b-440f-9f69-d8c0d227f4b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178315, "uuid": "fd467d88-791b-46ba-bb6f-b6b317db643f", "value": "12288:RJjJqAoZ/oR65AXwgFvuSS/IOzVFypZG/GxZ8yH0USk8PHbt3cfATYM+IIUIa7p:KoR6qgj2AGr86JsBuATYpIIUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628178315, "uuid": "b087f60a-aa44-48c9-ad3a-5adc685e9639", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628178315, "uuid": "4f8303e5-c788-4a15-bfca-a3fbd2fb0a4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178315, "uuid": "b0ac4e10-fe46-4b5d-ba6d-3fa578dc84c9", "value": "bcfe186a833a0bd8a2e70c05fc4f42ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e38898-f589-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628125606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628125606, "uuid": "fdc71671-e840-46e4-819e-915279ec6ba7", "comment": "Malware payload", "value": "c3061548e87fef765e4bbf04672c7cd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628125606, "uuid": "2434a0e6-c268-4db3-96e3-c4e6528b4cb6", "comment": "Malware payload", "value": "4b2e90180682a594c32e5d6e8b5c93f3263551058d589171cc89a1a8ad55eec9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628125606, "uuid": "0a44de8a-58b2-4176-881c-86336b891e56", "comment": "Malware payload", "value": "21b7131e47019d0f1a0f9daabde1322c3b5a6cd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628125606, "uuid": "f47a602c-4439-4ed7-847b-92f8401623b7", "comment": "Malware payload", "value": "6c042127a059fcb76cd4e1272ad8c3962c1759205d7f9004aff75c4710aa0c7c82f32c9b44095aec940f64cb199fba30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628125606, "uuid": "5dbc985a-3a9f-4e12-b35f-9a325943569c", "value": "T104154A9D329076DFC827C976CA986D64EB607CBA430BD2439493199EEE0D997CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628125606, "uuid": "b8466dc3-144a-4f12-bd49-7f62664c9ab3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628125606, "uuid": "09b1742f-0a2c-416b-a5a7-5d0105b88e63", "value": "12288:SNPy+Gt1UOtwG3MjM1pED4lI3RJGg5ChG8TVzUhQ7xZbqZ8bXPkW22vb3VI/WyFB:SNPJGt1UykMEkCz5X8TVz1qA9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628125606, "uuid": "32592f06-99c2-4afa-b1f1-fcd6934b2962", "value": 941056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628125606, "uuid": "3d380aa8-9645-4089-a230-764d55d0308e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628125606, "uuid": "43751460-11ca-4f9f-b3ee-111a8b60e0e9", "value": "PO20210508\ubc1c\uc8fc\ubd84(\uc2e0\uaddc).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ca90c1-f5bf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628149012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149012, "uuid": "e432152b-e416-4824-96bc-d31af70de0b7", "comment": "Malware payload (RemcosRAT)", "value": "51c906d4303e37f0cf8e137720bff0b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149012, "uuid": "c81ad043-529e-4a26-bb19-9eba560d1402", "comment": "Malware payload (RemcosRAT)", "value": "4b397487c62e45e2349920dc8fb905ebd85cf95bdde81fbb1f7e6ebdf3dbaea1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149012, "uuid": "caf65abc-57c6-48fd-b51d-891b891c0ba3", "comment": "Malware payload (RemcosRAT)", "value": "3f5d590d08236cab092e3bc12836e9f1ea9f29f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149012, "uuid": "21d02e8c-302c-4173-b0df-05ab7c6de826", "comment": "Malware payload (RemcosRAT)", "value": "e89ea8d0be7616676c4b3f9ac2651fea26688c66d124c2ed0296515f5a1fce011f7a28a0bc88caf8dfc617fc930c8be1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149012, "uuid": "a03f8caa-b9c6-4942-a374-822b310644b9", "value": "T1D393C713FA4AD0B2E42591F146426F31CEBCBC3736492173D38FCA41AD79892D456EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149012, "uuid": "ff234781-7bd4-452d-8a36-5d963d77f37d", "value": "d3a62971944197f0701c7049a9c739d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149012, "uuid": "28c62910-1dae-4915-9ff2-772a17020754", "value": "1536:AhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6Dra:GhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628149012, "uuid": "dc3ec7ae-584c-4b2c-b5de-8e9c0784592e", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628149012, "uuid": "51da981b-fcd5-42c6-ad70-f520b93c22c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149012, "uuid": "784ee3a9-3a98-439e-b1a6-5b2a7319c6fb", "value": "51c906d4303e37f0cf8e137720bff0b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81404fd5-f5aa-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628139822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139822, "uuid": "f6f49fe3-1522-4957-8982-77f982c36f87", "comment": "Malware payload (AgentTesla)", "value": "e146d579d1e2ccb3ae39881ab53d67a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139822, "uuid": "452a84d1-9be0-4c6c-a560-6a2068348f43", "comment": "Malware payload (AgentTesla)", "value": "4b50ad683aa4fa64ea52f33f77fdee2ee70c1c98bae14f75982469520830cc55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139822, "uuid": "c32e3f67-e25d-46d6-9c98-27c0132cd13e", "comment": "Malware payload (AgentTesla)", "value": "0ee90d5f0f44b921b6eb043882bfca1fa59825d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139822, "uuid": "8520edaf-a074-4bbf-9492-dbdad1d58a69", "comment": "Malware payload (AgentTesla)", "value": "665fcc9f0c7a45c31795f137dce84fdd99f4d3aa07bd6e571ec919393f5c3685f6c8877301b71c7a9e9ec245bb70cf0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139822, "uuid": "053a202c-9be2-48f2-bbb3-d4f3d58ef545", "value": "T1CD056B2229EB114DF3B79BB60FC4F8BF46AAF633560AB0F639411B964722940CD51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139822, "uuid": "3f5cb3c3-6136-48c0-825b-50a46d53ee22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139822, "uuid": "fbfc01c6-6848-48f9-8620-4e5056128012", "value": "12288:O1SjlOAQZSoR65AXwgFvuSSiILJf5ZjGXSTZjgpsecmEDzZZHTydD1166/vDiT6A:/oR6qg/PKiJgpsZDw/ZnD86BqLPYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628139822, "uuid": "b009148c-746b-4c4d-a6f7-b0cffc8ce99a", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628139822, "uuid": "7ed15121-f006-4ed1-9169-e5a4c29516e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139822, "uuid": "ed733b77-abce-4803-80cf-125afbcdf7ab", "value": "Hesap Hareketleri 05-08-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247f984b-f605-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628178751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178751, "uuid": "594d313f-450c-45d9-b273-412f98c2ab76", "comment": "Malware payload (Loki)", "value": "15fe7395ede733429881ca065f9e9cc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178751, "uuid": "86cdd571-d7b8-47d6-bb88-7159b3f5a68f", "comment": "Malware payload (Loki)", "value": "4b5ff74bf35bb1e36430b8a520457f361e246fe6b3c71511aea6d136388846d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178751, "uuid": "bdadc41b-d512-4217-a2e8-b09e8ccad6a2", "comment": "Malware payload (Loki)", "value": "d68ad8c559ae3e82b513ed06b94a75a96cd3ccc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178751, "uuid": "d8923df6-f6e4-4dc6-a409-8e58a85dac7e", "comment": "Malware payload (Loki)", "value": "6470dcc25eac255d9873a53c7c7be9b4c61f1188062befabfeebd6d31bca84bca86d1d4304d4874153002d602de4498a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178751, "uuid": "fec1b243-f6b0-4221-a4e5-48dd35d4156b", "value": "T192F404FEA6F30663F77E74F9D3190A9046848C384266AAEE81F5760A653F553CE081DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178751, "uuid": "6173bad1-d80c-4080-96d4-bc1ef21eb97a", "value": "7f3a4a0e96d9bcc5b3425ad3dca611da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178751, "uuid": "5d1a0683-3014-4654-9001-91c05c81ca35", "value": "12288:nrf0P3HD5Yu1lfJ1/Jbpb/71asOI/0ORZXs:YP3H1YuXf7ppbD1rOI/pzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628178751, "uuid": "8505e2ab-86e2-4f7f-8b7c-b546fa74ed19", "value": 769411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628178751, "uuid": "c3229f10-0aa0-4bcf-a1c0-cf5d2de39da3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178751, "uuid": "ce81deab-8159-47fc-acaf-006655e942ef", "value": "15fe7395ede733429881ca065f9e9cc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12de92db-f5e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628163259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163259, "uuid": "50d1c1ee-53d9-464a-91fd-2bf549d1647a", "comment": "Malware payload (Loki)", "value": "01bbac775044e89e981d285af1c656ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163259, "uuid": "7448465c-1a1d-47bd-8a6a-999781d93bdb", "comment": "Malware payload (Loki)", "value": "4b69b0e866fa08455cfbeff53259db488ded1fec50c55811fc1d401794918e7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163259, "uuid": "3afa3fae-3996-4d45-96f7-ae0e3cdcd3f6", "comment": "Malware payload (Loki)", "value": "bec05864c2fc289f2637a29a0e843eb2219f0aba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163259, "uuid": "44159631-882a-48b0-bd9c-598f73d80be7", "comment": "Malware payload (Loki)", "value": "a00f7ffec72d137c5b6448dfb2617fdf28a2d4f5c09606a18564cf64c5037067c1f98cd28593e8ada43645510bd36066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163259, "uuid": "98ad44df-cf54-43e3-8ba4-791260910dea", "value": "T1BA64F15573C3C036D5331E3906719A64DA2CF9398E3599E72BA806794EF00D15E3AF63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163259, "uuid": "9b5a5481-9ffe-414d-a85e-9e34d58d07a5", "value": "ea8de473df0698dc330fdb95b5eda1f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163259, "uuid": "d25ba23b-9716-48e0-a1cc-fdb6ecb96e78", "value": "6144:lPH+MbiH2r0u5EVjuU6A0Jcau7LUQEI2vEwyt+DunwagSCCcX/8Vhx4hw7WtavdH:l/+MbieEVyA0JcadIuEwyKJagSaX/ehB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163259, "uuid": "dd242269-7a60-46de-92ae-ef03630bc545", "value": 326590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163259, "uuid": "84d6e471-a6b0-4d4b-8dcb-d410913a0ea7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163259, "uuid": "02c01957-433c-4bbe-91b8-2d737e1b4b9b", "value": "Original Invoice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0cd4ccd-f5bc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628147740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147740, "uuid": "d1597cb3-5cf5-44af-897d-29623ea52dda", "comment": "Malware payload (RaccoonStealer)", "value": "e722b68af11e3460bc62ae5f2097a36b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147740, "uuid": "ebbdd68a-a0c0-452a-ab7b-644cf40de9c4", "comment": "Malware payload (RaccoonStealer)", "value": "4bf0a958bf731e67495df5bb0daffa049404d94d1138b0af8b6544fa69d1688e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147740, "uuid": "1be4eec4-c402-4580-a016-8d3f48ab9b16", "comment": "Malware payload (RaccoonStealer)", "value": "b509a4a1f75fb1653694175a2c30fedcfd16f020", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147740, "uuid": "99a80c74-9c7c-4811-924a-45f732cd84e0", "comment": "Malware payload (RaccoonStealer)", "value": "fd3dd12b9086a4e9caa4ff37c0e8c1870eb400128c91c2c8064b7299a0affc41ccfb760545f15d3dd72bcde68eb2fa61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147740, "uuid": "731a5b35-6237-46b3-b0ba-c6d9e393c205", "value": "T103A4021279A2C3F3F4A047B07822CA955A677C7C1C6A998B3BD5835C2F7D2D36E29305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147740, "uuid": "fa807b44-662c-4b40-9716-f837216c5aa3", "value": "e2ba8e1f75a8e02687cc194905c50074", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147740, "uuid": "a36b34dd-bec0-435c-859a-82f08da34282", "value": "6144:ggYL5tuGX/nT9ep2DXOkYq3ljOrQEuZiUhTMlKZqG8dOKJRq7yt5GG2xVaEnS7PE:gZFPvnT9eWlY2Zi4tMnR/u4WS7PN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628147740, "uuid": "3f29b3d7-1d12-4cda-98e4-1a00020fc2d5", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628147740, "uuid": "d303da94-96d2-4d99-bf49-78ce2a534f9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147740, "uuid": "d5168c8b-24cc-4fcb-894a-ed4819dc954b", "value": "e722b68af11e3460bc62ae5f2097a36b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9ed29b-f5ed-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628168784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168784, "uuid": "a3d76585-4f27-4bf1-a748-b47dd89ab9fe", "comment": "Malware payload (Loki)", "value": "ac6347256842947d6ce26fa3363bf0bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168784, "uuid": "a699e87d-7842-423f-a7f3-393b8a87056d", "comment": "Malware payload (Loki)", "value": "4c25557b1d7a360b69a1ff457e63b31351e438dde35661a85550c403fd8f0d1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168784, "uuid": "5f9d23c2-01f4-4295-855f-bfa36850a00a", "comment": "Malware payload (Loki)", "value": "6f9c0c99f49437bf7098811bea946936cdbb862f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168784, "uuid": "395bab2a-0bd1-43f6-a327-c09088ac4b9b", "comment": "Malware payload (Loki)", "value": "7709c219f8de73c0672c635c6f6de7cd2926cfa356973fb09d651e9ce3a954d5bcc3178315bced3808383852bd4abe72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168784, "uuid": "4d72f2a5-a961-4617-98c5-3f259d04c111", "value": "T149F46B2229EB158DF3B3AB760FC4F8BE56EAE573571AF0B638910B464322940CD51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168784, "uuid": "67411bb8-b785-48eb-bac9-2bdf23bb296b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168784, "uuid": "80616933-8ffa-4703-9f21-7a4e424cbf05", "value": "12288:fEoR65AXwgFvuSShs3Lut80pITLtbJhRRrfzxSJicWZD/Ub/rijCGR:MoR6qgmZQ6hrLflRcWWbGjzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628168784, "uuid": "2d61baf9-2520-4386-b8ce-43368f7359cb", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628168784, "uuid": "d5123197-ea8d-4155-b510-9cd3201c8917", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168784, "uuid": "6cf79f0b-781f-40b3-94f4-72bc1244ca29", "value": "AZ0955T53YY33.COM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb02571b-f604-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628178574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178574, "uuid": "cb70c71c-e3da-4125-9ec5-de2e016f8675", "comment": "Malware payload (Formbook)", "value": "873cf90c9a977554d65c523f433a96f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178574, "uuid": "29260713-45c3-428d-85f5-65132b549c46", "comment": "Malware payload (Formbook)", "value": "4d8f0613e6c1c51cc03a64477a407ff9aee81531a4e3e0ad0c6ac6ef7efed169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178574, "uuid": "919efe40-ba32-45a2-8cd0-210a6160c404", "comment": "Malware payload (Formbook)", "value": "2001135d9f006653aa2ac1c1d1208c9a210e7987", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178574, "uuid": "97ac35f9-bce4-48fb-a2ac-0af420a6e3fe", "comment": "Malware payload (Formbook)", "value": "63288c370da6b329a91cd5b16675cc86b8b08ed24686a38f62ee79079111872b90e81c34e38c5d68c752820be6351e8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178574, "uuid": "6dc360b7-898a-4c2c-a2fc-2e7437295151", "value": "T179056C2229EF214DF3B79BB60FC4F4BE46AEEA73560AB0F639411B954322940CD51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178574, "uuid": "5729e11a-a384-4ccc-acdf-004c10235563", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178574, "uuid": "c9422f05-6d78-45a9-b609-4fd89d162502", "value": "12288:pWjR2eASZcoR65AXwgFvuSSDIUo9vk1FfQ01D29sAehtJ4rCFRpUVDi5feAdGPL5:toR6qgZo9s3PN29sAMD4OUVplPLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628178574, "uuid": "1efb8951-4a7a-4dd4-9642-efec1682346b", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628178574, "uuid": "b077c1d2-ddbd-490d-9701-42f585d94cff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178574, "uuid": "ca085203-d75b-488f-a224-a3e30f23f2ec", "value": "873cf90c9a977554d65c523f433a96f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f234cec4-f5e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628164063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628164063, "uuid": "2582a146-4d07-4eed-a70a-00d98dc2b786", "comment": "Malware payload (SnakeKeylogger)", "value": "60b5784c9c3b22447f473b17422e5534", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628164063, "uuid": "2365a75c-c59e-4541-a6ec-50f67cbd4846", "comment": "Malware payload (SnakeKeylogger)", "value": "4e28b14785e16aa7847a61d1597039b9a9411f26ae95f3183a09396ebd80ce2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628164063, "uuid": "a937449f-a90e-47b3-8a2b-81dced71be65", "comment": "Malware payload (SnakeKeylogger)", "value": "9b5666de4d11aefd5759cda4de0a2d3e4d4ee4cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628164063, "uuid": "04bff61a-6512-41d1-a172-0aaf85b58986", "comment": "Malware payload (SnakeKeylogger)", "value": "de2f26dbcde70171684bff4ea37887bba598b857815570a309c85ac62cbabf4feaeec9c259fe9d84ce729db8abc59667", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628164063, "uuid": "9e3e96cd-d3e6-41d1-b692-5823a7c07f36", "value": "T153F45A2229EB114DF3B39BB50FC4F4BF46AEE673560AB0F639511B968322940CD52736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628164063, "uuid": "f3e96d73-d971-4bd6-ad42-b1a656a44d3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628164063, "uuid": "3747db77-8f49-4d4c-94de-38c23b4792b7", "value": "12288:l6jXmAQZioR65AXwgFvuSSDIk13+N1er/fkyl9Bnj6nZQwCn6/OPUh5s:goR6qg7+N1er0yFeZC3UhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628164063, "uuid": "743deb6b-2413-4396-bde5-84b587ae9e18", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628164063, "uuid": "258618c7-e2c3-4ea1-8a08-364e3e1e5b3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628164063, "uuid": "69bb147b-7d08-4be0-92d4-5849ab0f4ac2", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d0f731-f5b5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628144737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144737, "uuid": "65da77cb-8cab-4357-a204-c132b6255edd", "comment": "Malware payload (RaccoonStealer)", "value": "5fa441a115064b29cff09bb334a11296", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144737, "uuid": "77b4af6f-68d2-4113-b3e9-e3beed60679c", "comment": "Malware payload (RaccoonStealer)", "value": "4fad7861f4a199220da542b448292e9d2c88f4c0b465fcd89899c00a8a435051", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144737, "uuid": "9ea6f4a3-1e70-4466-908e-5dac5e2a9617", "comment": "Malware payload (RaccoonStealer)", "value": "250f160163e3ec13a285cff0096e983d4279ee3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144737, "uuid": "a2fd0688-b419-4009-949f-f566d476ea4d", "comment": "Malware payload (RaccoonStealer)", "value": "3198703ffbb4d654c5570cc6cb55a11d890e1d4cbcbc820f03e59a2015114296e007ce1fa2a001373db45630876e2101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144737, "uuid": "1263d434-5aac-465e-b107-39f02f3bc041", "value": "T1E3A402023991C437E56156739814C6B6EA3E3C74FC396ECB3B819A9D2E722C1EF16346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144737, "uuid": "b025e2ec-7de8-4362-876d-bf5d54339812", "value": "2a9c1ca66125aeff7a1c36242be63d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144737, "uuid": "7f0c1ccc-d239-47b0-8826-086eb89a9143", "value": "6144:fLyXL+tjAPDmu9eCI1G7U4bCYeWlmBCIHXfEswrzkT3qrmoqq0Fi8n8pSlB/:fmXyyPDqBIzCXMsa4+ioqNiK/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628144737, "uuid": "3abc9586-ab9d-487a-9162-9e624bf37443", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628144737, "uuid": "ebba1fcc-affb-499f-ae26-24b6f718876d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144737, "uuid": "279416a4-2bd2-431d-b02f-1d70b961ba9e", "value": "5fa441a115064b29cff09bb334a11296.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546fdb59-f614-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1628185274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185274, "uuid": "102de1a1-a3d6-4dc1-8af5-d097ad8a5705", "comment": "Malware payload (NetWire)", "value": "6e03ec466745f7804a0112d941cbb37d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185274, "uuid": "f6d1baf4-944a-4998-a7a2-484229d56a40", "comment": "Malware payload (NetWire)", "value": "4fd8e9d2ed86b9508d6d75a2ecf8e18ecf0524787ff868ceac8ad005a9d97963", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185274, "uuid": "d3798249-87f2-4981-aa80-11a4920e8688", "comment": "Malware payload (NetWire)", "value": "83f20287e7513cbd6bf58be6065238342752f6c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185274, "uuid": "334f84d7-342f-4e4b-b60e-354fc3e00ce6", "comment": "Malware payload (NetWire)", "value": "c2f79562e766b0d705bc225160c1724b8ac6c213d594d05acc0bc7748ec054042f8a8253d2f575b9ef192c33b1387d97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185274, "uuid": "7f37a06c-5c7f-4a6d-b1a9-e993c3aad02d", "value": "T161152AA4F4A5C82DE19938B97A662DD1D8CC5C8C3D3EA74B0509367E26B735C0792E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185274, "uuid": "326842e6-c059-4e17-a0e2-19f65cc762bf", "value": "a27bedaa147286540d08fdf824189cfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185274, "uuid": "e3a0ac58-d489-438c-a39a-22bfbe16262f", "value": "12288:EghRSVRxnU8yLl6hqTvkUFZOi3Df0nucVnue5:hQhnUFlSekm53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628185274, "uuid": "c0ed8898-a86d-4afe-ad44-c5e239c11136", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628185274, "uuid": "c9864112-b802-4f6c-9019-7db3997d0122", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185274, "uuid": "2d20bebb-674b-4dba-a7ae-3af9a459f8a5", "value": "Mtbvpkmtwcfyvfjrjycytqbjdqrykeeson.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a38883-f5fe-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1628176072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176072, "uuid": "47611597-e441-43e0-b943-ab92bf96a543", "comment": "Malware payload (NetWire)", "value": "ea0126d07ca352687cd80de06cbcb6f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176072, "uuid": "524e8817-0059-4747-abe1-dccb9972a322", "comment": "Malware payload (NetWire)", "value": "508363ac23d75a1e265f6ba9dc64f3fe227ec361f8ebfa21d03bbed7a2c878c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176072, "uuid": "358c4028-6063-4e76-a819-eac81e4052f4", "comment": "Malware payload (NetWire)", "value": "12dab64dd13e2f6c02c9639e6d88deeadcedcccd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176072, "uuid": "5ce39ccd-fae7-4451-bd49-56d23206671e", "comment": "Malware payload (NetWire)", "value": "8746df5e62101a48a8cefa7cc624d9f915b2326b86f2db3432565b480fd74ec467036bca785e5dbff152381d8728084a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176072, "uuid": "a1090642-d910-45da-adb8-24e99fd0ed31", "value": "T12745E043E341C4B6D07A0730C5975BF07EB6AD30DB62961B9BA07E2DBD723906E21B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176072, "uuid": "917c0a94-c580-4a54-8185-8ae4a2b164d7", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176072, "uuid": "9efcfde1-866f-4561-a6a0-f30b929e6234", "value": "24576:AAOcZwdf+OD0+Oxbuk8E33NtEFd9imt3fO+veij:efOxbuhs4zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176072, "uuid": "c93543d0-6172-4ec0-975a-af75067aa90b", "value": 1274041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176072, "uuid": "6804e37f-3054-4ac4-bb9d-f6c7aa6c8556", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176072, "uuid": "2ba859f7-2364-45da-ad06-16adcc4e9fef", "value": "Request For Quotation.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6c7019-f5dc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (FickerStealer)", "timestamp": 1628161291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161291, "uuid": "60645b9f-35e2-4514-8432-b09888591ecd", "comment": "Malware payload (FickerStealer)", "value": "a805ad0e74f9740a16855d75ce422b5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161291, "uuid": "9d504f76-1508-458a-b12e-11bb769dd53b", "comment": "Malware payload (FickerStealer)", "value": "509a12684cbe4807cff583c20831617ed823605226c022391e66e50be0227d8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161291, "uuid": "c3273985-d44e-4fca-88e2-171227561153", "comment": "Malware payload (FickerStealer)", "value": "b0aad0de40153ebb88ed374165baad591d75df18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161291, "uuid": "b3b5f32e-56a2-4757-b1e4-7c92b5f65a08", "comment": "Malware payload (FickerStealer)", "value": "82a9d48aa1686d43769dc8e05e2ab4e2734fb3528e43f3e79ec1def7073eba186765cb2c550797171a019b9d64c1a0db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161291, "uuid": "3e4b7c59-f9e2-4890-9abe-5a29cceb7e10", "value": "T116A48D2054E81D2AEE46227C48AB8356A73E3D705D33D7D37B326665CF231D3EAA4342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161291, "uuid": "95fe925f-d2ac-44ad-9d33-154279276f40", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161291, "uuid": "73884a19-79d7-45d5-ae64-7c7b1dfaae5d", "value": "6144:nrq0EiwG+9zt0449RZqy6wOZg0AALv21XaW0rLFb56dpLN4XQKJ3:nwiIu99PqtZXAYIXaW0rN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628161291, "uuid": "e3ce6dc6-5da6-43b3-9955-91bc956e22ac", "value": 480780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628161291, "uuid": "07162545-95b3-4f5c-80d7-9738f01c03ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161291, "uuid": "db6930e0-9fd5-4d91-adec-f5e3fba5e83d", "value": "a805ad0e74f9740a16855d75ce422b5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5ad2d3-f5fe-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628176083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176083, "uuid": "3c1457bc-7c17-4bc6-837d-e406b981ebb4", "comment": "Malware payload (Formbook)", "value": "52d7cccde88d979a77494e23a758faa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176083, "uuid": "4f1a715f-0558-408a-b4cd-e39067d8e19f", "comment": "Malware payload (Formbook)", "value": "511a94f3465fb39788f2c9a3c741b2f233ad6ebd6e47ab1225a1b8f34a463747", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176083, "uuid": "66514ecb-84bc-4bb7-9a2d-2e616e271d7d", "comment": "Malware payload (Formbook)", "value": "c14bceb7d7ccc2a815e964318174abea5eaae2db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176083, "uuid": "864a96a9-051b-437e-96ae-282e03ffcf93", "comment": "Malware payload (Formbook)", "value": "61373618903a878e516f4c2a69519e0126bd94d238e02941c21e3f9638f860c6f89660c6d57e07d2b4495b2eaf5c2f32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176083, "uuid": "8f5b57f3-ad80-449a-baf4-72db0e203bec", "value": "T1FEF40115A2585B24F53D5F786A71004427F0F219AB22EF8E7FC4A0ED4EF2729439BB46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176083, "uuid": "27975a8b-0937-4c2f-a73b-d937e411d64d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176083, "uuid": "1ab8b1a4-e913-4abc-b960-39780f55bf10", "value": "12288:F3EeNI3/LNE7gL/S1GoStWFnRT+wOyzDQW2Hpi3yvjef3/8Bt2NjFn:rI3/pEO/S1vSkFnRtOyzstpiivyf3UBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176083, "uuid": "346875d1-01f0-4891-b517-344217a6209b", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176083, "uuid": "b3ba1458-a539-40bb-9d77-921682c09141", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176083, "uuid": "2543670d-2ad9-4588-b5ba-bbc9bfce801c", "value": "52d7cccde88d979a77494e23a758faa2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ff1d19-f610-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628183471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628183471, "uuid": "407e704b-10a9-49cf-90a7-2cf5070c303c", "comment": "Malware payload (RaccoonStealer)", "value": "c587713fc29b7f74b99fc937fcc2cea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628183471, "uuid": "062da0e9-9bdb-41a1-875a-82c92c665cfd", "comment": "Malware payload (RaccoonStealer)", "value": "523821c313298b7fadbe5b8807619b819130205c39698d1be04b1a4891b52c0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628183471, "uuid": "102f2196-4f86-4284-b322-dae1ef982ac4", "comment": "Malware payload (RaccoonStealer)", "value": "a377b37e5f2c4e0edb410e64351fb881d12d9f69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628183471, "uuid": "a67d6cb7-7a45-41d8-b04d-699de713dd0b", "comment": "Malware payload (RaccoonStealer)", "value": "3b5a7a6ea9a35c18e708b4182b94d69681c060bf043a124b41a32a54b6bff0b2462bbd55286e51a9ba70e6b4bc593a8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628183471, "uuid": "eb34fed8-b01d-4b03-926c-b296e8a83f63", "value": "T117B402613540CC76F12279B18855CB660A2BFC79C9309A977F8693AE3F312D29F36346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628183471, "uuid": "60fed8f5-d88a-490a-acd2-cb7e14724a5b", "value": "7d2c4701a9e00af48c63738cadcb0b55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628183471, "uuid": "20688763-5139-44c1-bc26-a645f015c408", "value": "12288:LhocfGxDLcKuD/OLZnXx2cdNfHhcd4PiMYL:LJfCDnuDQZXxVNPhcdEjYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628183471, "uuid": "6646e10a-2b45-49fc-878e-dedb16ab7a73", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628183471, "uuid": "b4784cc1-2330-460f-9a53-3ed97c2ae2fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628183471, "uuid": "19e7ef53-f408-4676-b673-97a0e2792fdf", "value": "c587713fc29b7f74b99fc937fcc2cea5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706bb9da-f5a9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628139364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139364, "uuid": "c53f1f62-048a-4a2d-8657-c60cecf4847b", "comment": "Malware payload (RedLineStealer)", "value": "bd3c7e83dc5c8db8c398f50faf69824e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139364, "uuid": "476748c8-3e54-4a02-9719-f4a764e7a086", "comment": "Malware payload (RedLineStealer)", "value": "52ac1e4535281dcbc751114fcd6cf12656d1754269bce5f24bfdae5be9640108", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139364, "uuid": "c1850572-cab6-4572-8d1e-b66c87aa8ea1", "comment": "Malware payload (RedLineStealer)", "value": "d1f825c96f56e75984e639e222da99ad0ead7cde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139364, "uuid": "0aa347fa-a828-4189-9fc0-5a94b2111c42", "comment": "Malware payload (RedLineStealer)", "value": "bcc055279c0f5a20ef2f909c82246df90e57550aba9abe0c2936537b3b72b84e9a88cf56f2c6f7bb89ff077db543bcb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139364, "uuid": "41068bdd-6370-42d7-a17e-387bbcfbca9c", "value": "T1FF04B2D30DD2855BC3443738F060CA47BE3F9D297494713CE54EE29B99E5308AABE668", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139364, "uuid": "c395ffe5-78d6-4b44-b926-cc99352189d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139364, "uuid": "7f5250e6-b46b-45db-bf49-aa7e49eaaa82", "value": "3072:ZxdCWMAR+4fteXHqWp4iIQjt7dbLHvlGgas:ZnMARTfYLRbLHdGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628139364, "uuid": "cc6c170b-48bc-4af1-9e9f-138928ed9cb7", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628139364, "uuid": "23851519-2056-4695-9454-199cde8fe845", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139364, "uuid": "bb753349-b0c3-415d-85d8-2dcd3813b227", "value": "BD3C7E83DC5C8DB8C398F50FAF69824E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5875400c-f603-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628177979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628177979, "uuid": "c9575e4e-eae1-47d0-831f-a6e485adf0df", "comment": "Malware payload (Loki)", "value": "7598c86263182dca909e4b70a6e5f2bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628177979, "uuid": "391da363-bd5c-4aa9-b85f-e080435a1d17", "comment": "Malware payload (Loki)", "value": "52d267bd1cea3a3f5e4a248397341c2534169af3b29632eb923620108b1b42a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628177979, "uuid": "e5713b83-0056-44df-b35a-dbf4e7b6b07c", "comment": "Malware payload (Loki)", "value": "af3391ccb7c5e06a8637c18422e14bb9ba9bf82b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628177979, "uuid": "1f23d93a-3e3e-4b86-bcc7-99f014e7cd8c", "comment": "Malware payload (Loki)", "value": "5595da864e10bd18cff49377c2008222d7ba20dba320f58fb165c8e5cf65df3c179e65dfddb85ca9f14faae1f2cd32ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628177979, "uuid": "72eead40-c7b3-4f42-b561-aa6fd7acce62", "value": "T1EFF49342B644C86ED80330F3E81ED56035596DDA5676CB1E62477F2F9EF324318ABE0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628177979, "uuid": "9a704e6b-725a-4468-bfa8-d894d70c1870", "value": "7f3a4a0e96d9bcc5b3425ad3dca611da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628177979, "uuid": "7e60495e-e647-4d81-ba10-83b28f296f6c", "value": "12288:Krf0P3HD5YEoMXwE9FeJEEaMpyZwXLPVxFDd1mG:hP3H1YEoMXLEaMpyZwBbDGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628177979, "uuid": "d51cc977-7e40-4283-9d90-2a4ce7a2598a", "value": 769231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628177979, "uuid": "e8ddc8e5-3d6c-436c-af15-73c4393fe979", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628177979, "uuid": "96390bd9-5de0-4b9b-90c4-528bcaf28e41", "value": "7598c86263182dca909e4b70a6e5f2bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b886af1f-f5bc-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628147646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147646, "uuid": "6290f7cb-2798-45c8-a289-ef2e0b9800e9", "comment": "Malware payload", "value": "3f52d405191092bc8bca862462f1a288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147646, "uuid": "8e13aa83-0822-4bcb-88dc-e5113546c476", "comment": "Malware payload", "value": "532960b6b6dfdeb41fd7a1f528d2473f8e66ce7742d182239dc592b1f3ff73f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147646, "uuid": "9f7f1524-05ef-486b-98f0-770d618bde36", "comment": "Malware payload", "value": "b28835e9ffb00663f3430cdc053fc3941613d35d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147646, "uuid": "f4685fd9-42b7-44eb-abbb-c588b38a99ec", "comment": "Malware payload", "value": "2e6b782bccf3c15592b4fe99056f061c6aef452bf1227b2a67b66bf135a3d72ff6da77b88b69f92e55bf7cf418691c73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147646, "uuid": "ca9a5773-f0af-4e92-bbe4-9a228068de87", "value": "T18636334D11E8BF21DCE217F6844A046483E93546AD3DDBCD3ED610EA48A9BE84B70F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147646, "uuid": "a5166418-8a73-4488-9d60-1c80e625288f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147646, "uuid": "8f1afae1-8c22-4df1-af47-40349b52c1c4", "value": "98304:Df5eZfIHLPoDsSqmyHnl0hlKo/Hc8rHf6ysfRn3t9WAVpn3qD9Q6H0b1YRuH:FWIrPhPux/H1Tfyp3fWAVx3q1H/Ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628147646, "uuid": "0a406df0-a58f-46a4-a68b-239c942de7c3", "value": 5063680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628147646, "uuid": "95db77ec-dcda-467a-87b4-a0d5d7ba082c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147646, "uuid": "13a79997-7c07-4720-8d16-326e5653f131", "value": "usfive_20210805-060357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910446c0-f604-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628178503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178503, "uuid": "e9c3331e-88bd-46bd-95fe-61e2316566b9", "comment": "Malware payload (Mirai)", "value": "3bd07ee812e8e6a4168da108abac81cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178503, "uuid": "b6c9eb67-0e18-42d8-952a-a2a0db4876fc", "comment": "Malware payload (Mirai)", "value": "5389f6cc8fe23e7e79110fd518666e72f1a6baf635168ef52afdc69f1288d524", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178503, "uuid": "812d099f-1c99-4b46-9b0f-6ff46a58e924", "comment": "Malware payload (Mirai)", "value": "d8184536c4578f2d03dd58ae3a4ddd82e29a9251", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178503, "uuid": "2001140b-5c85-4020-bc5e-e3ea68336ad4", "comment": "Malware payload (Mirai)", "value": "34036c9d6ec6a73fd49b36dc28ffc3a50376e6dbbb3b23591494df677b86bf109b826a325d997d6c29243423d3cf0ba7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178503, "uuid": "c0b38243-e80d-48db-9fa8-9a8f788a2257", "value": "T13764F1CBEE01AC7AF9DA47B53A6B0B0977F0D6C5D3C3A140B264C5443CBD685AB646C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178503, "uuid": "541a5a48-46a8-4331-ac71-a79def3d7fdb", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6co4Pa5POdOQ33Q:7O/QJHZweEL/NOjCHm7FZZnc+PqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628178503, "uuid": "fe3fb276-be25-4d5c-b77d-fa09bd60f247", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628178503, "uuid": "b9ea0d16-8727-4fbe-a0de-35f22bf68f6b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178503, "uuid": "34242c30-1395-4909-9871-ae0ba4b34361", "value": "3bd07ee812e8e6a4168da108abac81cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54c4e64-f60d-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628182430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628182430, "uuid": "832271ff-fd4f-4e19-9529-9955130e3956", "comment": "Malware payload", "value": "c07bad616d058f17d94a0d1c5f0218a6", "object_relation": "md5", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628182430, "uuid": "6913115b-6881-4ff4-8585-c0553b86431b", "comment": "Malware payload", "value": "53d7bf7a09b8f617f410d6f378089f9c9a647e7e2fcac4459311dc684a24764c", "object_relation": "sha256", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628182430, "uuid": "1c51ce3a-2c6a-4374-a6cc-8fedf379e1c4", "comment": "Malware payload", "value": "2f1e35d0e11f74ba0458e7d7eab526b581d4e57f", "object_relation": "sha1", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628182430, "uuid": "ca47cc20-634a-4d92-b04b-e2e766090121", "comment": "Malware payload", "value": "6fe853322514d3a4181b781c25754d69df3ff866f170bdde7d32cf4395610e0330039b25fec7223105281c15914699f2", "object_relation": "sha3-384", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628182430, "uuid": "4bea971f-3b4c-406f-9416-26b166d36f60", "value": "T189D02B50DE30F4D843ACF190497A598E34821361A7241E6CD1015491D408B0CC72D08C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628182430, "uuid": "c2fb9807-4f56-46a7-854a-3dfafc5f9e70", "value": "6:HMVHjj2jkzozaqEHiO6snaYpXkGVokOMkfGTxPSnRh+Tj+lnORY:HMNjMJ2qEHiqnaYuGPOkTxPURcv+lnO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628182430, "uuid": "cdca028a-abf9-4a0d-9282-359d2176037a", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628182430, "uuid": "a8e79793-2d63-45a6-8257-c7e259119342", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628182430, "uuid": "c34a900e-089f-4287-86c5-90ef2afff5c0", "value": "1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4d16a9-f5b5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628144463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144463, "uuid": "c8eaffc4-d6d2-46a8-9eca-d39ee39bffe8", "comment": "Malware payload (NanoCore)", "value": "a1a147fd7540800331f4fe9dccc4311a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144463, "uuid": "0494fdd5-17c4-49a8-a2c2-0c03ba01e24f", "comment": "Malware payload (NanoCore)", "value": "5530fdb52c51e8820f0223d34deeb0d9416d6a1a720934bf1830bf630dd51b4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144463, "uuid": "d42c58bd-78b8-4a26-9cba-078f47cd337b", "comment": "Malware payload (NanoCore)", "value": "763487035a0395d4300952042500e8f01c7160bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144463, "uuid": "7522a4b3-aa90-4d9f-8fef-45b03bcdc2bc", "comment": "Malware payload (NanoCore)", "value": "31f7f803dc960484935e34d6de59a2d9d316956bb147980a0445c3f7f8e63cec23ffc2b71bf11ab638980aa2eef7a109", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144463, "uuid": "43d49338-46e5-4caf-882c-dcbe28e1c039", "value": "T1F064F10578C1D176E56508319D60CAB0AF3DF9341F701EEB778C9A7A8F346C18E26A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144463, "uuid": "f67187e5-0399-4b7c-9037-422f40087339", "value": "7f3a4a0e96d9bcc5b3425ad3dca611da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144463, "uuid": "ea893c2e-f08c-409d-aede-ef374f2f4d04", "value": "6144:oWrf0xh3Hfr5YwuLpVKKwBejzBkegc4LGt3fa2M8L4eT7nJukbsco9FUq0:Jrf0P3HD5YshUfLV4LGt48L4GkkbVonC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628144463, "uuid": "75bab0e8-49a7-4666-821f-c23cbbad5cfd", "value": 325648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628144463, "uuid": "34ebef9a-4853-455c-b6a7-3723e0d07a51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144463, "uuid": "267b2bbb-289c-48f8-aad2-32a9363befff", "value": "order list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6658d199-f60f-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628183156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628183156, "uuid": "03e86261-1cfe-41de-823a-9b19838537b1", "comment": "Malware payload (Loki)", "value": "bf696d255fc74e59ff0ce77824890406", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628183156, "uuid": "3db11b9e-039e-4b8e-a292-67e6b60a4b64", "comment": "Malware payload (Loki)", "value": "55dd34e26e94366e5cb30aa3fd40cd9ad85f7d4d36de6885084257290087ffa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628183156, "uuid": "691fc9ce-82d8-4c27-8912-57eda72a975f", "comment": "Malware payload (Loki)", "value": "c64b75fdbf2fbc9eb4abc14375623e2c4b95b1ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628183156, "uuid": "12c480b8-3038-401b-a30c-47f1412e79b0", "comment": "Malware payload (Loki)", "value": "083055d9bbb897f4f5cbd2cfbe0edd0d8d8835b14f5e7e3c70f1be19f7f5a67d05d818f6e237a1f080946a5743285bbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628183156, "uuid": "8c5a4c80-52ea-4112-bb37-c1484f5fc303", "value": "T116C48D2B15D44B17E57CC2BC2955926BF278DEC2B0DDDA8AECC33C83D675B4225801AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628183156, "uuid": "66625c43-fbdd-4ea6-b30d-534a19bb4459", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628183156, "uuid": "9b5677dd-c956-4522-9b95-d0162ad52988", "value": "12288:YXZJyk/a2Swlt4TDQz1s4lA27R2CRv/6Y9pDyHW0Hth:k1/wct4YznA2dzRvyKty2qh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628183156, "uuid": "14a818fc-ba62-4284-87b5-e61842fe2383", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628183156, "uuid": "721102ae-3a4f-4352-a40f-ae1a14386f1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628183156, "uuid": "c3151857-f746-4a2f-a0ec-2e4aa5113259", "value": "comprobante de pago de transferencia,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7ed318-f618-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628187217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187217, "uuid": "4bf34a6c-d43f-49d4-8526-488a1412aea3", "comment": "Malware payload", "value": "432a5b309d220458ec4ff487a30c5048", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187217, "uuid": "fc293685-0dc9-4309-b9ec-cb4f04f7167a", "comment": "Malware payload", "value": "57466da1095f6c28d5d7c56d171417bb796b153f1c545e846fee1743cacc15fc", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187217, "uuid": "98ba513d-606f-45a6-b620-3cb49675b33a", "comment": "Malware payload", "value": "b3f840e09ba724af15779296cb3a6423e3c9be5f", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187217, "uuid": "f5cf3684-ec5d-413e-9de3-f5d475081142", "comment": "Malware payload", "value": "5734796e5d3ab9bd49bd0248c0edc5b8dfd0cb93d39d794a1d3e087d09cd7ed78deea3bbbad921b801c154fce18455c8", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187217, "uuid": "c14ca1dd-cbee-4a66-9b4b-599a71796cc0", "value": "T1D3E56C23BA44653EC0AB0A3B6877D6549C7FFFA52A1ACC5A17F0094CCF395446E3A607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187217, "uuid": "f91c7eda-0489-4239-9ba3-7824c625abac", "value": "c9022e09c279f9b08397b5f90c6d0b23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187217, "uuid": "2b1412c8-4830-47b2-bfd3-2b4d34862f7a", "value": "49152:QHdQV/62t/jVKSAyUuZUMe+DzO7UjyXlZ:QHCV/6Y5ze+DzON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187217, "uuid": "c41c5eb2-f089-4ddb-8be2-4d9e8151464c", "value": 3268608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187217, "uuid": "c4b705af-2944-4aa1-954c-7dd29287bd87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187217, "uuid": "aa75b306-c2fe-4f1f-9b0b-0377b10552a8", "value": "57466da1095f6c28d5d7c56d171417bb796b153f1c545e846fee1743cacc15fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16217309-f5b2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628143078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143078, "uuid": "ef64ac5b-b55e-4d57-8af2-e8af51ebea1d", "comment": "Malware payload (RedLineStealer)", "value": "359c7ab488ee939900a61aed6f05c55b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143078, "uuid": "6851460f-78d5-418e-8f03-b553b7624a3d", "comment": "Malware payload (RedLineStealer)", "value": "577bbf239604ed454f342bdb85a2f12d460861440c11b372773197ae40310d70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143078, "uuid": "6ed59063-5ea3-4fa7-b69e-f4eff017c566", "comment": "Malware payload (RedLineStealer)", "value": "4c5139da680ab783f0c5c960adb691bdfadf3353", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143078, "uuid": "80b2a5c9-c92d-4c1c-80ee-e569032e4129", "comment": "Malware payload (RedLineStealer)", "value": "03d9e33e2e277891cc32ae98aa6b29595023275dd57de265764a121c1a0892cbd1d883906ea23444663a022d0b751689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143078, "uuid": "896d2f31-162d-439a-9aa0-dcfd24426aa4", "value": "T10DF4022266D18032F8734F3058E8A361EE75BD286675968FF7403A3D2B71AA2C71D743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143078, "uuid": "ad21330c-3820-45ef-acae-58c09f628a59", "value": "4cfda23baf1e2e983ddfeca47a5c755a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143078, "uuid": "7902b65b-6d09-41b2-9183-6ce25fed97ee", "value": "24576:Y20gPgFKFYQxAVBbIcXRA/EFTP/MMeO//:JKsxAjIE+/mL/MMeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628143078, "uuid": "d99e9802-6154-414f-9e43-572eb654fc35", "value": 788327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628143078, "uuid": "46c36698-51a4-4c9a-b185-320c98c8b523", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143078, "uuid": "5a2175ec-4353-4298-a37a-6be9286d9300", "value": "359c7ab488ee939900a61aed6f05c55b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b98f918-f5ab-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628140269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628140269, "uuid": "4d5a1cfe-3d88-4fbb-980c-1b1436a3929b", "comment": "Malware payload (Loki)", "value": "c439b8aeeac3bfcccc611b1bf6b810ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628140269, "uuid": "3c34ec6a-0d13-42a1-a9b1-5f764a35678d", "comment": "Malware payload (Loki)", "value": "57a8e3ad1acabf0501bab394fabe4bf264da09987fa4dc6a091414921b783706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628140269, "uuid": "f1113954-0542-4b93-9482-2dcb34296205", "comment": "Malware payload (Loki)", "value": "21ee54ea87b1cbad721db11edff073662cf7a517", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628140269, "uuid": "48318612-024a-451b-8791-73ec9230292f", "comment": "Malware payload (Loki)", "value": "9d992c2e7a2fb7a9ddbed85ee507bb8f723ac6ba4e86ebab32384f158ed6a2e554d88697eb470221ecb6c1c1f21c2a89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628140269, "uuid": "0f524ba4-e476-4180-b577-c5bdeb4dbc06", "value": "T1F214120072E2E43BD2952B709A73DB7AE8B2E46018351613BB65EF797D62241D70F783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628140269, "uuid": "3d972c55-b145-4700-8811-5a8ae363c5a0", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628140269, "uuid": "2559a852-31d1-413b-b7fa-4a03e733bcb2", "value": "3072:avoooSX4qZ1YzI0qEg6anPUKr6yPgJqEqpLJrlX0wNf1ily7ZLFHcyqa0TE85WQP:8ZX4qwURFnPUKr6tAEqvrlEwf+yVLF8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628140269, "uuid": "dc88f7f6-a19e-4f50-8638-1d4fe7552620", "value": 195452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628140269, "uuid": "008ec710-8985-4bd4-b9f0-820296264d54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628140269, "uuid": "160e8201-be93-4569-859f-7468665ebc58", "value": "57A8E3AD1ACABF0501BAB394FABE4BF264DA09987FA4D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60af3864-f5b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1628142345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142345, "uuid": "aae7da88-19a4-4c60-86e1-e71d1c73c923", "comment": "Malware payload (AZORult)", "value": "30252d98648e426c70287bb4f0f4b8fb", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142345, "uuid": "8636656c-0ea6-45c4-b826-32957bde5e20", "comment": "Malware payload (AZORult)", "value": "57f0ed548834dae8947ee1e4ef77b1780cf929af0aa406dcf2b4e06298607809", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142345, "uuid": "edfaead7-8a34-4993-a392-9289f2973715", "comment": "Malware payload (AZORult)", "value": "58a0f69a9c743639e2a901b76e97edda4a154226", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142345, "uuid": "5f5fa4e5-c706-42a2-a7c9-a6080b8ba1e8", "comment": "Malware payload (AZORult)", "value": "1831ad6e6eb9e58d2a3626e27204f126c64c617804c68ad8dc0510c061e16cba88f6b3b52898ec4d82ec966856d7d738", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142345, "uuid": "53ae8705-b7eb-4655-ad14-82c88cca01fd", "value": "T1A4F10912B7DCC332D9790E365C6652400775EB4ACC6B9B6E988C212BAF6730146E3BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142345, "uuid": "9329be78-be5b-469a-8d5d-5a9a78118243", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142345, "uuid": "8881a8bf-cd5e-473b-a5c7-396821058b66", "value": "96:Rn227jpP06Dm53Xr9Zsr5+XzYeoTbWqTxx7ic53pAfdtDG1zNt:R5jBy537bsr5uYLTbWqTZ5yfd5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628142345, "uuid": "c25578fa-e1d6-43ce-92c5-c32442ec0990", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628142345, "uuid": "00b64d99-4b70-447e-b61e-efed696bd62c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142345, "uuid": "7f3863d7-570a-42d1-9bd0-950c6186a91b", "value": "RECEIPT_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7f3fb2-f5bb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628147148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147148, "uuid": "7c04af41-5091-40fd-b47f-55d7633a3a6e", "comment": "Malware payload (RaccoonStealer)", "value": "298601028f5d88781a22dc94500b7607", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147148, "uuid": "9bf47bfe-7c62-4b4e-8b29-13f56f61dc90", "comment": "Malware payload (RaccoonStealer)", "value": "58290a4919362f3f76725d0cd01e812f6207d415017b91434ea7049b04c842b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147148, "uuid": "7d025f7f-e1ea-4163-b6ac-42ab23c5d8cf", "comment": "Malware payload (RaccoonStealer)", "value": "442c777c6945944d7776f2808b43d688daf576fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628147148, "uuid": "485a3ae7-af3c-4e21-9e79-3d21f3670548", "comment": "Malware payload (RaccoonStealer)", "value": "250eb0aca9dc6971797e685f162ea91ad43ee2b919f0ab49eb557b935303e62c3cd1745a317dc544d46843b22e23ebe2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147148, "uuid": "8b402667-7afb-49ba-9bc3-b9251dd0da3a", "value": "T1C3A402123E81F037E2E15674096AC6B19EA87C745D786B8B2787565D2F227C3EF16302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147148, "uuid": "42c70688-f7be-422d-b087-37e476b652c9", "value": "2a9c1ca66125aeff7a1c36242be63d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147148, "uuid": "b280a544-b244-4ee1-b3c1-2b4fe9128d69", "value": "12288:6XI5Wtx5emW+2sq+SQB8O9K0AE/6UXsMU:6f57N3DAEh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628147148, "uuid": "4a24acfc-4af8-4acd-bec4-d2e8c28b6bc3", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628147148, "uuid": "a6183c73-eeab-47f7-9467-f1e741de9aff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628147148, "uuid": "3440b330-d0fc-4c22-87b9-988c70481bb6", "value": "298601028f5d88781a22dc94500b7607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef72520d-f59e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628134853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628134853, "uuid": "a4dfb810-6e2f-4211-a9ce-28ffb6d354c7", "comment": "Malware payload (NanoCore)", "value": "98b82195aecd8942d2965b81f411eaaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628134853, "uuid": "aeb46953-75e5-4a0e-81af-d6a528dcac3b", "comment": "Malware payload (NanoCore)", "value": "588b25087097e7c8aa47d12876af1c3fa939a34fdfd22b26884eb60ff9f7371a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628134853, "uuid": "4749f8c6-b2d5-4069-9e03-bae00f114c77", "comment": "Malware payload (NanoCore)", "value": "694ed69b2b91ce8fe9e895dc28c29d628c482264", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628134853, "uuid": "302c08e1-5382-4b94-8f45-833395739302", "comment": "Malware payload (NanoCore)", "value": "be7ab28cfba6eb28becbbecbe9eaab74ff7a0f51e1eca4ab818b41655d29e0f57b1c92343af557597dd09d96ef3fa3c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628134853, "uuid": "7be82e0f-eed3-4161-b2ec-54d197f103f7", "value": "T1E845F0E5E7D89463C057267489BB5A623F22FB925B29410F2630F45E2C723D2FD21E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628134853, "uuid": "cc692fb1-8066-4661-b56b-5f37998af2df", "value": "3e5b9923ab1e9eb27fe6580af9265696", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628134853, "uuid": "4126c8a9-03d5-411e-bb29-556f5ccdcfde", "value": "24576:4dOxLFDApSPKk48br94A7KleMjbrnsuuxelFN1zcY:4iLFssPH48H977KKu3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628134853, "uuid": "3b5edc6f-684b-4d6c-a942-4212a211e290", "value": 1243648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628134853, "uuid": "d8ca56ee-ce0c-465c-b3ea-2b6752b7f973", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628134853, "uuid": "0ce4cb3c-9912-4150-ba16-951e19ac9eaa", "value": "588B25087097E7C8AA47D12876AF1C3FA939A34FDFD22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17c994e-f618-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1628187201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187201, "uuid": "6af9f486-12d0-41b0-a896-04f3c4a2af6a", "comment": "Malware payload (njrat)", "value": "ac38df856a40de55087a983227cb8109", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187201, "uuid": "1551c82f-3e78-4512-948b-7534fd42caef", "comment": "Malware payload (njrat)", "value": "5d52f58a75bbe7519bbcae8333e91b5dbcc8459bb23bb01d077d5c51954c0ef8", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187201, "uuid": "028e16b0-7d93-486a-a471-101b739a341b", "comment": "Malware payload (njrat)", "value": "93721ca83b4da6778492db4642111dbd32b97aed", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187201, "uuid": "a7a776c2-a58e-48fa-9bf6-89fcc2e75e85", "comment": "Malware payload (njrat)", "value": "21cc0a226abe31e989493b3234f7316b2803f652ce4bf6e2512bbd1037498b69245c436922b27039b98078c743d05add", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187201, "uuid": "e0755cbb-f16f-488b-bb31-f09663a45d3c", "value": "T16BA2288E3BA4C624D3AD1AB68CF3A32093B6D2878542EB4E1DDD919B3E333804544DF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187201, "uuid": "3d0b3a82-26a9-434e-b704-c7f403b7295d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187201, "uuid": "96a7439a-72db-478d-b6c4-d8b2f372c6c4", "value": "384:6HVGj4DnU+P24h/WHuvZVog9PFw6TdcF/l34ZoZSTfN:6iEKuvZL9PO6yt0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187201, "uuid": "00c0f1bb-e7ec-4bda-920e-ea8c7a10580e", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187201, "uuid": "7b478dc9-f3cd-4815-9a03-e9ed41095a32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187201, "uuid": "228ccc71-e029-4bc4-89a8-5c74046a6a70", "value": "5d52f58a75bbe7519bbcae8333e91b5dbcc8459bb23bb01d077d5c51954c0ef8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff913b7-f648-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1628207493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628207493, "uuid": "b9703ad8-d341-4b81-bcde-7b5b160ed505", "comment": "Malware payload (AsyncRAT)", "value": "f9aa0da1d22e2f553aff22b60c476c02", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628207493, "uuid": "ce63c356-bc8a-407a-93ed-d27a6a6b3201", "comment": "Malware payload (AsyncRAT)", "value": "5d58c5fa7aa0f5a8c4d2448b0f5fbb8ffb835228bcb3e4b6fa53f5593a2166bb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628207493, "uuid": "abc26dd0-941a-4ab9-871b-ea83cc00e5c6", "comment": "Malware payload (AsyncRAT)", "value": "f6b0dda01b9dfb7f9f3f3a66f7abd11732fd4245", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628207493, "uuid": "c1548ae5-8e00-497d-b863-ea4d0c999933", "comment": "Malware payload (AsyncRAT)", "value": "25d7b01680e6eef2b244122aecccccce03791344f4247174ed4c096aa98d4de9ff532737b600d3820d966af13a09eb43", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628207493, "uuid": "2bf1f41c-5fc9-4580-9403-a8cc771f58a5", "value": "T14655012589C8DBEACC9D0B720F4C02607DF1985571B1FAB63E8A07B4F6C8E29E575706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628207493, "uuid": "1f7d657a-4824-48ef-bc6a-dee1807c8a67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628207493, "uuid": "c421468c-b77b-4cae-bd78-dd9ac828bd57", "value": "24576:TKNqwYdkExzhH2bZTrLrr64D9mwRGPoN7vdiTbnFMu/dvv:TBBxzhGTrLzD9m/PoiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628207493, "uuid": "2f346e02-eb89-41e9-bf7d-db15d48f3067", "value": 1300992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628207493, "uuid": "256dcf8c-74b0-4950-85da-e369c4826ef7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628207493, "uuid": "8d8a4527-f85f-494c-b1f0-63054ceeaa27", "value": "f9aa0da1d22e2f553aff22b60c476c02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93b79b9-f616-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628186409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628186409, "uuid": "b0ac732d-71c2-48be-a05f-281e8ab4b682", "comment": "Malware payload (NanoCore)", "value": "619f78ef9ff635a3aa11d199ae1cd000", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628186409, "uuid": "fd38108c-b11b-40fa-96ac-b905d7e62eb9", "comment": "Malware payload (NanoCore)", "value": "5dcc3b735a85c101b06fd9150694f6a3fc626de9471669f6b99f2d14be844c0c", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628186409, "uuid": "235115f5-dd86-4456-ba61-8c6761c23053", "comment": "Malware payload (NanoCore)", "value": "536a19e8974b5c90256010b41898e78b6e5a2d09", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628186409, "uuid": "476e1ff2-2d59-4d0e-90cb-0ff241bc423a", "comment": "Malware payload (NanoCore)", "value": "bc286145a3a4c014f7ecb528bd59cf48eb5967beca5b7a8b2f01cfa54aaf825c5d365f4c822bf2987524134b1cd328d0", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628186409, "uuid": "87708e75-39e6-46b8-a5d8-f9d2399aeafd", "value": "T19575D07699F37C58FDED09A22E151C538C100F1F96E24648E692B7F85AE6C01EF290F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628186409, "uuid": "0cc4ad4f-b1f8-48eb-a53f-5ad2cba5b9b6", "value": "24576:I6ppgS1tE0CGUX0FQJ6TQha2R7Q+9+B/NVdIzc4oJAA2wfmgiyX2P5srwTW:NO01MJA2mPxJL+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628186409, "uuid": "fa742c23-5872-4ea6-a74b-5cc4b640217a", "value": 1621040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628186409, "uuid": "91942f7f-d876-499d-96ad-e9a5e10f67df", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628186409, "uuid": "9fca1a82-5ffe-45e1-a4f4-57d52f5820e1", "value": "PRODUCT INVOICES_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626c9eb2-f5f4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628171553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171553, "uuid": "78b71508-99bc-41c8-bfb7-57a51fcd82b4", "comment": "Malware payload (Formbook)", "value": "aff3c186fad17cff411da9fc003313b1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171553, "uuid": "dad8cf6f-18dd-4319-9498-2c4193974184", "comment": "Malware payload (Formbook)", "value": "5e019efe4f395e59309e1639d81db03d57919316eeae7f2ab26c29685886c163", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171553, "uuid": "7e51673d-21b6-45c6-a90b-b678950b9a20", "comment": "Malware payload (Formbook)", "value": "12a72f321229143e3d05956344d17600e16e2afa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171553, "uuid": "e3ee5873-aca4-45c6-8ddf-d84bf63e4807", "comment": "Malware payload (Formbook)", "value": "3ff062c21b2e0cb07755836c279dbfdabd1d99adf2e7d2608bb22564dc6f5f63075a9930ffe9b891d9ed0635052a6ed5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171553, "uuid": "b40d5dcb-6c1b-4de4-866c-f65685398f5e", "value": "T114551207CE289F87C419C3FC7F530E782B1F5608E8867BEA157A4DCA2B546654E9F029", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171553, "uuid": "7dfadf03-cb89-4a68-bab5-1192ece47264", "value": "24576:vjzGOa+lFRgYikxLjG/4hSrXzA4jmaYmqlk+l7oqvZbhsBx1bF07nb0Gkh9df5:H7a+nRqkxLi/4s4omJ71DcxD07nj6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628171553, "uuid": "e2ed99bb-17bc-43d8-a564-c35eac727c2c", "value": 1332169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628171553, "uuid": "4ba89162-3317-489f-bb11-b051be1d9f1c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171553, "uuid": "fd15dd44-9faf-4588-951e-e2dd9d615b14", "value": "REQUEST_FOR_QUOTATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4beb779-f605-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1628179100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628179100, "uuid": "2c573b43-c38b-4174-8c1e-b31928ff9dfa", "comment": "Malware payload (TrickBot)", "value": "180da095d8555127d0b820955514e835", "object_relation": "md5", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob120", "colour": "#9DB942", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628179100, "uuid": "4a1bf761-c499-4b96-9241-175f868619f8", "comment": "Malware payload (TrickBot)", "value": "5fbb240503648b2446f2a39c3e7b0fa67abbafa023859d8d055019598f0cdb58", "object_relation": "sha256", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob120", "colour": "#9DB942", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628179100, "uuid": "d343b4ef-5c1b-4978-8ffb-faa14b6092f2", "comment": "Malware payload (TrickBot)", "value": "22dbbe0a4e071dc4b85a9c048c2221b90023dc9c", "object_relation": "sha1", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob120", "colour": "#9DB942", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628179100, "uuid": "90d86b8c-ad4a-4e31-a40c-ce490dbe9895", "comment": "Malware payload (TrickBot)", "value": "bcea7349af9da030b5e5350d4b5be119825667e83008d402376cbf0c6faf1a26133c88586b6225c94495d0955c14e888", "object_relation": "sha3-384", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rob120", "colour": "#9DB942", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628179100, "uuid": "feb2e242-50ad-4f80-b718-ca5a2aa38996", "value": "T146727F6CABC1F447739C0F23AF101BE9C176ACD395C8769B89583A5D19DA31BC6B1CA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628179100, "uuid": "b1bfce7d-cbd0-4af2-a90f-20d1d474ce85", "value": "192:D1FVvtsL/0+OMym44ImnbrlUcypn1VY3woCuvaM3:DbXLMJV/JS+33L93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628179100, "uuid": "a0e3088d-e878-4047-acb1-b662a9988b7d", "value": 16671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628179100, "uuid": "f3f66731-4988-486e-b07b-4cb8307c5026", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628179100, "uuid": "5267418f-9d10-4253-aec5-6a322697c402", "value": "00283_938983 - Copy (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4de50b5-f5e0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628163209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163209, "uuid": "ca10224d-b7ea-46c0-a7a9-7becf6160658", "comment": "Malware payload (Formbook)", "value": "a478fa7b85fb8adc1e6abbcf8a5370df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163209, "uuid": "6fb153f6-598b-4b95-8e91-3545c223cce4", "comment": "Malware payload (Formbook)", "value": "6137b2968c98b110deef11d69b037a5d541b39b930628d12881b6daa5bdb9bb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163209, "uuid": "5556b87c-b1f2-4e48-a7d4-181d9409cb77", "comment": "Malware payload (Formbook)", "value": "5fdecece7114b66ece84ced8d501a66b1261447f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163209, "uuid": "f0311b69-91b8-4107-8c78-daec4fa64af4", "comment": "Malware payload (Formbook)", "value": "4b7a22d2c70c9c985e099f5304e6be6fd5493d613b1d5fbdf71ae6e148c197a512bc9838109d95d05fd3fc11ec865d76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163209, "uuid": "240ac288-b076-450d-a67a-ebdca6591058", "value": "T187156B2229EF158DF3B29B764FC4F8BE56EAE573570AF0B638910B464322940CD61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163209, "uuid": "de091b37-c3af-4517-8380-b6ccb7f22edd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163209, "uuid": "04c3b644-28f4-4229-ab10-7115df9ad41f", "value": "12288:13VoR65AXwgFvuSSWs1qTEbWX43/LWL+7cYje9mcbEG8mj:1FoR6qg6TEaX43GYKM4EE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163209, "uuid": "7089a5f6-4243-4b45-bbbe-3e89498f387f", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163209, "uuid": "ff428a91-b87f-4a83-8e11-7370bef95880", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163209, "uuid": "68e13ef8-7a10-489a-9741-9d82e2ce2cbd", "value": "00008765 20210805 order88567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0438ad40-f619-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628187287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187287, "uuid": "68886c2a-c8a3-4555-a9ae-5311ca2701d8", "comment": "Malware payload", "value": "5d54adefcf435c4e9f1705df690386c7", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187287, "uuid": "184eba75-313a-46b3-a175-d22db33859cc", "comment": "Malware payload", "value": "61df42b7f0e35797015ce24115e0a5e61ccaedae818c9389e6cb5d905f747020", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187287, "uuid": "0a7d8e6b-86fb-4f72-8151-5ce79a829279", "comment": "Malware payload", "value": "48cae7a32ecfa02d8df9a4572108dd1eca03f71e", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187287, "uuid": "22548bc8-17c5-42c4-8b3c-0989356aa80e", "comment": "Malware payload", "value": "30c422ad0557a85a7665ae63993a11eda9e29caa88c197926580b84bfa5cacc08b71ff27f698648686f6c4bdb0b69c20", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187287, "uuid": "ebe331af-d9de-41aa-bf2f-5d7d75a6fd68", "value": "T1D5620A1DFBE88776C5ED5EB109B3A60413F8D2128513EF2B2DCD68AB6F6379506013A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187287, "uuid": "d55f64ce-0331-4740-855b-70cc59123c3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187287, "uuid": "b7152f3a-fe00-4059-aea6-fb12df3055b4", "value": "384:CrSKMSJVGKXHehhCHNddfbY9z/AtTw74x8G:WgSJVFX+obG374x3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187287, "uuid": "75d5624d-d5d6-4086-811c-eafe02458f63", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187287, "uuid": "94ef46bf-4cb0-4e35-9c74-caa001a3af5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187287, "uuid": "2f70b27e-8ea4-4d61-ac0f-df84560e02bc", "value": "61df42b7f0e35797015ce24115e0a5e61ccaedae818c9389e6cb5d905f747020", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f69424-f5c5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628151606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151606, "uuid": "fbcc37ef-ebf7-4e25-a74f-8dd9d38378ef", "comment": "Malware payload (AgentTesla)", "value": "1aa098f1192085265284be05137384f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151606, "uuid": "8bcc0930-f126-4dbe-96a9-3cd1975b466c", "comment": "Malware payload (AgentTesla)", "value": "61ff536f01689f4b04f0ab41d3f6e217391f255191893f1faedd6334a72faa36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151606, "uuid": "0a61dde2-94d1-42a3-9b5a-534289ffb0e7", "comment": "Malware payload (AgentTesla)", "value": "ae8274f18f2dcc5ce147f2cf7134abda1d8dfca6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151606, "uuid": "44307467-d5fb-4975-b4e7-f589e2af9874", "comment": "Malware payload (AgentTesla)", "value": "1c993c5a0b8b2fa497aab7297aba0e95e5d317b83cf06388cfee22f73d11d2ce96adc64ee3b8c54fc8e8d653bbb9d5a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151606, "uuid": "254824b4-0017-4b71-a230-c2d13addc096", "value": "T1DDB423197CC77B3EBB97800EB5153035842ED66D3324BAEE1B201E2CAD1E555AB3D272", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151606, "uuid": "78ab7b92-3c0b-485a-845c-2c00a2f64421", "value": "12288:Hmn0HK93fOy2vSYF/SDHfNZZOQkdpOj/Kmlg6qIPkHi:Gn0HKcSY9wNZZO/pWTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628151606, "uuid": "b6cfc17a-8887-4f05-8de4-f305e1459546", "value": 526011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628151606, "uuid": "ed933793-b9b3-4b20-b9e2-5b7d4a3178b2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151606, "uuid": "6d394df0-e983-4653-af52-6f9f216d6fa5", "value": "W452-001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8bd4bb-f5dd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Pony)", "timestamp": 1628161885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161885, "uuid": "9c56da1c-d79f-45cf-b9a0-9cce7d7f54e0", "comment": "Malware payload (Pony)", "value": "299eed4b567d8c3448a27953348dd63d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161885, "uuid": "bd6b94c7-eec6-48ce-ab34-a7d35bc6dd26", "comment": "Malware payload (Pony)", "value": "622b4966cead9f36806f4f8f382925142849f5f8434a3e22396f923ecc228f65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161885, "uuid": "c0f0194f-e6ec-49e8-b678-7a87966f9b4f", "comment": "Malware payload (Pony)", "value": "3bad07f34ad1022c460561b9f5eb4638c0316f09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161885, "uuid": "32d0495b-f305-4b9b-989c-a2499421dd7f", "comment": "Malware payload (Pony)", "value": "a151375cff21b70b557b560ef3de53e41dc604bcaf30a8a058ed2698da95aa1e8e243663b247fd4a53a60128204d84d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161885, "uuid": "27985ad4-5160-42a8-b515-0b8f4c747211", "value": "T158E40A3E00E73CF3D090E2BDA7E266B4AA704D0AEF9C67E1125BB47D4DB4D59102E256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161885, "uuid": "b20be405-3ff1-4393-b79a-c8f572250fe1", "value": "c77c79e817d9ea724447a07f5b5b7427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161885, "uuid": "70f49eea-838c-41fc-84dc-48743382df8d", "value": "12288:MLJw4WKVpnO5GM4c1P2cvsH68CuitGB1s0Gg47uoqcYcmYOlsSlFxqllsxsY6ZiC:MLJwsVpnO5GM4c1P2cvsH68CuitGB1sw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628161885, "uuid": "92d04cbe-9984-460e-acc4-e3c31d57e0cf", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628161885, "uuid": "8b8ce4cd-b5a8-4bf8-ad4e-793111b85a05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161885, "uuid": "4f9323dd-559b-4ada-b4e6-4aa5c6be1016", "value": "622B4966CEAD9F36806F4F8F382925142849F5F8434A3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98baf308-f61a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628187965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187965, "uuid": "f7cb227d-090c-4048-8f6e-43540d60d9fb", "comment": "Malware payload (RaccoonStealer)", "value": "1551247aae88666392259bf614114b6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187965, "uuid": "7b1ed294-b704-4115-b4ef-35b3eeb6a88b", "comment": "Malware payload (RaccoonStealer)", "value": "624a60d00b8ca1fc45c0d83235eed131c13ca9cd9f89423229666952d1722beb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187965, "uuid": "ce21461a-3ce0-4906-ab67-564c0324851e", "comment": "Malware payload (RaccoonStealer)", "value": "d6477e6756927ff9426b2d920804d3409ab3faab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187965, "uuid": "90fca2eb-9fe0-489e-bfa9-f22bc7d4f63b", "comment": "Malware payload (RaccoonStealer)", "value": "67a2e1792453daabfc006d3bed945186893f06c8f647d5bf95955d70d62fdb400122b4bd400c958d742edadea0d6a7ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187965, "uuid": "76b5b7b4-ba0b-4bb5-b043-1a6b4d96cd17", "value": "T1B7B401213185CC32F110FDB15855C6A69AABFCB4C9249A573F99A7BE3F222D19F31306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187965, "uuid": "6d388ae1-d81d-4255-87c4-89c5c2996b94", "value": "c36bba2f7ed1360c17671decb7b1e9d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187965, "uuid": "dbd7c654-24f8-42af-9ea2-e43f52d92bb5", "value": "12288:IbJow7N+Z25frkZrAkUAzGejqc73JCDPPXYL:IljNFxkdv2c75CDXYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187965, "uuid": "051080f4-ade0-405a-9b5f-3db7cec3ecc2", "value": 510976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187965, "uuid": "d1caea73-ef39-42d3-ab97-d92a6b372a94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187965, "uuid": "6b34b030-8408-4aaa-9e2e-8f01ae0bb863", "value": "1551247aae88666392259bf614114b6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad10860-f604-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1628178359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178359, "uuid": "492857c1-ea5c-4134-881a-1f6a78358da6", "comment": "Malware payload (Stop)", "value": "836d680e3da7daac544bfb8d3d5f1cc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178359, "uuid": "c3bc02e1-a543-4e83-a2e7-49a7d5467cfb", "comment": "Malware payload (Stop)", "value": "63c696185eacdb5998d82e02e8cc0afd09db991ece9f72f5e99007e2aa36f4c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178359, "uuid": "084754e2-4e7d-4122-bab9-e8d37f8251a1", "comment": "Malware payload (Stop)", "value": "04b8e4153a3f629ad04eeb1327cd579faa684d3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178359, "uuid": "fea93147-6d60-4fd1-bd58-85934c98da78", "comment": "Malware payload (Stop)", "value": "6b7480077649ff88cc78f3beb2695c0f255669e9a05588b626ff3d225f5d61a4ede174727c6286656b073f52a327b6f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178359, "uuid": "f8eb4f31-ec52-42e8-93be-bab5cadb10b4", "value": "T103F412063E41C177E6224AB4DD19C2F4ABB27C7919785D4B3F94E39C9F32292EE19342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178359, "uuid": "76b0d91b-20c5-44ff-85be-20569cf4a5eb", "value": "2a9c1ca66125aeff7a1c36242be63d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178359, "uuid": "c7d89c6c-cdfb-4194-a85c-ba637b719b00", "value": "12288:Z+xbCA0/na8ZKtuUwlzRGXgRrVQ3U2C0Xbn9UpzzfksdaiDN5dy:Z+sAiBKbwRRGwRZYU2Vrn9UVkyN/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628178359, "uuid": "08c0536c-940c-4dd1-acf5-6b4d9ba39743", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628178359, "uuid": "0b3fc74e-42bb-4137-9b06-5b7296d8b969", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178359, "uuid": "3fad14d3-8e8f-4c61-860a-cbd5438b26e4", "value": "836d680e3da7daac544bfb8d3d5f1cc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e84d71a-f5cd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetSupport)", "timestamp": 1628154796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154796, "uuid": "d718902b-832a-42ef-bf84-dc42978432c7", "comment": "Malware payload (NetSupport)", "value": "85c6ab4916dad9444c1ca9f8bdb42a97", "object_relation": "md5", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154796, "uuid": "cc5824d4-df9e-4a41-859b-8fe8b8a70191", "comment": "Malware payload (NetSupport)", "value": "64caca487c57e5ea5952df3ccfe5924cb18f66f8653fa6fe156ef30604dfb48f", "object_relation": "sha256", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154796, "uuid": "a19b8842-9994-4b4d-85b7-1b8681c24515", "comment": "Malware payload (NetSupport)", "value": "2d78ce63220b5f86a367c2fe8e3e34686a1aa103", "object_relation": "sha1", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154796, "uuid": "a171ff44-73c8-4146-bae9-fe5ac72bc521", "comment": "Malware payload (NetSupport)", "value": "d9430bcb180d89fb5ba7a0f397b889104172264af2287f6b3bf2c51026eff9e71b4c81fd2d2096d051535f1019143f85", "object_relation": "sha3-384", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154796, "uuid": "568af217-b0fc-48e7-a970-340d9abfb03b", "value": "T1DA061202788690F3CBA0DD712B555E19A9E53C101F07BAFA6760B6F9AA32F50772071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154796, "uuid": "476ef583-9c5b-47a5-9a05-5dae813e7261", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154796, "uuid": "26f037f5-6570-4137-ad1f-fb5b7fa46dba", "value": "98304:NeryXGHprtcmgyKexolnCpZwxzfOBLUF8ljRY:unZczZ2azf4Am5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628154796, "uuid": "40f2cf7c-8b5f-4527-85a7-a2c854a720e9", "value": 3703904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628154796, "uuid": "0249ed11-411a-4b82-8657-a0a5ad3cb45c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154796, "uuid": "c76a366f-bd70-483e-8e50-579c8b1af40a", "value": "64caca487c57e5ea5952df3ccfe5924cb18f66f8653fa6fe156ef30604dfb48f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa6da83-f5cd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetSupport)", "timestamp": 1628154924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154924, "uuid": "08e632f3-7f00-4a7c-8820-d6e23467ceb7", "comment": "Malware payload (NetSupport)", "value": "7b3fad053f48326b3d69ce2ef83baf38", "object_relation": "md5", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gavrilov Andrei Alekseevich", "colour": "#6EE303", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154924, "uuid": "66a83c1e-c553-45cd-a0bc-b32f30176150", "comment": "Malware payload (NetSupport)", "value": "64e5b32569d9f0f8494b23e6ed44b0f5ab5fe96308751cf3c0b0bdbe82d88605", "object_relation": "sha256", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gavrilov Andrei Alekseevich", "colour": "#6EE303", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154924, "uuid": "29f28d58-8b59-4f64-be37-706d50bb6b9d", "comment": "Malware payload (NetSupport)", "value": "304a1b55953b91822ee9b3eb4f8c6162eb39cf3e", "object_relation": "sha1", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gavrilov Andrei Alekseevich", "colour": "#6EE303", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154924, "uuid": "27c5e1d1-a5c4-449a-b843-129458af3686", "comment": "Malware payload (NetSupport)", "value": "aab6464f383605f774bec271ab3309737cd9f49af87f9b096b1fabf9f73d2f2fbcd9360791c8627d02cbcd2322789ab6", "object_relation": "sha3-384", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gavrilov Andrei Alekseevich", "colour": "#6EE303", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154924, "uuid": "237f6594-6bbd-4bf0-b26d-3014eec636d1", "value": "T1B776223FB268653ED8AF5B3245B39320997B7A60A80A8C5E07F0491DCF665702F3E715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154924, "uuid": "0c4d0ece-1802-43c8-a45a-91f1d41fe734", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154924, "uuid": "d3c4501b-f6c6-4699-adca-35c5de288fca", "value": "196608:ad/tGPPLAczgTTgvlHcQZyu2WyYGqGgujZ+FT+8LsOxtl:uULJcT0vlHtZyu2FLv5jtotl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628154924, "uuid": "8bfa35df-3644-4938-913d-58d804984b16", "value": 7299416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628154924, "uuid": "c7b42435-06dc-4521-aba4-8e3220458837", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154924, "uuid": "4da533d6-d68c-40c8-97ec-8e76eb0f9ebd", "value": "64e5b32569d9f0f8494b23e6ed44b0f5ab5fe96308751cf3c0b0bdbe82d88605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76782232-f60c-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628181895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181895, "uuid": "97d1d4a3-5a53-4228-b4ad-f0d3f1e64628", "comment": "Malware payload", "value": "18c98f2e25eeea16f02024851c8fffef", "object_relation": "md5", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181895, "uuid": "c2edcad7-5980-4bfc-823e-688a0d089a03", "comment": "Malware payload", "value": "64f9057276536131595831b6fc1346b127dd2751b8ab60deac6f33f7abf92187", "object_relation": "sha256", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181895, "uuid": "c8e53e34-5896-445c-946e-150d800cbe41", "comment": "Malware payload", "value": "b25bfa369a838d8158d1dd87f22195025f49f40e", "object_relation": "sha1", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181895, "uuid": "deb6d0eb-e2a5-4406-8ccb-0b37bb9d6703", "comment": "Malware payload", "value": "1b74273f7ac44c0f8d93a16e8a2692d7358ce145d9af6c44921dd139adeebaf7dbd71854499f2c597f5656d519c4346c", "object_relation": "sha3-384", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181895, "uuid": "afc1deae-7572-4a97-be0b-a3635e005dda", "value": "T131528C3CD706BFA8D87B153D405422F7E64988936225A99DB88A724C43006EB636EFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181895, "uuid": "f8955cad-668d-419f-a2b9-4a3982cd9798", "value": "192:CtYqJTZNtBWAyX6Cko4hQrCnKrgZh+pVPSaPuU2JDYANkwvu5JLraPhxMh:aYqJT7tXRvnKrA+dGaANJKOPLMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628181895, "uuid": "71d3847b-6dd3-4365-9595-782c2dd783f4", "value": 14106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628181895, "uuid": "d29285f0-9730-49d7-9732-5c764a39f331", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181895, "uuid": "802d4c69-353c-49de-adf6-ff0606e96eef", "value": "text1.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba8d2ba-f5d9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628160053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160053, "uuid": "31608858-1489-45fe-813b-6c54095b67e8", "comment": "Malware payload (RaccoonStealer)", "value": "be366f6caa7ec9f41728cf7202cdccac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160053, "uuid": "5323e812-fbb0-4c97-83a1-3c6534a851f5", "comment": "Malware payload (RaccoonStealer)", "value": "657ef0ba8d26586758c89ddbb7e77b2cfff82e1748a0d955ec3121eba6f986b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160053, "uuid": "4150571a-d93c-414b-91ed-99c0f604af01", "comment": "Malware payload (RaccoonStealer)", "value": "311ed77a4ed989a62d63428501bf0f5be83fb767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160053, "uuid": "8e606b6f-db8e-4d13-b925-a93c1b354f22", "comment": "Malware payload (RaccoonStealer)", "value": "72b27ae98409c0c59a4ba0b2da23df751c25e92838b455f08c9810cfbf47da14a70ffb2668f4cb196ff22e8080867e23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160053, "uuid": "ca3aafbb-4049-47c4-856f-7d865408470b", "value": "T153B402113659CAB3E3511631083EC9A5EB69BCB10E78494B3BB1A65D3F612C3AF2D335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160053, "uuid": "c000dcad-09d7-4e17-b48c-74da30e59b4f", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160053, "uuid": "65d6bdb0-6fde-465d-ab4d-c212f2e79f5d", "value": "12288:6JpgpclZXc8kJfOiwmbhJ3wokzdA+xXZ:Kgpcrc8Xfihqogdvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628160053, "uuid": "d3e5aed3-e10d-49de-91ea-a4741b658d42", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628160053, "uuid": "07a36ea1-4517-499a-8b58-ce182499d78e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160053, "uuid": "6ee83c31-4468-40b4-b6fc-ab8467fbff5c", "value": "be366f6caa7ec9f41728cf7202cdccac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8827b1bd-f5fc-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628175052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175052, "uuid": "0bdf12a3-dbb3-458a-abb0-e525126fd9b3", "comment": "Malware payload", "value": "e802022f5ef47ef19e34fd83eb35a118", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175052, "uuid": "23828189-f76f-4333-a7af-658d0e289c1c", "comment": "Malware payload", "value": "662465eb6766f2084ca2756ac99e598623c368ae072a46d7810f7caaad4ca68f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175052, "uuid": "598685c0-4219-4a7d-9f67-789e73477605", "comment": "Malware payload", "value": "3af2b49724fbb85b9387cf6765e695ad0ed156a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175052, "uuid": "700e0f02-099c-44b0-8e3e-a3399a9a0c02", "comment": "Malware payload", "value": "e94d057027bc8cb79cb8c14c560a1de5b67fa42e9a0e7a369b16858be5b3f14834c390b30d22f77c5acfabe5e0abab93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175052, "uuid": "ed3585ed-fb6a-495b-b901-8e17ffe73e40", "value": "T1F9859E137985903FD26206328C6FAE7042A97E775A314657F698FF1D2EF0482B927F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175052, "uuid": "3fc582b3-af78-4c4e-ae98-bd6f7649cf77", "value": "fdcbfdff3fe99953a080ac7891a20374", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175052, "uuid": "d9c4e96f-f3b8-4360-a87f-0fee0ca2534b", "value": "49152:qDyo7MklXa+1NI9Z7STflGGmjKp12hocjh:dOMklq+1NIdZKKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628175052, "uuid": "30f1eabd-d6e6-4f11-8611-71332e3bcda4", "value": 1829424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628175052, "uuid": "1f095d9a-8aba-45f9-aaa9-eac1cb68f840", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175052, "uuid": "1b4036de-a71c-4618-bcd5-7a69a9c39135", "value": "GovILCardSignSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa3c96f-f5a6-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628138039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628138039, "uuid": "e272d2a4-62fe-4a3f-8003-4a02d3d0aee3", "comment": "Malware payload", "value": "8b910619e60a80ec48a3c171ec20dc99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628138039, "uuid": "a05af2e3-1fe8-411a-a844-c4a1d242fba9", "comment": "Malware payload", "value": "662c88c4e608ecb3c0d5b9104a12a42154df357b743af6557cbd7c2cba2fb51b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628138039, "uuid": "27c06a0d-e5d1-4d22-84e0-220597034024", "comment": "Malware payload", "value": "cc71941c4f3507b3d0e418957939a514be09838b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628138039, "uuid": "057df49c-9d5d-486f-a227-e035960d9d54", "comment": "Malware payload", "value": "6379eae6a04ec6170d9c7a5c825766d6a24ce9b1f172d010b9da13328c4acf2e5a54804a4244b4a466e2c9ac9e0b981d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628138039, "uuid": "365c548c-e1be-4fbf-a6d5-e00ae882f651", "value": "T172F45B2129EB114CF3B79BB60FC4F4BF46AAF673560AB0F638521B958722940CE51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628138039, "uuid": "b9d13d2d-b696-4f1a-a726-6a144626d03c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628138039, "uuid": "aa6cb8ee-432e-40c3-ba18-59fdbab5624c", "value": "12288:qYicjeLA6ZooR65AXwgFvuSSiIo3cVp+CLOIAzXZnhIrnGcXBHrE:qYNoR6qgaAOjcGcXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628138039, "uuid": "6781b77f-ecc2-45aa-a33e-c5edd75d7fc2", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628138039, "uuid": "f62a9b9f-eed6-49ff-b2b4-d685e7223010", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628138039, "uuid": "496b1d1e-deb6-4d5e-a129-e1bf9b62fbb9", "value": "Ziraat Bankas\u0131 Swift Mesaj\u0131i.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f67d82f-f5b6-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628145000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145000, "uuid": "5797e7fb-18e7-436c-a89e-51615c1f6b14", "comment": "Malware payload", "value": "e3c398cc75b837acf0794b5e44dd6e1b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145000, "uuid": "30622139-c89f-432a-9ec7-eaa9935b8e12", "comment": "Malware payload", "value": "6716b116641adc7f178db0a95d12a4b5ee846c9c9259d7dc61f29cf07240b51b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145000, "uuid": "e86b1410-b4f9-4882-807a-c27ebf004952", "comment": "Malware payload", "value": "feaed48b958b25c7946f9cb6d244c47b36f8b23f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145000, "uuid": "a5d24626-6f02-44ef-a508-90a2f7e4db82", "comment": "Malware payload", "value": "2acd7b86644ba19e111b020ea32c78ac1a1b174b35a21f13c3a1a60931f667df87cacb3d131212fecb12e288fa928444", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145000, "uuid": "59b22545-4239-474e-8c29-30c4dbb5e37f", "value": "T16B02D79CFA9703AD8F8D7368182A5AC8059CB72CE384A2B7357C67312F87D565A03478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145000, "uuid": "679b748a-894b-40db-bf91-9ca858749fa1", "value": "192:P3UjjTjxutD8lD9K3d4croiXv7QzwWwU+8QXlQWq:+0tDgD9UdTQzwa+jlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628145000, "uuid": "db89848e-4be1-4769-bbcc-d1ff65f5c0f6", "value": 8562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628145000, "uuid": "475993f4-4632-4c94-8117-f2379547685e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145000, "uuid": "506c242b-9bd2-4b2b-9128-2f731f9c8399", "value": "-...................................w.wiz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327feca3-f5eb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628167607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628167607, "uuid": "78f23eef-4f2b-4fa9-82bb-ad8f3bf4dcae", "comment": "Malware payload (RaccoonStealer)", "value": "3f520f828fd0b70b9bd0e8766a011a8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628167607, "uuid": "14a693cb-5306-45da-977a-3c7f274b67f2", "comment": "Malware payload (RaccoonStealer)", "value": "67e94de414ed1862f9e05c3cfbe6dca9f039871f5675d082975da34db4ff0cac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628167607, "uuid": "b1e952fa-fec9-4d39-911f-b3b0f0ed189b", "comment": "Malware payload (RaccoonStealer)", "value": "5a85f73ddcc4334266205cfaf174575dc95c7063", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628167607, "uuid": "33e64ed4-a7db-4cfe-b4d6-559b2d0106a3", "comment": "Malware payload (RaccoonStealer)", "value": "5851f15fb99bb15019bf5f462093dfc2e8f9755d6c9d320bc8615b8cf4edf5edc6ee5345a6f75b4c0612777876dea28b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628167607, "uuid": "10e51535-70d7-4176-b483-496c26971a3a", "value": "T1CCA4F1113690CC36F12276305819C5A05B6BFC71F92596E77BC293ADBF725E29B3A302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628167607, "uuid": "31c5d2a4-37d3-4f0b-80f2-d73eddb43f7f", "value": "5db1361d34b46103924e72350663b6e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628167607, "uuid": "684a8aee-2977-479f-b9a1-c8a97a271fcc", "value": "12288:LITl+Wcr+V/tqHtbp7h+ma5VtKwNVCskSaPBW:Xhr+V/tqNb+Znt/NFzKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628167607, "uuid": "f5e39dc9-9432-4e0e-9a04-7a252370f6a0", "value": 493568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628167607, "uuid": "9b95f0be-540d-4474-9405-c15f5c7ac70c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628167607, "uuid": "43493361-c7e6-457b-801a-ff625992e102", "value": "3f520f828fd0b70b9bd0e8766a011a8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5eb9956-f5e5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628165278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628165278, "uuid": "b32ea3f7-1afa-4f66-8537-6a2e850452c4", "comment": "Malware payload (DanaBot)", "value": "c781f07a614c5c4d3a2d4459b3681289", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628165278, "uuid": "2ff6ebea-5ec8-4418-903f-63ba8cc14d40", "comment": "Malware payload (DanaBot)", "value": "68ebca16a59d6ddc022472a4c4d68f8f6491c70737fddf1723ef36f11d8eb043", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628165278, "uuid": "eaf8eb60-1944-4b04-be82-6cd8783ebddd", "comment": "Malware payload (DanaBot)", "value": "c04dac164ed493801b4d9c3c7bd3ed446fc9de88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628165278, "uuid": "6b7c3947-d9db-4dd9-ae32-c26ba150ad13", "comment": "Malware payload (DanaBot)", "value": "49613bf86ac0ea134ce89e5a420ba5d3a8ce9f8abb10c48620a661c1d0ed23a80b340c67a12f3b34b769cb8637a323c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628165278, "uuid": "79e7282a-c285-4e13-9869-d6146a2ae0ff", "value": "T1873523267604DC7AF2627A368815C7F22E26F874CD2762873F85A35E5F302C1EA75346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628165278, "uuid": "71207c3e-6b30-4543-ab48-1eb51dff1dd7", "value": "e905b204d022a4a3f9803ba3895bcbd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628165278, "uuid": "c4c78190-fbb5-48ea-8fa6-78f459df5044", "value": "24576:wbxoouhi8lwokiA3NcfJUUIy9gr6RnvCSpvARGl:wWdi8w9iA+hU9q7YRGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628165278, "uuid": "493f07f4-4229-48a7-b125-4a57d010ed53", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628165278, "uuid": "bdc01e81-02cd-44d7-846e-25b8d7f85602", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628165278, "uuid": "fce6bdb8-6703-4605-8177-6e88b6cce9d3", "value": "c781f07a614c5c4d3a2d4459b3681289", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96f4606-f5ad-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628141178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141178, "uuid": "0fca6be5-3260-43ed-9c5c-0e5a5e3f2945", "comment": "Malware payload (Formbook)", "value": "8c093f5b8a7931a73a9cb03245990d80", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141178, "uuid": "2fbf8b02-8c59-4c7b-932d-8dd8d65aeb9c", "comment": "Malware payload (Formbook)", "value": "69fb385f09b26bb2d7a720f53cd4491bc4406860b0889bc8ad25c3ff37f983c1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141178, "uuid": "f4057be6-35b0-4127-932e-f4d360e9a1d7", "comment": "Malware payload (Formbook)", "value": "e869f222e21deb3121577978fdcf40125dfe3b25", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141178, "uuid": "97ff8c95-f216-41df-837c-62c8b64dbd6a", "comment": "Malware payload (Formbook)", "value": "2b6412079175f08b75b95b6c12f13ac7d197fb7815bbc115c48e5e96237b62a185aa490c2c586a631b4d055e435b599e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141178, "uuid": "4357904b-0eab-4f39-b5bf-ce4d4bf790b9", "value": "T102D4233F3A06EEF878D181D92B41895468C5AC5D0EB08E6D98DA5B062C4E6DAF4F4733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141178, "uuid": "5d2afb7d-5a88-455e-9e32-9eea3e86129a", "value": "12288:8vp+G1UwRWyq8MdALHr8FvRAOEft4cIq1TVfD6xndBGm:TQRVZravSBIq1TVf2JXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628141178, "uuid": "c928b303-c277-4b72-bf11-db0642d17e57", "value": 625311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628141178, "uuid": "b0a6f01e-500c-48d2-891e-4628e43b90ae", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141178, "uuid": "e2f60627-54d2-44e2-9c75-800faae155c4", "value": "P.O Contract #007676.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430dafa0-f5a9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BlackMatter)", "timestamp": 1628139288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139288, "uuid": "efd9e06d-ed6e-4418-bc90-8cf91805ab57", "comment": "Malware payload (BlackMatter)", "value": "3f9a28e8c057e7ea7ccf15a4db81f362", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139288, "uuid": "f6ba77c3-3e17-435e-b152-c87870c19210", "comment": "Malware payload (BlackMatter)", "value": "6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139288, "uuid": "bff8857e-7bed-4e53-b9b5-2bc4ff28beb3", "comment": "Malware payload (BlackMatter)", "value": "10d6d3c957facf06098771bf409b9593eea58c75", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139288, "uuid": "e7a7905c-6e57-45bc-90fe-1822ee3696f4", "comment": "Malware payload (BlackMatter)", "value": "79477648895c71a818d16aa283fdfb95a70df6d707f6e1ee1923f43212efc570ee35735ea92b3d4bd2805ff7d8240e8b", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139288, "uuid": "15516478-c18c-4592-8d6b-c17158d2ae5d", "value": "T115A54B5FB66698EFC1A6D830C65BE0A2B9217C5942327A373195F7300D7AF204F1A772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139288, "uuid": "b3293c7a-71b6-4671-839e-6b15cf821581", "value": "49152:k5Wy/20shMXR8uUz9cBbLc/6LCM01iNFFB9wO:k5Wy//sO8uDq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628139288, "uuid": "d43192f7-e1d8-4ca4-b802-310ae3fba459", "value": 2077696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628139288, "uuid": "910f8e25-431e-48dd-a10c-2333e7220c90", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139288, "uuid": "bf590f4c-94be-473a-b309-b20d84b6f411", "value": "6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6672e915-f60a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628181009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181009, "uuid": "497c72e6-d3ee-4557-bf41-39b4ffec0b27", "comment": "Malware payload (Dridex)", "value": "32b71b618f84d02dead0ab8a0cac5a10", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181009, "uuid": "65035145-34b4-414a-993d-b98ea13da890", "comment": "Malware payload (Dridex)", "value": "6bd2ea6c1af240afab09d27758486537b921e48ce87b8b69d49633c1429074ba", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181009, "uuid": "22aa4b03-a1ca-440f-9856-0561dd6c3ac2", "comment": "Malware payload (Dridex)", "value": "a16ec6952391322973576bc0f214773ba2fd3cfe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181009, "uuid": "2ad522e1-3204-4113-92a2-b0dd2a5818a2", "comment": "Malware payload (Dridex)", "value": "5881ca341360e3a3a6563e25171d6dc3eee938ff36ab9b345f43c38091cfa1d2b4dafd1787cfff1cfe5b6627c31a66dc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181009, "uuid": "903c72b4-dd96-43ce-bdb9-a5260a68d9f6", "value": "T17A04D042E3CE23D1DC97B43248FC262A24F05444D85ADCFEC995EBACD7E1F574A64A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181009, "uuid": "b3128759-87ed-4939-b544-69055b8d4ecd", "value": "6eb7ecc6c2e948f718b1179f888ea193", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181009, "uuid": "b3319643-5549-4be0-a22f-b8a485ffc994", "value": "3072:lcYhzpn9z75jWpmrL3gA99hXkKsorn+AOr4RRjvaT:lcIntom33RDvn+Rrqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628181009, "uuid": "3dd87efe-1006-4427-b082-c0835156e860", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628181009, "uuid": "1c8d35f5-1ed1-48b7-aaf9-ed10ce346d17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181009, "uuid": "05111721-007a-43b0-b143-6f297fa77932", "value": "F3SFOPdU3GwP.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f66b2f-f5d0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628156154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156154, "uuid": "d2667a76-b579-41c5-b0e4-8298732ad42a", "comment": "Malware payload (RaccoonStealer)", "value": "f3e587a562a294820ff9f89fa22395a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156154, "uuid": "1ddc2863-33b3-4752-8017-d78374bdf964", "comment": "Malware payload (RaccoonStealer)", "value": "6c53a9857e069a36ee9ec56da0073a158f0350ef43a6537ea821dfa4fbaa3932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156154, "uuid": "b70e68ec-34bf-4a17-8365-90d48fb6f454", "comment": "Malware payload (RaccoonStealer)", "value": "021d9b0d6b1b552b83a6f207092e49608c0d3f7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156154, "uuid": "c04239b7-1edc-4275-b156-d381795ff4d0", "comment": "Malware payload (RaccoonStealer)", "value": "58cba796be9667326182014c60926a6a3bc6681b0f376e61591fffb716b5a57733fa7bf283c4747355e7a14129383d62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156154, "uuid": "3813d1b0-6827-479d-9207-004e23267c78", "value": "T1D3B401113A43C533E06506714835C6AA9A1A78B11D74CE473FF466BA7F723E29E2B31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156154, "uuid": "2abb4106-f560-41b2-815e-9ebf04d849d8", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156154, "uuid": "03ea74a4-aae5-4b74-9758-2be1532ca7a6", "value": "6144:jkAeExSyh0a3HEM9ngifemA4AXwiL5qpKt1yP4LHfv/66w6HXsG8Ecu1ABYc4v:QAhdXDg+eLDxqEnLHH/p1v8EckAz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628156154, "uuid": "67a2a135-8c51-43bc-b564-4608f004b556", "value": 495104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628156154, "uuid": "4fbfce0f-d7d7-4609-a8a3-e1e48b27a360", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156154, "uuid": "271590fb-dc01-49ad-91f8-452144130234", "value": "f3e587a562a294820ff9f89fa22395a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d622ba-f5d5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628158491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628158491, "uuid": "b310c663-5ea9-44a6-b8d1-483779620f6e", "comment": "Malware payload (RaccoonStealer)", "value": "f9be043cac258752a7a51c70062fbd2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628158491, "uuid": "38289dcf-1ba9-4e03-95d4-920340971a6a", "comment": "Malware payload (RaccoonStealer)", "value": "6d3ca814ba07ae5c6eb34eff7263b789428b1d58bef4c083015ab664f1757e50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628158491, "uuid": "a873c759-8493-4429-bd79-b1505ba366ce", "comment": "Malware payload (RaccoonStealer)", "value": "967b17744c09b9bad57790d63bf9c65104dcd1ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628158491, "uuid": "fb6f7876-4a5e-4766-ad8c-956c460d54c8", "comment": "Malware payload (RaccoonStealer)", "value": "9a794d36d542455470d9a6c1ee52ddcfdd1f265a46fb7bf2dda78a8d5ce281bba0030783c827abc04db50af4413fd296", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628158491, "uuid": "6031b99b-920a-4e24-89c8-b0a193c8def8", "value": "T1AAA402D174D1CC33E67449797C24C7A45E3ABCA45C2D998B3BC87A8C7F2A2D29B21321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628158491, "uuid": "7264233a-8a90-47ec-adbb-28b5c37d3344", "value": "629ade9afe4dde1eb664e78b28e49fc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628158491, "uuid": "6511f671-f194-493e-a329-7c78c47b9d9c", "value": "12288:L0FJ1pgIfJ9TKY5VsH39/HKiNCPHtUKUX9V2:2lgIf7KYfsH3hKiNcNUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628158491, "uuid": "9fa9a46a-9920-49f1-81ee-9f1f424af10d", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628158491, "uuid": "637ee5e8-2eb0-48bb-a604-2af4a75d07ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628158491, "uuid": "f60e39e0-a400-458b-8de1-ec0b3715518e", "value": "f9be043cac258752a7a51c70062fbd2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8415cb77-f5e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628163449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163449, "uuid": "1aad154b-1a1c-40db-b2d0-a16f8f4f0b3c", "comment": "Malware payload (AgentTesla)", "value": "d9ccd8340c326c9eb0e753c9be063682", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163449, "uuid": "87356abc-2896-4537-aa5b-deee3b43694c", "comment": "Malware payload (AgentTesla)", "value": "6e349d08351d823858f58319874f8b70314b4b20ec746470b1cde7659ca811b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163449, "uuid": "0103fe16-29b3-48a3-a79b-a0cb4bf1d01a", "comment": "Malware payload (AgentTesla)", "value": "c1e9235af5520308b861b9218f2938ac8b680933", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163449, "uuid": "19babad7-ba6c-4603-b38d-597920e60c95", "comment": "Malware payload (AgentTesla)", "value": "2afd7277cde48c63a2b03bbb6fe955d0eb1c955c501fde25cdf4122bd4374184d55d134fd48e1ac3f46c1c3832baba28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163449, "uuid": "837dc84d-6a1f-48c0-b110-8c715e30eed6", "value": "T15F2512116690A953D9AC0A750FAAE1304FBC5D169628D66C3DC83D4734BFBC3272A9F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163449, "uuid": "9fc43519-2f49-4055-8faf-fef6b8e62cc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163449, "uuid": "af63fdbd-d7f9-492c-9ea8-4c07b74f0945", "value": "12288:qZCXESbR4MB8o5kK1ZKkzZuBMVvYIYg9R6uqFX/N1fVNia+NB1CThHWhXS6DbI:sCXgo2KncBkYo9R6P/NJKao7CTxWhXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163449, "uuid": "80dbb07b-c571-47ae-8bcc-7e0b40ff6c01", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163449, "uuid": "242cae3c-3d54-4c09-bf6e-a04aec77237b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163449, "uuid": "b4dfad61-442e-46ee-8745-9910ab7c8b96", "value": "Reg_PA_Statement_B20210705 15h05m55s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3fdf31-f5c6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628151737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151737, "uuid": "d64d9e98-f6b2-49d5-996e-16fc9da0dc73", "comment": "Malware payload (RedLineStealer)", "value": "1e6e3247b0ca280d6c7055d7775a7e40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151737, "uuid": "fea90a7f-d728-428c-a275-7a6cc469b20a", "comment": "Malware payload (RedLineStealer)", "value": "6f1904a99189848d5856b7872fa366e4ebea02531e8155da6c29bcd8d64e4353", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151737, "uuid": "8250871e-f851-44f1-99e5-053cb6c0b1ed", "comment": "Malware payload (RedLineStealer)", "value": "0421cc82d6ee6d30b24fe2a94ad77aec8ab9602c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151737, "uuid": "0195cfa9-8a53-4c06-9f64-c4bb08c25d1a", "comment": "Malware payload (RedLineStealer)", "value": "172de9758066070695c158f2cd9245f7f8a28ce5514dc25ea005e2dcb0792940315a3af7c7c8cdb6ad8f7f4155068c76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151737, "uuid": "ed74a028-a8c9-48f8-ac75-65057bba8b53", "value": "T14CA34B2563ECC62DF7BE0B356470092A07F1E08F6412E75B4EC174EA2E767826558AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151737, "uuid": "1ed54a6a-d953-46b3-b1d9-08c68629a515", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151737, "uuid": "c866838e-1056-4223-9aa1-403b75b46438", "value": "1536:4m386AEAe3QBjsrK5A+CAy6yBcQzb7vgbue7vkuvmyAsdWTi1xQeTEaG6WAaoigN:4i86Ad00PA8Qzb03kuuyddfsvId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628151737, "uuid": "9a73a815-34bf-4fb5-b3be-87b28727d1d6", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628151737, "uuid": "202ea863-93d5-4b8e-9084-dda0105c3329", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151737, "uuid": "5935d844-ef54-4812-9be3-6899cb2a5feb", "value": "1e6e3247b0ca280d6c7055d7775a7e40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a311e73-f5fc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628175056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175056, "uuid": "cf6a8f9c-23b9-4d3c-8896-f314c0850ff4", "comment": "Malware payload (NanoCore)", "value": "0da153b39fad9f5b7e7b98a55bd24c8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175056, "uuid": "1c4a37f7-f004-4740-ae55-a10151efec0a", "comment": "Malware payload (NanoCore)", "value": "6f421f465ccec29b53aef6282de1ee43ab391c36f990272ee6b3954aa61f68d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175056, "uuid": "4700e05f-90ce-4b7d-b023-48ed5df3ea5b", "comment": "Malware payload (NanoCore)", "value": "a5f361d1db78f63e9574155385c4bd3dd57c0ebc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175056, "uuid": "6eab11e6-2be4-460f-9528-3f0e88f6e369", "comment": "Malware payload (NanoCore)", "value": "c19f2284a151655fd607915fd5b84457d97fdf63a089509ebe2da02e47718d8aa9d72190ba2c77a67e7e55522267af12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175056, "uuid": "36d3e6fd-ae50-42a3-9f02-b58be9df3635", "value": "T11DF4F17DD2153F97CEBD51B6800032458EF1D236725AE7DA3CACB1E954C1F629B20A2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175056, "uuid": "b8aeb97f-ad1e-4c69-8876-e775765fd148", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175056, "uuid": "2b295ed3-8771-40c0-b2a7-28d56161cb92", "value": "12288:TNUWkc/mifisrGqMz3F/ayt640UfJUu8GqtfpGIAdd3R1VhR+2iNGMxQZJB:Tv/mifisrG9z8Ufeu8GCfAw1QCQbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628175056, "uuid": "451395f3-62d3-433c-8f3e-cd74fd6867ba", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628175056, "uuid": "63ae297a-a89c-4f3f-8af6-1449c33ad1e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175056, "uuid": "23b57bf9-ec6c-4b94-b042-e9ecb6c387db", "value": "ASC_093876338TRAS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d0d868-f605-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628178780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178780, "uuid": "e016f590-0739-45aa-b0ea-9a7be26c208c", "comment": "Malware payload", "value": "46111bfb0988a925636b7979d14373da", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178780, "uuid": "86da274d-ed36-407c-9c25-437139b5926d", "comment": "Malware payload", "value": "70524a680a3873a90d313133b96402d5a98ccafa3d7c2a32dc819f5f43eae66c", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178780, "uuid": "5a2d04c9-c3e8-4ced-8265-0fa09254b209", "comment": "Malware payload", "value": "8fbad7d684ebd4570086bcf1e655e9c95efc8d20", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178780, "uuid": "37803373-857b-4353-b275-fef459c26756", "comment": "Malware payload", "value": "9fbbf5fff99e082a473dbb3a04646a2a109902a37b89afc8c496c9c9f9b73abaedab3bc75398c22d1e9a701b80f253b6", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178780, "uuid": "9839604b-dfb4-4776-b5a0-92042b6ec20f", "value": "T1902133247A07F136404AE3D68DB99A3CF2E76266C9605495323DC199907F4EE29C3ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178780, "uuid": "2132d4ea-38e3-4429-b40e-4d5bb6818082", "value": "24:APcmi+r3ncJ3ZjzeArpIqmnAMvAN5STD69P1EI3SDKV:rt+bnyhz5rK/AN5SPc1EI3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628178780, "uuid": "025a7de1-5ab6-44ee-b573-2a981161df86", "value": 1168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628178780, "uuid": "a5e8f4ec-7ca8-42d2-ab91-8874b452b093", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178780, "uuid": "996b78ff-9556-4939-9efc-b09c4d431bef", "value": "Estimate_and_Invoice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301cbff3-f5fb-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628174475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174475, "uuid": "80952cc5-e1f2-46c9-bd9b-d2ecc5e1acc3", "comment": "Malware payload", "value": "bacf3b869e082df351ea3517d3557820", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174475, "uuid": "1b85fe78-a438-40dd-a0b0-25e9287e88ae", "comment": "Malware payload", "value": "71998bb4882f71a9e09b1eb86bac1e0a0ac75bc4c20ee11373b90173cedc7d0b", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174475, "uuid": "c3fd3973-8689-4224-b657-d7c6454b2a14", "comment": "Malware payload", "value": "ef341121d96692f7d529c6bbcd80b6c4d5d28904", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174475, "uuid": "094c06f1-e2c9-4123-9c7f-b82692e1e935", "comment": "Malware payload", "value": "eeec3822649654397b0c90867bce6cc8127438ed7eb3127c013a38d7b33eb1c7aee28cc57060e305434d05fc20541daf", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174475, "uuid": "3661f394-9abf-4be4-abf8-213fc7fa04a9", "value": "T1E83402FF15D0D8A7D0E6003B81D642AC3FD697FD2294F1205627AC9C35ABFE46A485E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174475, "uuid": "de32859b-6fd0-4a99-968e-417b3b35c4a5", "value": "6144:OyId860LCZ0al467daz6AyXk4YyId860LCZ0al467daz6AyXk4U:OyP6O6N7k6HYyP6O6N7k6HU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628174475, "uuid": "3a356181-0894-49a6-8501-7c93347e9d4a", "value": 252005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628174475, "uuid": "a8069057-57a8-4ba9-9aea-8badd428ccde", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174475, "uuid": "372013ca-3339-4350-93d9-9f78f5910a1e", "value": "Bunker_invoice_023.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5fde26-f5f4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628171570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171570, "uuid": "f3c2343d-5c98-4eed-90dc-fd6c67d3d242", "comment": "Malware payload (AgentTesla)", "value": "3ce564c62300f5e01653b86a39e745a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171570, "uuid": "24f28298-4873-4da0-8045-df77683cecac", "comment": "Malware payload (AgentTesla)", "value": "71c1133e29baf2c5de513c5cdebba864c68ecd4362c9a6c6eec9d70734e2277e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171570, "uuid": "942065c8-70bc-4447-a013-10ebd0cf53f9", "comment": "Malware payload (AgentTesla)", "value": "d16b2c5be7e715a78461b5a4b154377dfed9c203", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171570, "uuid": "36b944d5-0ee4-40ab-8abc-6dfd387dce69", "comment": "Malware payload (AgentTesla)", "value": "42de646f4c9063defc33b67b9a431e6b958df0048e81a177601906896e3656c0387a88bbd8ae78fb9078f8cc190adc1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171570, "uuid": "d908c1d8-7878-45b5-b7b1-c7b006a48b10", "value": "T11422D0369F619726C0217EAD2E7728CF2FEE5019FC17EEA315E1A71552421874E91022", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171570, "uuid": "c3d9d89a-f0d5-4504-a077-17d52a371030", "value": "192:YeWxomsd/lmGI+C5AEcg0CWqBpEZi+3vT1didOxTsbrLjnWIlWV2BLCE7a0b:YbHSa+C5nciqudhLnAoLCE7a0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628171570, "uuid": "97c01bb3-9f19-4b6b-8c05-10f5150515cc", "value": 10522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628171570, "uuid": "8e2cb2da-4f39-40ee-a6fc-0457745e1345", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171570, "uuid": "f5916a07-252c-4f1a-b157-bd73833d476f", "value": "Final,pdf.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1837366-f5f1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628170424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170424, "uuid": "584bfc7e-e451-4e6d-aaa6-5d8ad44cc1a0", "comment": "Malware payload (Formbook)", "value": "fea794d22d11c7eda7af63545fc5f9ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170424, "uuid": "3b68ce90-5cd3-458e-b587-747c29a166f0", "comment": "Malware payload (Formbook)", "value": "72320946e28ee9117b85cb1a83e5e122c3938e4a79c9be1551595103cb2c311a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170424, "uuid": "26bf7332-dca7-4728-8f6f-81ede7d7079d", "comment": "Malware payload (Formbook)", "value": "7d30f8fa2652c0e36a82fbbf6a5995bdb1d056f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170424, "uuid": "a66508f9-3b49-4ff6-9a54-8bef51523ad2", "comment": "Malware payload (Formbook)", "value": "de1dddb8189386b6738e4639072c254fb92038543460a5550a35cd5709a3f64a239b7e6bb85d6bc1a847eaa7dd1b242e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170424, "uuid": "125b0f24-d42e-4c9f-b0b3-382a0e294330", "value": "T19A64E021D396AB96F3DD8F74974249001FF1A396EEABC5F83F4D09C88786901CED161A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170424, "uuid": "5f1d5f97-4bc0-44f3-8258-93b9315952cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170424, "uuid": "fa53aa6a-3bea-4b06-90e4-80ca435e74ed", "value": "6144:UDsmb8RHBESKs3hnD13HIMq/3WdCVdKrL:UD8WSKsBDpaWdCi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628170424, "uuid": "0143b40a-2f1d-471e-8718-fb5f7bf35891", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628170424, "uuid": "62a0cf1c-a214-43df-b0b1-22f519d5d78d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170424, "uuid": "0b3eb714-43ac-4cd6-a39c-fd0257ab21c3", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e80f9d-f633-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628198775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628198775, "uuid": "ca6cefbf-a705-4bbf-a4ee-d6f661018267", "comment": "Malware payload (RaccoonStealer)", "value": "d6cae91c7f1fe16880ec9b626c3b2863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628198775, "uuid": "7b7686b4-cd56-4a48-ada3-ee4c0b7d664a", "comment": "Malware payload (RaccoonStealer)", "value": "726275af580053d15d4070b4158e1dfcdf13c555ce39b0c39cef3c3569b8164b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628198775, "uuid": "d3316a77-3efc-4868-ac67-e82bf1a185a3", "comment": "Malware payload (RaccoonStealer)", "value": "98128c8306094805284611feccb8a6dc8eaaabb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628198775, "uuid": "c9f7b1cc-a73e-438e-a48d-ce566bd01fb0", "comment": "Malware payload (RaccoonStealer)", "value": "e7cfcec113df01541253d75e57ad1df0de2b4568d9fc08a0a52307bdc50d078ed43e91434611ec7a9fe962e0352c05de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628198775, "uuid": "e6e73934-12fa-429d-841b-292285f4b222", "value": "T192D4E130AA90C035F4F712F84AB6D3B875297EA19B2450CB62D53BEE46346E9DC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628198775, "uuid": "bcc29736-61cb-4e5a-864e-2598333db977", "value": "8c5e0d9adb6e2e9f038be707c352a043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628198775, "uuid": "f6e34c3c-fe53-4a47-b91a-2d3ab9b125d2", "value": "12288:odqmnoikpClKh32aqKy267xWrVfWTLXH5Ted2iyXAx:OoaY2al4EhfWX3S2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628198775, "uuid": "39589b14-145d-4436-bd5c-9c20a315ef32", "value": 606720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628198775, "uuid": "ed541ea0-4c4b-4f2f-bb47-7f82fa3c06f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628198775, "uuid": "a521a10e-6a64-416c-a10c-42ad09e21401", "value": "D6CAE91C7F1FE16880EC9B626C3B2863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56dc694d-f5a9-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628139322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139322, "uuid": "18b25c26-1035-415d-92b6-aef679bdf2bc", "comment": "Malware payload", "value": "826e465b72a02cd1169f1220b76e2130", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139322, "uuid": "55e5cbb6-d7bd-4cb9-a3ec-eaa8698d151d", "comment": "Malware payload", "value": "728e9f5fbcaff9466990fa15b2cd591ec1b2540bb5ff7b7b8246ad83572e854e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139322, "uuid": "cafb1209-fd2f-4d49-bc2a-dae44a4473e3", "comment": "Malware payload", "value": "214b891dde714d058a270585da0922d4e287ed01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139322, "uuid": "0fba9df3-4455-4e58-8092-eedff303af49", "comment": "Malware payload", "value": "045d9f43d6de48a42254de4dcfdad6906a9487c12c0e414e5cfe784891912801800f0c9005b792b9a84f465601af1042", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139322, "uuid": "9de9b5a8-de60-45e2-8638-e15277856c84", "value": "T134156B2129EB250DF0B79BB90FD4F4B24ABEED6546CEF1BA38810B474339A91C951731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139322, "uuid": "80d52889-9d2d-406c-ab16-bf6d74197b77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139322, "uuid": "2fb1aa62-7634-4707-ac5a-789d07607071", "value": "12288:J7OstYdODLqJmNuoL7pM6cpTxXkKWyEKRe2lLONh9sYd9gcoLR1Jg+3+7DPSm:J7OstY4PTdM+KWSLLONXRdm1t1CA+DB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628139322, "uuid": "8cafa1f2-06d8-4289-b150-a4528df772ae", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628139322, "uuid": "c44461ff-3a2a-4707-8fb0-029e600527cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139322, "uuid": "04e0ac0a-4200-4ff3-ad94-c64e2d6fbffc", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49bbe3a6-f614-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628185256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185256, "uuid": "e8ddef78-e56b-48ba-a087-3f384258a8fe", "comment": "Malware payload (RaccoonStealer)", "value": "98f4b7ccb9861a4595ee20d411d98390", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185256, "uuid": "de9f0a5e-8e17-4ee6-814d-216f49a00063", "comment": "Malware payload (RaccoonStealer)", "value": "73e87c3cfbf82b015e25d90187231ee64b4be2404cb3213b3093ba7ab0d12dfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185256, "uuid": "046f353c-9bde-4283-bbb3-c53fbe867683", "comment": "Malware payload (RaccoonStealer)", "value": "adacadd97e0ddc6615866f123698696eb441555d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185256, "uuid": "83cd37a1-55d7-4d98-854a-0bb29fb6e8a7", "comment": "Malware payload (RaccoonStealer)", "value": "1c06eb38bf6b4452ac23cc61b74e2d394e6498e77c5b35ff6da6e704bf438c78d3775ab44917a8ede8fbe2c9ebb5554f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185256, "uuid": "ba352ece-901c-4b30-bd19-1a32089521d0", "value": "T10BB401113641CC76F0513AB14C5AC6A29A67FC74C97897877B8A2FAE3B312E29F35305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185256, "uuid": "f75e31e0-6494-4c28-a41c-5806577bd85a", "value": "c36bba2f7ed1360c17671decb7b1e9d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185256, "uuid": "a8cf8a05-59fa-4f6a-9c87-0030c78e3723", "value": "12288:HJlLWt/Z42w2wbIKDJRAbz0B3eLoBfZJzP2dYL:HJsL42N70BgC2dYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628185256, "uuid": "82bd190c-9ef5-4ad8-86c0-e5357f6948b7", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628185256, "uuid": "cf8341c9-7efb-44a3-b44f-8404ab3310a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185256, "uuid": "39e57919-2812-48a5-b445-4d5a3ef8c4fb", "value": "98f4b7ccb9861a4595ee20d411d98390.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2a5253-f5b5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628144669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144669, "uuid": "6693f4e5-a7d8-4216-a935-287bb4b918cf", "comment": "Malware payload (Formbook)", "value": "667b669aa8550120f1e4281ec1d94b50", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144669, "uuid": "279fed8b-fab4-4d0d-9c44-8d78ebfaa97b", "comment": "Malware payload (Formbook)", "value": "7402820a9e624e3c35ce2275dd9e6d73e906d976c8e4da6a140ca7cb7daab2cc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144669, "uuid": "53215532-6a09-4a81-9a23-44d020d23fda", "comment": "Malware payload (Formbook)", "value": "4973d9e75316e3873d3b8203daf59e84e21cb4e0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144669, "uuid": "d8f5ffab-2f11-4662-a4b3-b704ca64a731", "comment": "Malware payload (Formbook)", "value": "a9d87233d43ef3ca572008f70ef2e1645821c52622c8a32bd6c8149f86f9f06f09e8c2e1858b036321a8fed363ad1cda", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144669, "uuid": "df4cb6f1-5fe7-4a76-806b-1dd3c3dc1559", "value": "T187227E7DD602F81BC21542BDE41582B5E7686167F612BD2DB094719F07902C3CF8E2BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144669, "uuid": "e60a8d50-99b5-40b2-9f0d-08525461e318", "value": "192:ScIMmtPZG/bEpOcOsWgEamWBXpK0ydJb3F0tx:SPXEEpOtNoEP7by", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628144669, "uuid": "1f00b02e-efe1-4455-9edc-b6e648d3cb14", "value": 10346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628144669, "uuid": "cc7428dd-780a-4596-8527-2f5163595e98", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144669, "uuid": "a18cf6e4-dc95-4e79-be2f-a1503de7b39d", "value": "quote12124.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383f33bb-f5d1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ServHelper)", "timestamp": 1628156450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156450, "uuid": "de0bc2bb-66ae-4350-b993-f1df36f92606", "comment": "Malware payload (ServHelper)", "value": "21e6b945c35f97310ab6a88f4381fd37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156450, "uuid": "cb1762cd-0818-4d57-88b1-15dfc65e7cb2", "comment": "Malware payload (ServHelper)", "value": "74e55e975c5d306701f8f86bd3c8c14698352923a8eb1d43ded6f62eae2abad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156450, "uuid": "037963f7-d080-465b-ad96-7ea2e5fcd47e", "comment": "Malware payload (ServHelper)", "value": "439d4f0743c6dbe480fe3b4ee27c326ee0053fdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156450, "uuid": "3258c5bd-c939-4618-a938-0ecbf7c1c544", "comment": "Malware payload (ServHelper)", "value": "a108498396d8d0b57c69c29c9b9e41b6b044424d10436f8d9399b4476bd8643d821afa6bf0843889abd619618a5bfecb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156450, "uuid": "e56f8595-3674-49da-bd0a-9a8799482603", "value": "T1E8B401113581EA77E75D06B14839CEA267397C710D299ABB3BB0766D3F612C29F2430E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156450, "uuid": "c8c6af92-c56b-471b-8be0-d206992e094f", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156450, "uuid": "b4694ce0-e5ba-468f-8e46-9896a5cbeec2", "value": "12288:YOzBHH3u8w/3RnyBPVQdDGYjuRCIM6EAzAG:MbhnyBPedCYKRJM6EhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628156450, "uuid": "6cb8f8da-7e2c-4968-8cf6-cbd30671949c", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628156450, "uuid": "ffd738dd-da6e-4c1d-ab3e-e99bbd5e7a87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156450, "uuid": "5da189ce-3971-44d5-86a4-639c28db667a", "value": "21e6b945c35f97310ab6a88f4381fd37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13acb40f-f5b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628142215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142215, "uuid": "aad6616c-c413-4907-b272-984e52ed75ec", "comment": "Malware payload (AgentTesla)", "value": "20c91fe068e8c73ac194398c87118b59", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142215, "uuid": "77ec5f5c-338a-4645-bdb6-538c7a6a5987", "comment": "Malware payload (AgentTesla)", "value": "757e30d7a402856bd55c4a8f84cab25fcc1e01f3b7365cce3e91a7775322987c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142215, "uuid": "946bc18d-8f07-4830-94f8-989e58755bf5", "comment": "Malware payload (AgentTesla)", "value": "926f5b35485cb5d7ef5c0e468459a3e374b3065b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142215, "uuid": "5541856d-4af6-41e9-9b37-4d6fa9598e99", "comment": "Malware payload (AgentTesla)", "value": "b612500f187e492e234be3abab4a6aced061467bf9c388556dbc49496f01e430776013fed72b9ce9f53e82c8912c5586", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142215, "uuid": "96a4e34f-3af8-4470-91ab-e4eb075ef93b", "value": "T19ED423A60152D069D105D5BA942FDC23BFA312EEF13B8C07F6147E498F49BE01F636A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142215, "uuid": "a42d2915-211f-4bd8-8fb9-0c88e5948d34", "value": "12288:XZ9/XYg7btYsxVAiJgSt/y6R5OQJgBjMFiVIsD7IQt5LOUaZC3:XXvLbHVTPaQJgVIsIQT6Fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628142215, "uuid": "a39b811a-5c87-4987-a6df-6ee4e314def7", "value": 629157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628142215, "uuid": "42787093-0e1e-401c-84e2-a4abf3779387", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142215, "uuid": "926bd205-5ece-4b5d-86c7-2a8b2fbfde5e", "value": "Outstanding Amount.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38df5963-f637-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628200260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628200260, "uuid": "14efb4ea-c2f5-4e0f-bdae-12941a3d4b98", "comment": "Malware payload (RaccoonStealer)", "value": "dfd72cf998be69be0418701a0dee0272", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628200260, "uuid": "f29362b4-eb67-47e6-a0fd-e0f4c4cdcd7f", "comment": "Malware payload (RaccoonStealer)", "value": "758b0fcad0950b63607f06609bc9ffd7953206111f04adfbf40bfc1c0b5ed2c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628200260, "uuid": "11a77ee2-b4c7-4709-81c5-f7f88656be55", "comment": "Malware payload (RaccoonStealer)", "value": "16ec42de83a698415daa33b47a5363fb289a4f6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628200260, "uuid": "7b61bb4e-d8ec-44f8-9f2c-ccac3fae7b2f", "comment": "Malware payload (RaccoonStealer)", "value": "a560fd314fee714661b63baae8f1dfda8c917c476c3bd9252a7b67112a49b47f2b1352b6e6a198334533fb1199fe350f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628200260, "uuid": "fd239c33-8cfc-4182-860b-8de31737260c", "value": "T16EC4AE3279725076F07240B06E6CEBA115BEBC7008754E6B73C90A2D5FB15D29B22B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628200260, "uuid": "597dff93-1dbf-4677-bb30-fdd964c6b335", "value": "51747c8f67e1906217336bcac3925924", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628200260, "uuid": "7b8e43dc-33b1-4ddc-a1dc-ccf95a1d98f6", "value": "12288:QNlFn8ArT3Z/N+k8kfHax9WZi70WvlRdudnjrTJuIms32ciFCUpxCLQO:cF3TZ/N+k8K6DWZ0cl+F/vCLQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628200260, "uuid": "72df1dd6-d8f6-4cb6-8915-1df42a615179", "value": 586240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628200260, "uuid": "b4590ae1-7be2-4507-8e6b-530a05b1bf79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628200260, "uuid": "bf89e0fe-9f9d-44bb-a4c1-fdf28693e868", "value": "758B0FCAD0950B63607F06609BC9FFD7953206111F04A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa59c6c-f5c1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1628149510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149510, "uuid": "5b8abb85-c977-4179-95b9-feedaae224d9", "comment": "Malware payload (CoinMiner)", "value": "9618279667a233d19c843a54cf2e1c81", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149510, "uuid": "2bc934f5-b0ed-4ee6-9c10-772a86cc0692", "comment": "Malware payload (CoinMiner)", "value": "75b77800228079a5b6b94166581b2b406f6dca7baf3a9fb163aa0a2d2a89926b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149510, "uuid": "7c4b7937-8cc9-498d-8aae-ec9e34bcf334", "comment": "Malware payload (CoinMiner)", "value": "138f85fabb71e56ff351508ed79b2308883cbc41", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149510, "uuid": "15dcb0ff-971e-4189-ab93-2d18eb523db6", "comment": "Malware payload (CoinMiner)", "value": "5a18a7d8b4a77872332b2a033d3d620e1753d0480ec33e246ae1e225bbe9209aa7bb3114e3cc64b6cb5af43f25b8aacd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149510, "uuid": "0e9df9bd-dedf-4418-aaa9-6cf981ec1a9f", "value": "T176F36C0B67F811A6E4B5937059F203D359327D615B3882EF128EE97E1E336E0A631B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149510, "uuid": "3f210bb4-814b-44ea-9a6b-5ded7a69c666", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149510, "uuid": "12043831-c074-49b5-aabd-e6a1c766bdf1", "value": "3072:mahKyd2n31D5GWp1icKAArDZz4N9GhbkrNEkbw2rv:mahO3p0yN90QEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628149510, "uuid": "e59d0404-5d06-49a7-8600-0f115f6ec4f8", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628149510, "uuid": "d506c4a1-f0bd-4727-a778-baa4ce44091b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149510, "uuid": "f17bf1d1-b9fc-4094-9fe7-444894ae93e3", "value": "9618279667a233d19c843a54cf2e1c81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4417bce3-f610-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628183528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628183528, "uuid": "ca265e93-db3e-444f-972e-010b2edb19c4", "comment": "Malware payload (AgentTesla)", "value": "86bf69da2b82293a9cc9a7316b16d988", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628183528, "uuid": "0bdf80e9-d614-43c7-ae7a-2b9252732c38", "comment": "Malware payload (AgentTesla)", "value": "75d45ca23421acaac6b55133f964dc2b15cd8af4697cf58e63c2cba141821044", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628183528, "uuid": "18ee9330-73be-44ad-b642-95447ec4ab50", "comment": "Malware payload (AgentTesla)", "value": "e88a432b6f3bff9b01d2c93bfba416b121d83fcb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628183528, "uuid": "85245fd0-c1b5-4f8a-b63a-43b3ecc79a55", "comment": "Malware payload (AgentTesla)", "value": "3897b4e38972bcdd668fe29104ced522bf1ac99168c1668617676b93852fcaed96a9faaa2c08d994780cb2dcf112563a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628183528, "uuid": "2ccb38ad-c727-4903-a01c-4c75b738bddd", "value": "T10E056C2229EF158DF3B3AB750FC4F8BE5AEAE577560AF0B638910B454322940CD61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628183528, "uuid": "9654e0bd-314a-485c-bf48-000fa7c9d3e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628183528, "uuid": "2f86c64a-fc92-4b9d-9500-3066e482475b", "value": "24576:foR6qgrgyWaD3DGAjzrXTAjTg+bntldgR:QsXrNTJrXTAjHtLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628183528, "uuid": "e78f432e-b152-49b0-9aee-704753db1a49", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628183528, "uuid": "81201953-9ebc-434b-8f7b-ca7872ce0801", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628183528, "uuid": "98996853-5bb9-4ff6-a8b8-51be290988cb", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19c00ac-f5f5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628172116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628172116, "uuid": "b6d131e6-8a43-4785-a620-dc113d565465", "comment": "Malware payload (RaccoonStealer)", "value": "69bcc8112cfbccbebc6e4aa36f49d16b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628172116, "uuid": "5b897695-f91f-4767-9121-019d103be386", "comment": "Malware payload (RaccoonStealer)", "value": "765122a51ca892c353717e43af45875e9fed000ed736759b53b73155692bb775", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628172116, "uuid": "4822076b-bbce-476b-a52a-06fea1119c7d", "comment": "Malware payload (RaccoonStealer)", "value": "79ee1a3223f1218709c10174ee52617cd0677ece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628172116, "uuid": "1a09472e-adef-48c3-847f-cc8fec775017", "comment": "Malware payload (RaccoonStealer)", "value": "8b47c6a90d990c6501d63ad4f4c52b12b326301476c487f4ee298f4305559380bc2016b19512fbba1dc52bdb3fd7b0d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628172116, "uuid": "f55b7c9f-4416-4f4f-905a-b9ec52042148", "value": "T142A401103AC1CC76F426B4704816F7A16AEBF8B5D86189877BC497AD2B713D39B36309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628172116, "uuid": "56ebdd48-514d-4f39-a6f2-e2403c003f9d", "value": "5db1361d34b46103924e72350663b6e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628172116, "uuid": "13760f14-1d32-4d3d-a50d-e9d979bd38d5", "value": "6144:p5aqGfScT0jIAnxt9QMNpqYTAd30WO2KlszfD/hZhmN5W5IxpqQajRil+OJ6Psup:rIPTKJFQypq4y3/hP5aqQ8Rq+OsPDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628172116, "uuid": "92defbb8-452e-4445-afda-dafa23417f93", "value": 493568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628172116, "uuid": "bba643e4-51b3-4099-a1b9-ebfc657471ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628172116, "uuid": "b2857530-d23b-43d5-92b0-ff65ef961afe", "value": "69bcc8112cfbccbebc6e4aa36f49d16b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ba8314-f617-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628186641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628186641, "uuid": "3b0d69d1-5417-45a0-97ed-ed2a9213b295", "comment": "Malware payload", "value": "7d2ce53d4201aa1d997a1da890015e7f", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kavach", "colour": "#CE1ED5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628186641, "uuid": "bf550384-e5c8-48d9-8cb6-477a75a8eed8", "comment": "Malware payload", "value": "772bc22f6238eb368c47f4d34fb98db9124a44b8443cee92d73c6086609fd2f1", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kavach", "colour": "#CE1ED5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628186641, "uuid": "79511045-b7f2-4aeb-a5d0-65473f046290", "comment": "Malware payload", "value": "76a3a4a0dde74d5ef0c7c4c98ca01b0eae91cd65", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kavach", "colour": "#CE1ED5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628186641, "uuid": "ba0c6b16-3641-408d-8d1f-27c31eb69c28", "comment": "Malware payload", "value": "9e5c8c239c1e37e70a68eb127f44f5d1bd17e99a6948d4e2079a6e080c97d7c375c89c523207b9f2ae69b0e4f9ad503e", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kavach", "colour": "#CE1ED5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628186641, "uuid": "8ea9b8b2-62b5-49c3-8524-3c246aa30967", "value": "T1A513066122B48B61E6AACB71832254700F756E465874EE1EDCC430CACE73B46C6D1B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628186641, "uuid": "d41fbd4a-c36e-4b64-b687-fe480630c6ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628186641, "uuid": "1a1995d3-e79c-46b5-9266-5115b55a3d61", "value": "384:I6qpvOmYFUgIixW9lR/J4AdwHufJp0GRNWQzWvwtokwrwq6uC8g6PhnM92CsWUeH:VqcmYlj69LDEGRF6Pe94hziR6Pe94ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628186641, "uuid": "10236e00-3d2c-4afc-8cac-d0499c95e864", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628186641, "uuid": "ebc7c07e-202d-41ec-b1b7-6fe7373b7850", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628186641, "uuid": "377d89a7-1bf5-485a-aea5-51788b451024", "value": "KV-Update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16d61d0-f5c1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetSupport)", "timestamp": 1628149755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149755, "uuid": "df240526-2635-4dd8-83a1-c3061af72a7d", "comment": "Malware payload (NetSupport)", "value": "c8f3e604a88d2b25f9eaaf3f5ca625d9", "object_relation": "md5", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149755, "uuid": "e604a4c8-2a01-44ab-8493-bcfdfe31b957", "comment": "Malware payload (NetSupport)", "value": "7879720cfa32665c40e8ffaaa0171ed47563698960d5885d20e0b6a7af8e08ff", "object_relation": "sha256", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149755, "uuid": "b46d5245-fd76-476c-acac-87b5b507e596", "comment": "Malware payload (NetSupport)", "value": "4f312f7d0489df0dddf50c3b097a249ff7b59c01", "object_relation": "sha1", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149755, "uuid": "d3399d2e-be1c-4585-812f-72ebfe3ac75c", "comment": "Malware payload (NetSupport)", "value": "de80569b0ae8a502eab1da19dbafe751b04bc032e2eb3fc2f2b6d406fbe4db75ebdf431df9b5b1ae9a63501131d761d7", "object_relation": "sha3-384", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149755, "uuid": "ace7b9bc-d7b6-4250-81b7-db4846cb8aea", "value": "T115F5013BB268A53EC4AE0B3245B39360997BBB61B81A8C1E17F4090DDF764701E3F655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149755, "uuid": "2a3f6678-7b11-4c9f-ac72-7fcc8fe7b0c1", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149755, "uuid": "1b86fedc-ab72-4e76-adbc-5d8cf14cfceb", "value": "98304:RSis6mcGGKYFaTplAFZ8e/QoBQ+DidXvh6d204OOR5qmm:8ZuaplIZ8gnBZgJ6M8YYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628149755, "uuid": "035c2156-7119-4b99-98c2-dac17437930b", "value": 3621344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628149755, "uuid": "adc590b5-c87b-4796-9421-f1e16337b6c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149755, "uuid": "af8c8bf8-bc82-4781-a5d7-96810975ffd4", "value": "7879720cfa32665c40e8ffaaa0171ed47563698960d5885d20e0b6a7af8e08ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf9a625-f600-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628176966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176966, "uuid": "fc55baa8-264d-49da-a9a4-a3bfd6ab0e7d", "comment": "Malware payload", "value": "15d1d1f6b45ecb4da929978f8be4ca0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176966, "uuid": "a8600ee5-f435-4a7c-9c78-c56c5d5077a6", "comment": "Malware payload", "value": "78aa874c9cc7844bb2ae828e35d96ca6f978e164908020461c84e8c0c57529b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176966, "uuid": "29db7846-4fc1-4e5a-b511-e696c7ca177f", "comment": "Malware payload", "value": "63c9d99a7540231970f8725e9d5d59b5abe82b0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176966, "uuid": "7ef89900-49c6-4623-9c4a-4019038aacd3", "comment": "Malware payload", "value": "128d7d688db22e341f621442ecb8055dd4ab18943df0330765881a51c99aa7b1e495f283b226f0e99604b24adb03b54f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176966, "uuid": "28e69590-18c5-47d3-899d-864f94a6b4b5", "value": "T120063352BD949A72E9310C7545A67B6068BDBC201B098FF7D394AE2EC9350D0B23CB77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176966, "uuid": "7a04584f-f11a-4bd4-a786-459da52bd1f5", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176966, "uuid": "cb274571-d908-4ba8-805e-872d01b46cda", "value": "98304:JlH9S7bPMmbPICPYp0+3Rdy0JiLADmy7k/DBXF:pS7bkmrICTzAay4/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176966, "uuid": "e09c87df-f138-4ce9-a0e4-37b999001acc", "value": 3747621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176966, "uuid": "7412d3f3-4a69-474d-850d-c4e544a7caa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176966, "uuid": "d5ae46a4-dc6b-40be-9ed8-7e0b518df8ad", "value": "15d1d1f6b45ecb4da929978f8be4ca0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9000c1a6-f5a4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628137270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628137270, "uuid": "7cb3552b-3d74-4d35-b059-7fa8882fe0c9", "comment": "Malware payload (AgentTesla)", "value": "e9d4fa4f16e79f6aca9ce3761cf58463", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628137270, "uuid": "f207443e-8554-4fb6-8ebc-35bbdb66dfff", "comment": "Malware payload (AgentTesla)", "value": "78b22dd43ba0c201a7f63a9e7c7c59649395709a86aea45787103ef37c715798", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628137270, "uuid": "8c727175-00cb-4c2b-a5d9-3a6cecfe4569", "comment": "Malware payload (AgentTesla)", "value": "f2441d782327d923b52c5218815b42e69e37ea5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628137270, "uuid": "a433c866-9585-4986-a626-a33352809d04", "comment": "Malware payload (AgentTesla)", "value": "4430b5cff64f1442a8656d90ee42b68b0f85992f4adb435ec975b6f1753055865912d8b29ac41def8336123700a3cc82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628137270, "uuid": "a8bc5aa3-eade-46c2-a703-9548ca2afda8", "value": "T1FA15063ADE1BB31AE9EC81FCD410054A92DC8EA3B4DDC856B842FC57A2F090D65945EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628137270, "uuid": "b8389483-4434-4f06-89d1-da29f306e9e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628137270, "uuid": "3961a4c5-2d45-4906-8f44-706297d049ce", "value": "24576:z1z7UiozaJgA3v+tU1+1nGsUWVAaWlCJw5:xz7UTzaJHf+t2k/FVHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628137270, "uuid": "20fd59ae-7bd2-4494-81e8-4d06c8854f74", "value": 942080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628137270, "uuid": "0650e2aa-5d48-414c-ac20-1f7e3febd098", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628137270, "uuid": "d07743be-1f45-4bb8-bf2f-3de3c53384f5", "value": "AUG. PO..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65be006e-f600-11eb-8fa1-42010a9c0011", "comment": "Malware payload (FickerStealer)", "timestamp": 1628176713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176713, "uuid": "49b3b8b3-1dd6-48ab-9213-b66d47fc9bd5", "comment": "Malware payload (FickerStealer)", "value": "9fdeed473f923e282c4394ff58191cbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176713, "uuid": "a9f13df5-0ab0-426a-aa7e-a9b2958d62ca", "comment": "Malware payload (FickerStealer)", "value": "78dce934e15d7dd8be0038d350f32d1d02128b560fb328f954ce44b7fead353e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176713, "uuid": "b3c3c1f9-7ffa-476a-8905-44660a5bf897", "comment": "Malware payload (FickerStealer)", "value": "2ba8aafc4717afd8d374448b2193adba7a3d3f11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176713, "uuid": "d0f65478-fb88-4129-9ab4-f0fd96a80b32", "comment": "Malware payload (FickerStealer)", "value": "2f1640d5c50da13400afc1646f05ffd125f5f6627080ecbe895a8d6337769f27ba84b3ca9a3897ab0ed8a297a59507c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176713, "uuid": "e232747e-5769-4cdc-b03b-e87b57dac68f", "value": "T19BA49E1064E82D26EE42627D48AB8366A73E7E705E33C7D376366675CF231C3E9A4341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176713, "uuid": "e694e352-1cc4-4368-9454-d7ceda39e37f", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176713, "uuid": "c85bcefb-1b70-4d0d-972c-f9305e1bd11a", "value": "6144:i+0ZycPjPPztWO/9adNDF5AJxbjYfC1lAAJB/L1XaW0rLFb56dpLN4XQKJ3:QycPzPztWuad5ebj09AnxXaW0rN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176713, "uuid": "c42a314c-d77c-47d7-9df5-db42694d283d", "value": 481292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176713, "uuid": "9a19dd6c-d6fd-4049-b9e8-5c9916f4e667", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176713, "uuid": "d7aec953-cac8-44b6-906f-1c7acb1476fb", "value": "9fdeed473f923e282c4394ff58191cbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c156c3-f5e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628163610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163610, "uuid": "ee1eb479-c9a9-4049-90d1-54e59973cdfc", "comment": "Malware payload (AgentTesla)", "value": "42c8a2ef6ceb995ba824c1571f695ffe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163610, "uuid": "591e22f0-99c1-4acd-83b8-a5c97276abb2", "comment": "Malware payload (AgentTesla)", "value": "7a39ee4f4e2772032e1609736832971ec322b1fac47458b10d35721bdea4c31d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163610, "uuid": "01d21ffb-72fe-4957-a9eb-a840e72dbd99", "comment": "Malware payload (AgentTesla)", "value": "b82fa37c0f10e887136b4159bdae148e44f25fd1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163610, "uuid": "cf611486-7e83-4c2c-9008-c5bf082289e8", "comment": "Malware payload (AgentTesla)", "value": "60734d5422e8a81db6bc10b2b3883d575a02ddd252652fdd5d011d7caa5f59bcb9642ba68af36653713c0e7f9e95f845", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163610, "uuid": "34ffbb0a-d416-4c03-b88b-efc66a56f223", "value": "T17CC4DF417148C1D1DA890A73E423EFF824852ECBD6AD449F6B9AFF5839B27D0D41EA0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163610, "uuid": "4e30cfd5-3bf2-4e24-bcfe-6582d0e0a881", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163610, "uuid": "916ce306-a318-4806-9c99-4b4d5ac85287", "value": "12288:ECRshqSvWzyIReAShJtuyz5VPZbxzSI5:ECszaxYJ37Ztea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163610, "uuid": "d6ec9ea9-f0bc-4add-a1f0-971b790b1868", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163610, "uuid": "5e148af1-2eb5-4982-8c0c-eb0e15c542a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163610, "uuid": "6fa782a3-15a1-488d-b0b4-2fb97b4a444b", "value": "payslip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4076450c-f5c3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetSupport)", "timestamp": 1628150451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628150451, "uuid": "4245d938-abcb-4419-a5ff-3e3e62675788", "comment": "Malware payload (NetSupport)", "value": "247e8d7c97da1778e87233b14e27d7b0", "object_relation": "md5", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628150451, "uuid": "991b9ee6-c0a5-4a3d-b6b5-288161392048", "comment": "Malware payload (NetSupport)", "value": "7a5f2afe726768008f80860aa992e56e01cb609d6a0510348a528182ae4ad8d1", "object_relation": "sha256", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628150451, "uuid": "4df73b35-0e5b-43f5-a6f8-293b6cc26dcd", "comment": "Malware payload (NetSupport)", "value": "355362876088aa1859bbd1ec9612c8722f3cdbd7", "object_relation": "sha1", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628150451, "uuid": "f8c88607-3401-48c3-8fea-8a29a5652ef5", "comment": "Malware payload (NetSupport)", "value": "702d484d34d6a1a0549c508dc04d27e815327c8ca40000c890b388cd618d0e1394914443ab6376b72856bc400a6e0d4e", "object_relation": "sha3-384", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628150451, "uuid": "9ecaffa4-e026-4c59-a7c7-6703ab522cd1", "value": "T1C4F52249DF35A1D9E0895F7688226EA2383E7C3D5F7CD65822B3F7098172AC141217AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628150451, "uuid": "a2409c5a-9e19-4c62-89ff-4b2cf13f7411", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628150451, "uuid": "821f7b60-1a20-48d7-877f-838ab9f0e3dc", "value": "98304:QmYkk/dwG9dx8s/2gEY131oV0oAVSSH931:tYkWwGnx8C2zq31He", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628150451, "uuid": "e9557e64-80c5-4966-980a-420d7f269dff", "value": 3634320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628150451, "uuid": "7aa8b9af-5e29-4532-b6d5-0b74c85e08c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628150451, "uuid": "81331b46-2973-40b7-a5aa-640105965be7", "value": "7a5f2afe726768008f80860aa992e56e01cb609d6a0510348a528182ae4ad8d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19427448-f619-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628187322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187322, "uuid": "ed773bd9-bea3-47f4-be87-72c03399763a", "comment": "Malware payload", "value": "0e58ad12df9dc2be0d3719af3081e022", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187322, "uuid": "91752e63-dbd3-418f-8b53-a7927345f989", "comment": "Malware payload", "value": "7ab2a679240ea3d06d03e67f8651916fa5c56408bd4e1660d2afff9f2ab354fc", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187322, "uuid": "4925f7c3-0313-4881-a1b5-81310ae4c65e", "comment": "Malware payload", "value": "9e22b1e6e7cf810de926957757c8f5ce54092408", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187322, "uuid": "561a2a65-dc0e-403e-aae9-cbf86f148f79", "comment": "Malware payload", "value": "8d0e12cb2694171c8766ce8b54ac1efdf2f0c7cba5c689ab616d4da53ae23cd162fc9f20d70cba75cb60d40a3d38d442", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187322, "uuid": "e2d450a0-9183-48de-a8d5-3956b5c46479", "value": "T1A4621A1CFFE59375C6FC5AB109B3A30003F9D2029C22EF2B5DCC946A7A13AC64A557A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187322, "uuid": "497f35da-a6fd-4839-a203-dba2ff8b4f52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187322, "uuid": "1d4df5da-03de-4ee0-b15a-5d2118cf15d4", "value": "192:U2EwJhfSABng6SHxGuXCMKU2jV51Y+6nr1obkBOg9oCIts0uOTpGyeiWLMbfvSTl:UcjBiI+sV51OnRobCV9oCIt9pnWiEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187322, "uuid": "6e792bb7-29d2-42b5-a3df-616e3470512b", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187322, "uuid": "b40aa5d2-ab94-4cbe-b664-3f4e5d456f46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187322, "uuid": "2b80e855-bf19-4fa6-9154-6cbda95c0a5b", "value": "7ab2a679240ea3d06d03e67f8651916fa5c56408bd4e1660d2afff9f2ab354fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55cad94-f628-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628193999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628193999, "uuid": "80fc0f59-4b5b-477b-8398-3378ea4adf6f", "comment": "Malware payload", "value": "1810992703a3b39d1f14c8be78af9d8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628193999, "uuid": "511068bf-3d35-40e6-8228-9a25b36c7905", "comment": "Malware payload", "value": "7b05bcd35f34368fcb1f2afd7350b8a6f003cbfaa9833f1a9e8d10a7997d49af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628193999, "uuid": "bf153f16-7432-46da-b455-1b81eacde811", "comment": "Malware payload", "value": "9df4f82538d4f7cf515941fc26ee5d30ebe115f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628193999, "uuid": "d2d21ea6-275f-4d71-bea9-3d7e20a1bcea", "comment": "Malware payload", "value": "052aa19c45b72d89f61feaaef536ed20705d3138fef4c7d2dfd538478208605f5f3f6dc6bfd301c336f745d03107d0df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628193999, "uuid": "d028eb4b-8dc8-4d8c-97cf-251b394abddd", "value": "T1CC056C2229EF154DF3B3ABB50FC4F8BE46EAE5775B1AB0B638910B454322940CD61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628193999, "uuid": "f3aecfc1-e5c3-4c9e-af11-5d4cd9cfa32b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628193999, "uuid": "53dc3912-e1e9-4cef-a57d-70f121e7ecad", "value": "12288:wRoR65AXwgFvuSSOsYSoGe6jbLzN/NqB0ktAffIMKZoyZQNG7xSfQQJVHvA:4oR6qgQr6zzdNtqAfJKZoyONGVrgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628193999, "uuid": "76466b9c-c03d-4268-9b91-10e2bf541ca1", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628193999, "uuid": "b1fda24f-e1b9-4de6-b596-37d7fce75860", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628193999, "uuid": "c2747628-5fbd-4e88-9ff2-039e4cde496e", "value": "AEGFS1872Q COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f89fa4-f61c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1628188982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188982, "uuid": "66c95717-5ae6-4c20-9408-86ad744b5e09", "comment": "Malware payload (Smoke Loader)", "value": "3b7ba44b1c5bdb34ab82e6ada3ffd3ff", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188982, "uuid": "b9b291e8-da8f-4249-abfe-2011114350e2", "comment": "Malware payload (Smoke Loader)", "value": "7b29622208b0c1278250c46855e38fde0b9d67c1263bd64fcfa283424af027e4", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188982, "uuid": "77a05f3e-422f-4848-a6ac-118ddb4324a3", "comment": "Malware payload (Smoke Loader)", "value": "5b52bd80fe6ae0ced0f784bc211cb47b239c4d84", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188982, "uuid": "3d86d6d6-4ce2-4cab-9480-62b70845aef9", "comment": "Malware payload (Smoke Loader)", "value": "b74b482899b8150b88d887f823f686592bd15f1f31dcda74f1550571e881ffa4ebde2dd16968cb89bd523addbee2bd07", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188982, "uuid": "575f70dd-8db6-4e0c-a3ef-cb5842bd190d", "value": "T1E724CE113680DC77F12239B18866C7A27A27FC69C9249B4B7B85739E2F312E29F35345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188982, "uuid": "686b213a-2386-452f-b48d-e60ab1544f8d", "value": "c36bba2f7ed1360c17671decb7b1e9d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188982, "uuid": "cb84d63b-e027-47a0-b27a-7a0975807007", "value": "3072:1uSgdizPBtRL0nTvuX4wWkd3P44lw5qWDkGD0egDzxJWtk02syVUI:oJEtRL0nTWX4wWwDl7WPuPxJgLBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188982, "uuid": "569c5481-3c06-47c4-bc9f-ed837d430f90", "value": 222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188982, "uuid": "7e1d8693-6e4e-470b-8c8c-40031c7f4137", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188982, "uuid": "737ceb02-10e3-42cc-ad7f-82888076d09a", "value": "3b7ba44b1c5bdb34ab82e6ada3ffd3ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cda9db-f618-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1628187207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187207, "uuid": "2570ee44-7102-4c90-8f85-2225db5dbc22", "comment": "Malware payload (njrat)", "value": "0a57a396163e5ec44ecd2fb4e59db4a1", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187207, "uuid": "1db79c60-003c-4047-a316-88062d47f8ec", "comment": "Malware payload (njrat)", "value": "7bf2d1167b4cd57a72aa1c34b2c3f978ed42569ff0494411af164b1ead715466", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187207, "uuid": "8145aa09-7788-4b0c-9fb1-b3171caa4c8b", "comment": "Malware payload (njrat)", "value": "f917cff8500b32b1405b914512e263a064fa904e", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187207, "uuid": "3fc668ad-7e36-4239-a6ef-95653c2681df", "comment": "Malware payload (njrat)", "value": "7fba9a80f6e080a86130659225b575d1896d6b246c2ef7095f5e458539d2ab91e336a81b651a3606c8f30a5726ee3c19", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187207, "uuid": "0855ae9e-57ac-4675-827f-252204d90adc", "value": "T158B21A4E3FA98866C57C1774C6A59A5003B491470423EE2FCDC564CBAFB3AD91D8CAF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187207, "uuid": "6e7d26a1-6c88-413f-ba68-65e369351b1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187207, "uuid": "d16b7fa1-fcb1-4784-9a2f-3077b35e561e", "value": "384:rfQ+ILgIbOprgPsUOSU0kB1kd6dg7GYh/JomRvR6JZlbw8hqIusZzZTLH:ryLL6MVU0NRpcnuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187207, "uuid": "4510af5d-d329-4c28-92cf-64e6390a73d3", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187207, "uuid": "7be747c5-5da2-445d-9c33-3744987ea252", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187207, "uuid": "15b09217-90c5-4080-bfaa-d76b8f2e0653", "value": "7bf2d1167b4cd57a72aa1c34b2c3f978ed42569ff0494411af164b1ead715466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b703de-f619-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1628187371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187371, "uuid": "ab121282-a842-4503-9922-c743e9cf3532", "comment": "Malware payload (njrat)", "value": "7d9c3ac18392b467e24e34fece6b8e6d", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187371, "uuid": "63c1cc7e-6ef1-4b13-8ecd-49b7bc2786ab", "comment": "Malware payload (njrat)", "value": "7d6822107e82ad3fee7b901e4e74bc9f885892da1a1378e63f8cdeaf651b4f49", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187371, "uuid": "41ef8615-976a-460d-aa2a-b7baeeb1f002", "comment": "Malware payload (njrat)", "value": "f74dc15f9943377a5b375690d7a6730eb19eafa5", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187371, "uuid": "f9f167f3-b6cf-4d1a-a8b1-603b60e22949", "comment": "Malware payload (njrat)", "value": "1b3f66ae64f1eda7dae2686ec40666de645adf54187ebcb8b80d7199417579ce85f1b949f4b336f35ba5df10e9bb4c0c", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187371, "uuid": "a37d91ff-84c6-4dfc-98f9-b45dd8a4e64d", "value": "T1F7A2394937E4C618D6FD29F64CB2531093B6D2838651DB0E6EEE40EB7E233854A14FE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187371, "uuid": "22bd7100-52bc-422f-8edc-92911360ab9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187371, "uuid": "adc9eebb-dd1a-42c0-a6e6-b3602173dd4e", "value": "384:84DKEBlK/e7oYK3sktd+dc0//37/LAZSTDTzB:t2E6/jYkbGHrD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187371, "uuid": "d86e69b3-b24d-4487-ad7b-5a0ce779cd7d", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187371, "uuid": "4f8d172f-081a-49bc-bd6a-0aa9c78056ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187371, "uuid": "40eb5c30-889b-4b6f-b949-cec8b900d326", "value": "7d6822107e82ad3fee7b901e4e74bc9f885892da1a1378e63f8cdeaf651b4f49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbeead7b-f5af-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628142175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142175, "uuid": "5cdd47dd-9fe5-4b15-9d21-7a3828e8a008", "comment": "Malware payload (NanoCore)", "value": "091a56c3089be047db43a5062100b14a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142175, "uuid": "bb9b6564-f169-43a3-8db6-e1bdf347896d", "comment": "Malware payload (NanoCore)", "value": "7d7f0a5a8799e4e02b9c4f4cc98d269ab3c43853fa1286e72882b4a74174fbe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142175, "uuid": "12d17544-9bbb-4ded-bf6a-c7778002699c", "comment": "Malware payload (NanoCore)", "value": "0abe33fe3ba0504cbf5f91bc63a273b8d752f3de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142175, "uuid": "19c21079-76fd-4f48-a850-65ab290b6074", "comment": "Malware payload (NanoCore)", "value": "3929d3ebc3f913ea15c316932af7764a85564045deced6d280295d150e450c491936bfd438c11590f987ddbb7aa2b7b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142175, "uuid": "7adf35b0-b3cc-4147-af04-44d399793b24", "value": "T10BA412202599CF90C78F8533D427805167AB5D83CF02EBEA558FBFC275373856622A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142175, "uuid": "63f8a4b8-f3ee-4a25-8063-0a2ae1d655d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142175, "uuid": "1d761165-022f-454c-90ad-6d66fb4ced73", "value": "12288:M2Z3+dCHzW99m/YiZGOVcL5TSuCdmVofGRQNA:M2Z3+o/qOVclGuCdmVofGRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628142175, "uuid": "27dbe32f-0e11-4097-85cb-01df74e2e1ea", "value": 473088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628142175, "uuid": "e84ad7e5-a5ed-4bb3-8077-4a400240fb45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142175, "uuid": "48db7d44-c4a5-4349-9328-35fb44e95b96", "value": "PAYMENT_CHECK.PDF.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4b8f85-f5ff-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628176299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176299, "uuid": "99e16fbb-86ef-4e72-8ac4-c10e56d60fb9", "comment": "Malware payload (SnakeKeylogger)", "value": "e20bb6118f308221644a10476def1aab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176299, "uuid": "256157f1-4643-4b3f-9332-91bbb5ea1d6c", "comment": "Malware payload (SnakeKeylogger)", "value": "7e10cb63c5eba68e512fead299844cbb0d92e60c980904fa90de210b72b922c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176299, "uuid": "392e973e-ac2f-4ee3-9540-d3c1b4ab1fda", "comment": "Malware payload (SnakeKeylogger)", "value": "b0ec6b391ae597e450e0ca6480c88b107dd1c7bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176299, "uuid": "4f4c8c42-5072-48a5-b310-0fd5c594b679", "comment": "Malware payload (SnakeKeylogger)", "value": "33ed0b7d0b5915544c293ff436237affd91786f702b124adf182a785471dbca218a541bf4d7e33ee4cc5e0ef3b6874c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176299, "uuid": "6ec6ce26-bbd7-44f4-9bb1-d0a24368b660", "value": "T110154A2229EB104DF3B29B760FC4F4BE46AAED33561AB0B639D12F4767329418D50736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176299, "uuid": "b2e71e09-4a3f-489c-9f25-b7697c339dba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176299, "uuid": "61b84de9-3d4c-4a20-b5e9-b69029aa79bd", "value": "12288:5KCjB3AqZsoR65AXwgFvuSS/I83RnSAJLL7g+gZTT006h9lbBOJtxYX3R+5LqyAY:4oR6qgwAZL7g+glTQhXbsD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176299, "uuid": "2ee769c1-11f7-406f-a559-3510bdcf5d53", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176299, "uuid": "144588e9-b0a8-4bab-87de-f15c55975299", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176299, "uuid": "9cda54c2-1263-41d6-af17-f2d18bedfb28", "value": "e20bb6118f308221644a10476def1aab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d1a960-f5da-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628160368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160368, "uuid": "81d91642-ffca-4d6b-b851-8f41bb4a2ae2", "comment": "Malware payload (RaccoonStealer)", "value": "13e4184af3976b743e28058d9257b4fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160368, "uuid": "99104448-e767-4429-8625-3eb23efad9e1", "comment": "Malware payload (RaccoonStealer)", "value": "7ee02b093120e14034b37111a4e3f717bb35615d7dbb1cc33f143aa9dcc31725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160368, "uuid": "983b0d9d-7915-4c7f-ab92-ca0c4eb02ae8", "comment": "Malware payload (RaccoonStealer)", "value": "bfcba4da4bb4f9e70954ec77fb9ae7c353b698c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160368, "uuid": "c6140f8f-e5e4-47e4-ac30-69bd99d36f51", "comment": "Malware payload (RaccoonStealer)", "value": "7bd21f00b54cd1ace9d6b67d9879a9d48776d777294c6e2461c8f873e66f5bc6eab2719bfc7524bd946f0a5f7ce619ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160368, "uuid": "d7acadd9-9250-4e38-853d-a4843f1a8fd1", "value": "T103B40221F141CB33D166457D8CB5C6A29B6A7C721D24C68B3FB9A65E3FE12D29F28301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160368, "uuid": "9230ec99-65ed-4809-88a1-f40e63d0caa6", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160368, "uuid": "3a0b4921-5d1f-476d-9994-c10be665e1dc", "value": "12288:9As2K+3i5VjzTXwhK0i11RLJ7OecLY5mA2sPxo9:yHK+3iDHMyJ7Oec0mnsPxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628160368, "uuid": "c702dd4a-ac71-4319-b4de-c27493fc67d0", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628160368, "uuid": "6fe437c2-1ab9-4a9a-8971-23b88f02df0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160368, "uuid": "fd5687d3-321f-4b0f-b6f1-53863469c513", "value": "13e4184af3976b743e28058d9257b4fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e61d733-f61b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628188270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188270, "uuid": "a751ed4a-47fc-4a65-952d-45f1bf3e75c6", "comment": "Malware payload (Formbook)", "value": "ad0e083604e877c46c305244b2b4db33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188270, "uuid": "7901dd7c-6880-4123-8479-8618070c709f", "comment": "Malware payload (Formbook)", "value": "7f3487008181899cb240230130ea395a1b4a925a0fcd216dfdced242e5495deb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188270, "uuid": "502efe9e-d0e7-44a0-9624-ea83e74d45a8", "comment": "Malware payload (Formbook)", "value": "42a23cb3d7010380ffd885bcb62ce4e634224541", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188270, "uuid": "97f2c77d-3aaa-4cf8-9366-3e90b727a8bf", "comment": "Malware payload (Formbook)", "value": "29c1b8e1135b8c810af965ced5d6451b34d80eae12a73798dae733f49e18fe147a85ba23d2d8bef73fe8f31ed497f363", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188270, "uuid": "7955521c-2dfb-4ec8-b9f0-0ce0e63652c1", "value": "T163C406E9D7E346D3F8316A36CB91523464323FC9A4E46DF54AC8B72C49311DEA31A92C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188270, "uuid": "ae894919-106a-4b61-abb7-6354388bbf02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188270, "uuid": "8b570444-9e99-44c8-b951-ad08868bf339", "value": "6144:KbkY80hQ+laooGEN26+sZ7ly2XQocFWgG/E38CVdKrLGdP:r+hQ+KNZ5yqcYgG/EsCi/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188270, "uuid": "fcf4c48c-fcfe-47f1-99ea-89a57eb4cb49", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188270, "uuid": "fe057601-6906-44fd-89a2-ebb00f1d99da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188270, "uuid": "7743f1e7-6266-4684-9e70-ff3b2e43146a", "value": "ad0e083604e877c46c305244b2b4db33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30b2116-f5f9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628173809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173809, "uuid": "e0f28a1f-8ba0-47d4-aa9d-8baaa7ed1734", "comment": "Malware payload (Formbook)", "value": "aa4b9c043e923952fee38447b9dd0b43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173809, "uuid": "3acc8098-4dfb-48e7-a280-43074891bd2b", "comment": "Malware payload (Formbook)", "value": "7f7af3d03481bb68e11a68e958ce6d8e96701a053eaa458e7010a4a85643cad3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173809, "uuid": "808612d1-cad4-4235-9b83-0f4365b82761", "comment": "Malware payload (Formbook)", "value": "14b12aeacdd0ae6ba8e1215c192f513c29bfef6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173809, "uuid": "196aac8c-8af8-4599-b28f-e1601e632b71", "comment": "Malware payload (Formbook)", "value": "6ff4b4e275a2a347689b5805a0d4a8569438e6ca1459e2fd3db15c72b2f6ce7da5b25c9e4ab6aa506d1ecf7b3f67d9f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173809, "uuid": "504c5813-e36b-4015-8db2-654f8b3ea5d2", "value": "T112E45C46B3E0817EC091177A4D8EEE6D791C6D906CB5200B3AE83F5D6FB9A05276903F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173809, "uuid": "dfd235be-ea67-44f4-8f21-23ed4e4de66c", "value": "f1f21c88e9cb261ec581191bb4c538e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173809, "uuid": "40e20f50-d942-41e0-9fa2-1fbf76cc3436", "value": "12288:cLJ8IaEF3CbhMemzpeVhpEj7c0DFtIGnu8:cLJRaElQMePyNtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628173809, "uuid": "ff189385-1586-4c03-b6e1-00ecb048d26b", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628173809, "uuid": "da1fb7fa-a424-4748-9f2a-3eb938152bd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173809, "uuid": "5b22d6b9-f500-4da3-ab74-8ff42888c3bd", "value": "aa4b9c043e923952fee38447b9dd0b43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76e1716-f5c5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628151617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151617, "uuid": "ce11bbd5-a832-4e72-864b-4b69adab2c43", "comment": "Malware payload (AgentTesla)", "value": "3b1eed37a79cba66ffa22626d7ab9b32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151617, "uuid": "7171c44b-6d1c-46d5-a371-0ee1b89ef6c6", "comment": "Malware payload (AgentTesla)", "value": "80c79c1c02b526e064b5567308ddd9ffc1a365087602cad228f352488394c92b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151617, "uuid": "2ffb580e-ffb8-4042-a4b2-a1df5f4cc0b3", "comment": "Malware payload (AgentTesla)", "value": "a81788a332ac919b2554b8e00ee60490ef9c03ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151617, "uuid": "637ef49c-4349-4541-b518-8b6fd273e827", "comment": "Malware payload (AgentTesla)", "value": "f9ef3e085dfba4aa424ed46c54f7b3d92db877a1e22c3507e4d53900603d13de7f4607c0ae4d13d71594c61d4b412136", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151617, "uuid": "e1d9ce07-db8b-46f6-89d6-df1e4767ec3a", "value": "T146D4AD6F3650726FE47AC43D6E581D26F524EEE3B2CEC583E4432148C93D9879A841BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151617, "uuid": "3863969c-46f2-4a85-a0ca-43928cad10f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151617, "uuid": "2f23b611-7f49-4646-a7cc-dad6f032169a", "value": "12288:p0Hk9bpO0Ut8GbzSbjfxZHOQCdr8z7KmT3whF0dwjZq6cH260NE:p0HkY8GHexZHOXrArSF0yjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628151617, "uuid": "ba263615-e5bf-4015-9874-3277cc0166ca", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628151617, "uuid": "d91f5259-d57d-4221-ad35-e77256f595fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151617, "uuid": "d05df9b6-3139-4e81-a7ae-7951d922076d", "value": "W452-001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a38a92c-f5e9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1628166708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166708, "uuid": "28d54cd9-0fcb-452c-b080-6a2b00f05ed2", "comment": "Malware payload (NetWire)", "value": "5c1a933f916891911ab6d69a65d0d855", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166708, "uuid": "995f4022-a2c7-48db-af0f-0d0bb2ea1f6b", "comment": "Malware payload (NetWire)", "value": "82137775a74b4ee9456e1fc73e4dc89f78d25dee1c4d3990df95570124ad439b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166708, "uuid": "a61c4873-6bdc-478b-8c27-98464a532b26", "comment": "Malware payload (NetWire)", "value": "37aa46c9b8d8e9475d6029d57be31f47409d4726", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166708, "uuid": "87eb61bd-fe69-4525-b63e-b2289123e677", "comment": "Malware payload (NetWire)", "value": "1cbe9fbd8e5b8d722f25960d1ef0ec9c18f338cad298dc8fe3da60e9e7d00abd20621ffe531453ae492642deea85fee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166708, "uuid": "da388111-d7d6-4e7b-ae5b-907043600165", "value": "T1BFC4E14579C0CD23D661263946A0E3749B3CED982F694B43FBD86EAF7E31BC56C24206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166708, "uuid": "ecddee14-a857-4d71-94be-36a2c8750752", "value": "7f3a4a0e96d9bcc5b3425ad3dca611da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166708, "uuid": "3f44b857-ebf3-4ce0-a8fb-95347ac9e290", "value": "12288:Irf0P3HD5Y+nvGtCsA/Rm2UGWGMqY2u3WUmVKeWe:XP3H1YEvzAAcW7KeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628166708, "uuid": "a5fda069-6e0a-4e4a-9802-3659e5598f1a", "value": 590718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628166708, "uuid": "7d316b4e-d43f-44df-b862-2204b54f0ddd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166708, "uuid": "3d1d52f6-3524-4417-8132-732c3f0f5b37", "value": "PO4500139005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5402d140-f5fa-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628174106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174106, "uuid": "3f042e46-6b47-4e8f-9b46-ede913a42d90", "comment": "Malware payload (AgentTesla)", "value": "dc48298f19bb6f6fb30f997d6f327b15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174106, "uuid": "a0db3072-3722-4d9a-8729-0aef1eb11f6f", "comment": "Malware payload (AgentTesla)", "value": "82a617b8169608e73ce761f98793ee01e8d6c936bd2f0a7048f1fcb9bea283c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174106, "uuid": "ff832fac-4f3f-41c3-97e7-b1327a178322", "comment": "Malware payload (AgentTesla)", "value": "11fc8d48bf253e4b79a82947ec2685b04556d1f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174106, "uuid": "9fcdf95d-ad48-4401-bcdd-a942bcb216bc", "comment": "Malware payload (AgentTesla)", "value": "5c611465c92c68190572d7c0c5893d573a20e9706dfd3f0840d253092f955e4f84a9b1209560e3d92c4aefacb3df3206", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174106, "uuid": "c14ed7d2-f203-4618-9844-9b185cc42102", "value": "T1F2157C2229EF158DF3B39B760FC4F8BE56EAE573571AB0B638910B464322940CD61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174106, "uuid": "d514cf99-04d8-445d-8f1e-4b11fc8abfb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174106, "uuid": "533e7243-0c86-4f84-89a5-e74899644011", "value": "24576:uoR6qgSD/7iCZ3exdG7ssq5gsC0nIOMy:ds7XXOsz/IOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628174106, "uuid": "f451da27-4653-40c0-a9f7-8e57f178e24f", "value": 889856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628174106, "uuid": "e2c6b7fb-464e-45bc-a2d0-909e0d769e8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174106, "uuid": "bc431821-b396-481d-9266-5f0f33f18dde", "value": "dc48298f19bb6f6fb30f997d6f327b15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb86c98c-f618-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1628187245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187245, "uuid": "82392da8-7587-4663-ad31-a6fd49270077", "comment": "Malware payload (njrat)", "value": "fcae8c3823eecebb9b8e0f9f2b9eeb89", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187245, "uuid": "5929ceb7-8b62-4d8f-901a-6f7225949795", "comment": "Malware payload (njrat)", "value": "84609f9e443225a23cca8ab6be910c207d220bb430fd543d0724eaae8f7df592", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187245, "uuid": "eb4166a0-4b08-46f1-ba2b-04d0562adfa4", "comment": "Malware payload (njrat)", "value": "53c49e7458363a22180916f30e6d945081b20d83", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187245, "uuid": "2b94acff-3691-4b5b-a1a8-801385d8cf86", "comment": "Malware payload (njrat)", "value": "074f7c3c9fe11d843939e780c113e2b67c133642f99b694d29847171584b40155874bc0882fd866478a82748cb347669", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187245, "uuid": "e37adf75-0002-44bc-b23d-09f708561e2c", "value": "T14C050201B6D684B2D6331D36493DA721B97C7D202F39CA6EA3D85D6DCA31580A634FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187245, "uuid": "3530bc9a-25d5-4f52-8e9a-6e38fc1a2768", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187245, "uuid": "f2ba1ebd-f7c6-45d7-a14e-06e62931459e", "value": "24576:ANA3R5drXPrfHh2bQA53HU+tV9iKOcuiLbGD:55j2Z1z9b0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187245, "uuid": "59f5f85a-2e80-455b-a895-b67fc4ae97f4", "value": 820992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187245, "uuid": "d412c72a-c71b-44d0-b50f-7ce27d6d1c05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187245, "uuid": "5ad451e6-9ed3-45a2-a97f-8df230eebf49", "value": "84609f9e443225a23cca8ab6be910c207d220bb430fd543d0724eaae8f7df592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64ede15-f618-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1628187236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187236, "uuid": "01ebf5b8-df91-44d5-8e98-05cf3bee93ce", "comment": "Malware payload (njrat)", "value": "66fb288e71fa3fbcd2b49d292f1938f6", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187236, "uuid": "89d44f10-4483-448e-b6b5-1b31e34e23a6", "comment": "Malware payload (njrat)", "value": "864dc421ddda3032938a5f1753ebc4d24c6250cd201204c4024012fe2b8a460a", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187236, "uuid": "d5bac1ca-4fac-4983-ab18-168dbd599e1c", "comment": "Malware payload (njrat)", "value": "d43b8f5dd1051eff35c5e1a87918b26a360187b0", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187236, "uuid": "86453d64-483b-4c58-bfef-419a6cb1617a", "comment": "Malware payload (njrat)", "value": "465da72817c7afede50a32dba9b970b7d906b81d5ab90e73801573dda276a49d01c90cdbbed17efaecd3b91f7e2ed94d", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187236, "uuid": "dfcffc31-5fe0-499f-9759-744a34a64213", "value": "T17A631D243EFA102AF073FE765BE475E69D2FBE623617D89A604133468A32A41DDD013D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187236, "uuid": "a2251aa9-6c9a-4e36-8508-ad6f9a0e9978", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187236, "uuid": "6b020765-90a0-4480-be43-387bab30833f", "value": "1536:twW5v5ShTLys41asnXrkn8vaUAPJ6AlNQDAo6PU4CR:twW5h4TLys4Bn7kn8CUAB6AlNQDePUlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187236, "uuid": "18db5ee5-1715-413b-94b3-b4a6cd330a55", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187236, "uuid": "5ae85fb6-d2e9-404a-9ca8-33dbc7bd3068", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187236, "uuid": "924eefe1-f92f-4dfe-8c32-1331f9aa6f21", "value": "864dc421ddda3032938a5f1753ebc4d24c6250cd201204c4024012fe2b8a460a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148a5176-f61e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628189461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628189461, "uuid": "eb6415c8-6157-4153-adde-d02a3d7e2446", "comment": "Malware payload (RaccoonStealer)", "value": "9539c87e4cd03d9c2c20ecc87d95115e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628189461, "uuid": "f25bac18-1aef-44d8-8303-dc457db66ef7", "comment": "Malware payload (RaccoonStealer)", "value": "86617e8f912a832ec0b5817f5a8f16e419b7a7746a638c9ec7406ddc325f5139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628189461, "uuid": "6715230c-5408-45a3-b599-e7d6581b236a", "comment": "Malware payload (RaccoonStealer)", "value": "0a1b4a6f1589f6363800a42203aa3c99da0d517f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628189461, "uuid": "e09b1729-5d4c-4cc8-bdea-bf762c9191d0", "comment": "Malware payload (RaccoonStealer)", "value": "2af5aa64e1455e3354d9413aed0bbe8194fb8d830a1ed46980619ab09c182aac59c82f6cae758d12ec4c82446e834e44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628189461, "uuid": "2bff08d3-0f39-48e9-8b89-ba173a1c8721", "value": "T1DEB401113941CC72F5513E750866CB606E6BFCA4D878978B7B8657AE3F222D2AF35302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628189461, "uuid": "96604a0d-51bb-4199-bda2-6c20573565dd", "value": "c36bba2f7ed1360c17671decb7b1e9d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628189461, "uuid": "f76a4e0b-748f-4872-9bdc-d823985292a7", "value": "6144:AapFL5f5BqRfZa8MgsNQRcoWwrA/qW1XBa73JATIRY7dSLtHPexJgLBI:5F7BqR0QcobASWV+3+TImEhPeYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628189461, "uuid": "122f0964-8b51-49ce-9167-1f50f17c2318", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628189461, "uuid": "cb36efb9-7ed5-4f20-93f9-69d17568828d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628189461, "uuid": "82abc367-bcff-4b85-a59d-82ae54040b26", "value": "9539c87e4cd03d9c2c20ecc87d95115e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2be1da0-f5bf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628148951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148951, "uuid": "678f7b13-9cab-4d4e-928a-1c36d1fab541", "comment": "Malware payload (RaccoonStealer)", "value": "5545293f7ee02ab0f2a62157441085bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148951, "uuid": "8b804fb1-a3ee-4c17-be59-89db323fc1da", "comment": "Malware payload (RaccoonStealer)", "value": "867208617c2dc209e5c6866cb963612b81b7b2d2e95abd6cf9615e1232ece5e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148951, "uuid": "98f5698d-bb4d-4480-9393-38eb925786cc", "comment": "Malware payload (RaccoonStealer)", "value": "a0e1d06402a63d9bd311ae85148df1297663312d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148951, "uuid": "537a5cbe-dc7f-4a2e-9f20-e3b8b8bfae15", "comment": "Malware payload (RaccoonStealer)", "value": "0636a7be1535481091324a7dba54af884890235ff22ada30e65176e9d16fdc8f1121a9a416ed71ce288fdac7d6a52c71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148951, "uuid": "f3178c42-b9ba-49ca-99dc-7dc3240ac333", "value": "T1D1A412293A91CCBBD13156B14C54CBE9EB6A7C705D348A8B3FC2B6597F242D2DE25302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148951, "uuid": "58cde5dc-9f7f-44b8-b2a9-fbb4c0dfab09", "value": "2a9c1ca66125aeff7a1c36242be63d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148951, "uuid": "0e10f90e-9eb6-4086-ba3e-e228aace7667", "value": "6144:q9uBL8tjQqzXW5uUyxLE1B4ME6YNHBhh0lHCsne74sVK+dGvmLp173NrLu5:q8BIe3upxSBNxMh0Ysn64AKqGY9rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628148951, "uuid": "f6f15188-b72e-425c-b37a-d0f46ff1a3b4", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628148951, "uuid": "b6de41c9-653c-4a55-b334-3d7f07b89d5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148951, "uuid": "b0b6ac55-1f2a-42dd-9a8a-25000dab4079", "value": "5545293f7ee02ab0f2a62157441085bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033e0475-f5bf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ZLoader)", "timestamp": 1628148630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148630, "uuid": "e19ec627-3722-4962-90b9-3b09252b6348", "comment": "Malware payload (ZLoader)", "value": "86cef6c066a05b3f67123fbf638b6b01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malsmoke", "colour": "#F9A941", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148630, "uuid": "4b44eb23-3d0f-44f3-9b99-7b91db2cc53b", "comment": "Malware payload (ZLoader)", "value": "86c37d778f584a2a3090ab170c8cd2fb3ddf952cde689b4c5a1efd74fc113a05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malsmoke", "colour": "#F9A941", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148630, "uuid": "250025c9-d6ee-4e06-b2a1-239737290d71", "comment": "Malware payload (ZLoader)", "value": "81618f8ecc48541c219aa974e4b16cab8f34203b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malsmoke", "colour": "#F9A941", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148630, "uuid": "009329f2-28a0-41f6-be14-98a5a92a02f8", "comment": "Malware payload (ZLoader)", "value": "450b9e3aec2d16d06da07d6849d9c0560eef29b4975b9a983169e9aba4fb3539cfc88ac14b5953f964aa66536a311cdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malsmoke", "colour": "#F9A941", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148630, "uuid": "8de62120-0a40-436a-a933-c9e7a3dccbd4", "value": "T18354AE61B28A4332C7DFC0B86D0FBAD63A2DED9E12BB5D1C5FB5915E42089DC940B12D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148630, "uuid": "2be36cd2-d1a2-4307-91f5-cf763543eeec", "value": "08450bd1a68c8a3b0a810abf7bf95ef9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148630, "uuid": "5ca1b238-05d1-46aa-9cdb-fb5b0d1572c8", "value": "6144:JZSK5O1iiCZm6bVhmwcEVWxd5QLA7RzAorc/Sg/Gp9z:J52ZCZm6bVEwcW25QK+oriSg+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628148630, "uuid": "9dcab57a-bc9f-414b-9b5e-f216cb902620", "value": 286664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628148630, "uuid": "843396cb-9170-4892-8c3a-9b6d23191a24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148630, "uuid": "f588bb18-ec0c-496d-a6f8-5664bf72482f", "value": "JavaE.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2011ac2-f61e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628189779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628189779, "uuid": "196b16cd-42ed-473b-a77d-6832c9a81416", "comment": "Malware payload (RaccoonStealer)", "value": "2fb30d134fa55b708966cd7ddc36fbca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628189779, "uuid": "57beb913-add4-4df2-81c4-37f661049cb7", "comment": "Malware payload (RaccoonStealer)", "value": "8703d4c714e624ffc12e2b5b0fdf5a351c7c3055a0f1b38457e54b46741d2f4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628189779, "uuid": "eb2f9452-913d-42f7-9e83-fc269d4feb0b", "comment": "Malware payload (RaccoonStealer)", "value": "ea47b39a1c0359da88f7f26ab671e10e2128dd1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628189779, "uuid": "1b41d6eb-4bbe-4ff2-b868-b5c1c6e689c1", "comment": "Malware payload (RaccoonStealer)", "value": "7811f299a85ce35c3591d84ee5337dcf92ce851b26c0f71e9b158b9c3457886f5373b92a93d8faca7c89662b7d32ac4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628189779, "uuid": "c873b3c9-0ebf-4bb6-9df4-eed20a101f3b", "value": "T111B401127940CC37F621B9B89865C6E52E67FC64D520DB4B7BC2579E3FA22D29B34302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628189779, "uuid": "a7625957-cd35-47e2-a0ad-7dfb8596e481", "value": "c36bba2f7ed1360c17671decb7b1e9d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628189779, "uuid": "17067cb1-5a81-426b-8d90-516e2492843e", "value": "12288:OPTXT1JlcXE9aYnapayDCdhKOaTIfnIUk7WYe1PJYL:ObDtmEAayOD8N8JYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628189779, "uuid": "558a1d1d-9046-4949-8e5f-d98a15bb1978", "value": 510464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628189779, "uuid": "3eb5861e-91b9-4444-901e-0770bcd24e3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628189779, "uuid": "24553bee-c8b8-4e7a-bcc1-49d013552e42", "value": "2fb30d134fa55b708966cd7ddc36fbca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7385ebef-f5aa-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628139799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139799, "uuid": "d7cfa426-b295-4b68-87c9-722fdd3e2050", "comment": "Malware payload (RemcosRAT)", "value": "d6ada04b5b74073a43e05c2cfbad451f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139799, "uuid": "b8ad2f1c-21bd-4173-8e6a-c6c35196dbd8", "comment": "Malware payload (RemcosRAT)", "value": "87df76ea8788701b874398c49b1ef57006ebce794ec7f3ef3077bf2172732a70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139799, "uuid": "7fcdc9f7-8c13-4418-8999-a4e7b0094541", "comment": "Malware payload (RemcosRAT)", "value": "23e5e05d6f7a4d3c8834a924dab7c74b58b3dad8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139799, "uuid": "8711e541-ed5f-4cb0-99f4-ceb36d1b862f", "comment": "Malware payload (RemcosRAT)", "value": "e4a6fc1f2c2cd9e0d5199dad271aeca38218c8eccd0b748c17b544c4df9862a022b2bde634e64820ca0684f0ca4ef723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139799, "uuid": "403bfd55-f0e8-49da-ac72-23d4054f49c5", "value": "T159D43959E2D568F6C2A507F66E277AA45808BD202D607DFB5DD01F8C8E389A1303DE4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139799, "uuid": "dcdb648c-9652-4960-a715-83e9c202960b", "value": "93f93c19958ee392fd5405cbaa49996b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139799, "uuid": "d49da4cf-f5c2-46b5-ae95-1f488d795cfe", "value": "12288:xeOX6MRF7wJLbjAXZCvdQ9GCUNzi8tYrfFyQgPf:k2lF7SHjAJCvdbhNzi8tYrtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628139799, "uuid": "65227947-3cc7-4d94-b7e1-d2a9a12a5b45", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628139799, "uuid": "7a447f04-26ac-449e-b23b-2b97947094ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139799, "uuid": "eb98e750-cb20-4b14-9374-cdc10aca7806", "value": "Orden PL-PB39-210706,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd35b61b-f5cf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628155868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155868, "uuid": "fedea05a-6168-4646-b1aa-5e96f1a5ca97", "comment": "Malware payload (RedLineStealer)", "value": "a5533b2c40ec7085a4c4fae8b278c665", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155868, "uuid": "2d2024ba-d5ce-4aa4-806e-48c8a66fd24f", "comment": "Malware payload (RedLineStealer)", "value": "8872cdeb47a23b1b3ca7746fd650f5d43a6acaa69e954dd307adb14785aa98a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155868, "uuid": "c3d5d87f-0886-4249-af24-f41ad285374e", "comment": "Malware payload (RedLineStealer)", "value": "e07a8a9c6117e85b809664459f04730e827db142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155868, "uuid": "c33b97a5-88a1-4f27-b6ce-be19591b1a7b", "comment": "Malware payload (RedLineStealer)", "value": "12e8d7495919b8a347cd165d996a7bd2760018f3609e391d67b9bff5814e83be4642eecf358f8be6beeb1aadd41d6942", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155868, "uuid": "63e2b06c-83fa-449b-a509-9aecab032771", "value": "T12ED6E161BA50CB72D886053180F69B756FB7B8325E60414F7BB876AE5F323C2267530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155868, "uuid": "266a7677-7abe-428d-84cc-db9b7fe74403", "value": "ecc36f6be970cd1f60fff6968abb9451", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155868, "uuid": "9e2857e6-c285-4b28-a3d1-ab8da1391dba", "value": "6144:SCKUCD623VzIQrUpC/EZhhR5eOJbMpylqIMLvFWrMDUIJo6hRwoOLprH:S+M6K9rUQ8s0YpylqRzFWrMvdfwoOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628155868, "uuid": "b4440415-5897-46c7-9988-e9699822f16d", "value": 12616449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628155868, "uuid": "30456a1a-8632-4bff-bbae-d1bbd82c7d3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155868, "uuid": "149fc611-e432-4dec-a1b3-138559dd169e", "value": "a5533b2c40ec7085a4c4fae8b278c665.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad364a68-f5d9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628160082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160082, "uuid": "1035d16d-3822-4fdb-a64d-fdf5e219021b", "comment": "Malware payload (RemcosRAT)", "value": "ab6139f5e23f66bd0c1455019771e266", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160082, "uuid": "d22d2286-1e43-406c-a205-4f027fdfeebc", "comment": "Malware payload (RemcosRAT)", "value": "88b1766ff9c749387b51b47bde3e387393a01d10133a04c5afb763fd9670926a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160082, "uuid": "9f8b9901-8d86-4767-88e0-66c2c31f1eca", "comment": "Malware payload (RemcosRAT)", "value": "32198d66530781380327dcd1d3cac8dc020b1087", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160082, "uuid": "00d97ae1-f419-4693-854b-b76e8dde9406", "comment": "Malware payload (RemcosRAT)", "value": "86510722473cb1cc6257eb72e57235dda5ffeaf26d0cc7427f6e9376c7953fd0b258f986941ffb1d2d52020715644dbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160082, "uuid": "ba0da086-8632-4a74-9072-1e5d5f303dea", "value": "T1BEE46D22F390C137D1212A785D6A8EF9AA6CFD14581820CBFEF57BDC6BB2285342554F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160082, "uuid": "9de4a18c-2783-45ba-8f1b-aa426c36d475", "value": "f1f21c88e9cb261ec581191bb4c538e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160082, "uuid": "505f6f36-8d65-42e7-bd8c-668c68b2110f", "value": "12288:cLJ8IaEF3CbhMemzpeVhpEj7c0DFtI9Mnu1:cLJRaElQMePyNtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628160082, "uuid": "bbc29de2-e0ac-4db2-9135-779de51a7bfb", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628160082, "uuid": "36224098-93fd-4050-83fe-8167851079fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160082, "uuid": "37d24251-703b-4d07-9449-b3bec24521eb", "value": "Re \u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u0437\u0430\u043a\u0430\u0437\u0430-5309,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c0750a-f590-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628128555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628128555, "uuid": "a5802299-c003-4756-86e4-a5541e95fa17", "comment": "Malware payload (RaccoonStealer)", "value": "6bcc5a2e94aae58a93037032209ca52f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628128555, "uuid": "43e46c59-a613-4448-b344-3fb0b808ee0d", "comment": "Malware payload (RaccoonStealer)", "value": "898430761a060253f40f0b6762ce837753b2b297909bbbc225c525cafd185cef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628128555, "uuid": "8150b722-94fe-4675-b421-055527293c03", "comment": "Malware payload (RaccoonStealer)", "value": "021371c2851c5cab908ef123290b514d3c3e1b9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628128555, "uuid": "aefcb10a-3993-45f9-8513-36b8362b2309", "comment": "Malware payload (RaccoonStealer)", "value": "2c7cb404c88e4a0e7c16793f0786afd76737ff86a03d65116f34b311735f1ed66a0b87ca1462c4ff55314a57e4fe917f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628128555, "uuid": "fd455290-50bc-497f-8294-6e8c42da723e", "value": "T15AD4D030A690C034F1BB12F445BA93BDB92D7EA19B3490CF91D52AEE52356E9DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628128555, "uuid": "5741b352-e4b1-41c2-b8b1-5a6262ca7cee", "value": "57bb9b4b2dab4ca0a9a9d0cdae0c89c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628128555, "uuid": "9e0e211f-482c-4207-8833-a2bf05920360", "value": "12288:KmMTTaqiHcix3y6HZQOlAj3V/dKpv3d9q:gTfiXthAJ10/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628128555, "uuid": "dc0957ec-1fe1-4f75-b10e-bc7ea7df8627", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628128555, "uuid": "281e055c-8920-486b-a1ae-684ae5c3adc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628128555, "uuid": "717f9bcf-e0a0-466f-a940-b6f577e57d31", "value": "6BCC5A2E94AAE58A93037032209CA52F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c232d8f-f5a8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628138901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628138901, "uuid": "a6db2389-b4b3-47cf-bf20-096004794254", "comment": "Malware payload (AgentTesla)", "value": "f63ddcfe83c77c5ad9d571e32723fead", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628138901, "uuid": "2d5c7696-dee1-4ebf-a591-69f7b9a57062", "comment": "Malware payload (AgentTesla)", "value": "8a1f70a1bd5d2cc96b5034dbfecb9adf59780500c3ed87312004894ce12275d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628138901, "uuid": "9eb06cb0-406c-4aa1-b33d-562a625b644c", "comment": "Malware payload (AgentTesla)", "value": "ac019c5c9a9984c98688fc33de812a41f100c6d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628138901, "uuid": "3bd09eb7-64fd-47b7-a329-4777333cb6ae", "comment": "Malware payload (AgentTesla)", "value": "19a7a30dccdbf4523ff41cc68038bdd0b1a472b70ce83f23f1975d5d630ab9c35e300819309292e6e76fe15c6dbebb98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628138901, "uuid": "098b7f18-6f4f-49a8-8762-1fdf10ad0262", "value": "T1B2D4AD6B3650625FE47EC43D9E580D1AF524EEE3F6CEC583E4432148CA3D9979A801BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628138901, "uuid": "3103b6d1-c1f9-4b5a-be85-f2f83b61d009", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628138901, "uuid": "27a878f8-92c5-4820-a643-1c3652c0c177", "value": "12288:7km0BZXU+KSKVNyP90D73r5sLu3KpU4qNovzK6vco37az+RjyV67BO:0BZXUL5nyP9GdWPII5vcor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628138901, "uuid": "434fb557-97e8-4930-a1db-043df0bf8367", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628138901, "uuid": "7f7db20b-4a8d-4c52-9d72-5b0cb8a15550", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628138901, "uuid": "0068b50e-2cc1-4f6b-a850-b6bca4e09a48", "value": "PAYMENT INSTRUCTIONS COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d5b0e3-f5ff-11eb-8fa1-42010a9c0011", "comment": "Malware payload (FickerStealer)", "timestamp": 1628176532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176532, "uuid": "1cd2f41a-5c30-408a-861b-98cc1935b0f4", "comment": "Malware payload (FickerStealer)", "value": "48ede083fc71d65ecccebaa824fd1dc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176532, "uuid": "83d0549f-4693-46d6-951f-4ea1c2e09bf2", "comment": "Malware payload (FickerStealer)", "value": "8a2365761853f027da2895b4f4a24f7f988255b00b837fe6caa6e8a5a067e99c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176532, "uuid": "da852a26-9160-4eec-b4b8-7367c5002d98", "comment": "Malware payload (FickerStealer)", "value": "14a6353634af2037c180a7d14bd1d312b51e34d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176532, "uuid": "e79490ad-99d8-4b98-a8a6-367d0340270b", "comment": "Malware payload (FickerStealer)", "value": "f33c855129597e0b3981933a80afe4f0d475572d723ab168b20b02aab21c84b9390013942c117984149f3438d6836915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176532, "uuid": "3d9dc842-adca-456d-a975-0359111316c3", "value": "T158A49D2064E81D2AEF41227D48AB8356A73E3D705E33C7D77A326575CF531D3AA68382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176532, "uuid": "f4def85c-4d74-49a1-8606-35c740e8ada8", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176532, "uuid": "10bee11a-2c04-4ebd-a9df-0d81c96897cf", "value": "6144:W+06dFf/CW9ELXwOFqLhWg/Tae+kAevdXaW0rLFb56dpLN4XQKJ3:rdF99s/q1B2oAelXaW0rN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176532, "uuid": "d0cea218-bfa5-4cf1-be11-832977c15f45", "value": 481292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176532, "uuid": "0977aca6-0869-4dd9-bf53-0f2d3a11f895", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176532, "uuid": "6ee245ec-fb06-4f4c-a49b-d6f84779652e", "value": "48ede083fc71d65ecccebaa824fd1dc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962001b2-f5e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628163480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163480, "uuid": "bba0925e-9823-405e-a00c-9a1842b3f1c2", "comment": "Malware payload (AgentTesla)", "value": "97e7ffd7a1f5aaa030f936300170aa66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163480, "uuid": "2e37c7cf-8c30-48d0-85cb-7eb10eb47f48", "comment": "Malware payload (AgentTesla)", "value": "8a39bf4eabdfaca0bbbf8a623fc2576534fd32fc0d3cc5f4de95e2830322f3b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163480, "uuid": "8150168c-e65a-40f3-bafe-b21b9e51a933", "comment": "Malware payload (AgentTesla)", "value": "5bedefd5edac1bf4f5e01de95d4e7eb60e41f212", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163480, "uuid": "3b682258-a1d5-4a43-aa5a-2f3f0b103391", "comment": "Malware payload (AgentTesla)", "value": "d4754ec3fbd0bdedd5250f0d3b87b648e4d7e9b08459daa706a180eed2fcb2b10f335396744da9812362ee0efa444d98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163480, "uuid": "472ec676-f7ab-4555-b6ec-3ef9118eece6", "value": "T10A056C2229EB214DF3B79BB50FC4F4BF46AEE673560AB0F639421B964322940CD51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163480, "uuid": "6bd03d5c-3cb0-496b-8544-9cea356e1874", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163480, "uuid": "70180220-3d06-46fb-9e13-0753ee13de68", "value": "24576:xhEoR6qgcNllce7ZPNOYs6DJ7QY4KugIw:nsxe7ZlOj6DJ7NugIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163480, "uuid": "b497c31d-5bb1-4e95-95c0-0b1c701b6499", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163480, "uuid": "4f5d3e71-2025-4339-a8cd-ff9e6a2ab358", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163480, "uuid": "ccbe19e6-c06c-4a0d-bf4f-59565f56e4ff", "value": "SND PBB469850_KOSUN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17f39dd-f5f8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1628173484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173484, "uuid": "b82bead8-c3dc-4560-9af0-6e2c2a2d9584", "comment": "Malware payload (AZORult)", "value": "a9aa5cc96156193b9e742b2b05c111b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173484, "uuid": "1144c0cb-942f-4144-9d92-2c99865535fe", "comment": "Malware payload (AZORult)", "value": "8a7136d6f15d4d79c4d1b89e39ac1c8678c49649d66a451c90a135e4db278b6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173484, "uuid": "7e558b4a-8f2b-47dd-a818-864bd4f0f128", "comment": "Malware payload (AZORult)", "value": "d352379eab94a73f6289af90877def65385e8b2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173484, "uuid": "15d8e759-47fb-4a25-8573-08b237f30769", "comment": "Malware payload (AZORult)", "value": "8c6ff31098f1c501916b49bcccfa341a81ff9dbce2a638a8b8de770840d89bfcaafcbe682fc401b6c174d9e237809538", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173484, "uuid": "c9528300-ee66-4838-b319-6b0fd6bee80c", "value": "T12FE4E132C7982DEBC1BD907AD0093940A5F7C1BEA662F3463DB51BEE20D679047B960D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173484, "uuid": "ea242f16-b1fc-4079-b964-c6b52ddfd0cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173484, "uuid": "c0c304c3-0fe6-4aee-bf52-e3ab5ddf05dc", "value": "12288:6tEn22jblqFTdnsgNILprnbrJZhltmRcrFjEYW5t:6qlqFps6ILprnb9Z3tAchY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628173484, "uuid": "0fa7261a-1ba4-40c1-b14e-6a892a0f1c74", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628173484, "uuid": "162d46ee-57ae-4382-8b1f-cb1a69712dd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173484, "uuid": "d91528f9-1d57-4c73-ab67-6f715937aa26", "value": "a9aa5cc96156193b9e742b2b05c111b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c165564a-f5cd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628154962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154962, "uuid": "3500ba21-3abc-4c5f-9daf-573f3baea63a", "comment": "Malware payload (Loki)", "value": "69dd66c92413e7d9f33e98b39d3e2984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154962, "uuid": "82f8512d-6c4d-4a59-b0f7-a46139368177", "comment": "Malware payload (Loki)", "value": "8ad687f4cb4a7c3cdf496a11b138089ede3f4c269bdbce4dfa8e18a8f7f4f144", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154962, "uuid": "c7cb1e51-dd60-483a-87f3-2723f2f8f51e", "comment": "Malware payload (Loki)", "value": "c854036ba58a0e040ea9ddb9dc2fdc0bbd039c39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154962, "uuid": "937cbe0b-cd4a-4f0c-ac5f-485479f2b2e3", "comment": "Malware payload (Loki)", "value": "b07f42a02681fb777d5a5960735dda9b870915226b94c64adea97711de06c51302c0172c7d059f8c3ad728fc890d0699", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154962, "uuid": "65f83de2-6617-48b7-8185-0e2d63b45d18", "value": "T18964E00575C1C572D2B218306C20ED754E2EF5301BA86E9B6B98577A0F326C15A3AFFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154962, "uuid": "1116fdac-eb3a-460e-9fa0-e774444149f6", "value": "7f3a4a0e96d9bcc5b3425ad3dca611da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154962, "uuid": "18134d90-77a8-4bb1-bcb9-4d0e47b453c1", "value": "6144:Egrf0xh3Hfr5YwuLpV83AGefjrBA6gRwPEaybRK32KfFQVo4NRqpxf/89B0XvgOo:/rf0P3HD5YVGefBAZw6RG2K9p4NRoX8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628154962, "uuid": "9e843580-89ce-4c03-9dae-4b9f206c923c", "value": 331916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628154962, "uuid": "bcd21488-f7b9-49c8-b210-e3df6cc4a306", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154962, "uuid": "5d84c560-9f5d-4a70-b6b2-8bd7c3ad8502", "value": "Order2021.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60e8b71-f5b1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628142917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142917, "uuid": "923926f5-fd8b-4742-8553-cee86c2776c5", "comment": "Malware payload (Loki)", "value": "44b009068b134ea6e631f1a37c4ce3d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142917, "uuid": "9be9f934-cac6-4359-bc8a-9e3a633d34b0", "comment": "Malware payload (Loki)", "value": "8b6e08de57154b0a2e3805cecb24f32a487ff9768787c167a23a47927c93561f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142917, "uuid": "52b38f83-d188-453d-8466-47dbcae801bf", "comment": "Malware payload (Loki)", "value": "6b89cea3f4cdade3cd21f23939dfa79d9085e671", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142917, "uuid": "9fbe0d73-a452-4860-92e7-411a4551e766", "comment": "Malware payload (Loki)", "value": "4fce0181e9fc70c452aedf825a1cd69d09e350acca83b039ad7ea60aa0c99dfb0dfe385c8353d843891147c2012d9db0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142917, "uuid": "67156e66-5546-4e8b-94b9-b200bd533d18", "value": "T11864F100B5D2C532DA7A4A308490D9B40A3EF9B15FB92DDB73C8A63A4F545C2463BF67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142917, "uuid": "34be300e-e7ce-45a7-bd5d-3cf37e7c3676", "value": "7f3a4a0e96d9bcc5b3425ad3dca611da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142917, "uuid": "32f58ec6-0818-4afd-a227-bfff47f1c2ae", "value": "6144:2Grf0xh3Hfr5YwuLpVIj85WrOaQkb/K9i9QuJG5+zgZDKdJLXL9/0w25/:Lrf0P3HD5YGNOZkb/K9i1E0hX+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628142917, "uuid": "09cfa77e-6d87-4139-a23f-d0608fa0b97b", "value": 336215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628142917, "uuid": "7bbaa7eb-dd34-4d1a-8f23-5db6e991817a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142917, "uuid": "59260e57-2721-41f4-9a33-8134ab15181c", "value": "mazi file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d13b8f-f600-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628176924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176924, "uuid": "3b7e16ee-df07-49f1-a4b2-dbc366dcc74c", "comment": "Malware payload (AgentTesla)", "value": "65073720c547a156668f2b6133a0d8b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176924, "uuid": "7f836bdf-0fc3-4a21-857f-eaf8621d6f9b", "comment": "Malware payload (AgentTesla)", "value": "8c97d61551833fb8f5c8c3c44c731881104885a390623816a7d57f964b1d4ed5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176924, "uuid": "1792be17-142f-400e-9ebe-4caf89847783", "comment": "Malware payload (AgentTesla)", "value": "d44a75a6d48bdcc95954b1fd7088269cba384e05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176924, "uuid": "79a20f16-12f1-4cf2-baeb-06ba84b88626", "comment": "Malware payload (AgentTesla)", "value": "9f2c56af1217c23d6228a4093c8e003164b62235a7c8aad83d4cb46438b541e6c3e172430c3f8b2fc53f9226b4b82065", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176924, "uuid": "87d159bf-a3b4-4719-9d2e-1dc43437b54a", "value": "T1A1056C2229EB214DF3B79BB50FC4F4BF46AEF673160AB0B639421B954722940CE51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176924, "uuid": "90001049-77cd-4166-9abf-a3e7a533898b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176924, "uuid": "be9c7027-4c4e-4b70-bc6f-d661155817b4", "value": "12288:zWjRtAqZ8oR65AXwgFvuSS5I5ZULKA105ZzZCXeKTtqi3zKBFX5cwBoCNz:foR6qgQoKAkzZlQIi3e3XmwB1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176924, "uuid": "b3d488d3-4757-418f-a040-f0ceb676faaa", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176924, "uuid": "dfc95484-a48f-4338-ae30-e7928a858c80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176924, "uuid": "d81e63e0-32d4-427f-85d1-e546d3e0f298", "value": "65073720c547a156668f2b6133a0d8b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4bda9a-f5f1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628170525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170525, "uuid": "33da7d05-7e62-456f-98ee-6442b9ebad71", "comment": "Malware payload (Loki)", "value": "5bf999f74574d83a0cf2a1dd194a4bf3", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170525, "uuid": "57daa30e-50ef-410b-b3b7-f10a0c51abe1", "comment": "Malware payload (Loki)", "value": "8d0ff95405ce9a8a7e23a3d1bd7f7cab0bdeb2f13e88d6dd034a59cb7313742e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170525, "uuid": "4247ff92-3f98-40fa-aaf5-5e87c0e0672a", "comment": "Malware payload (Loki)", "value": "be8f4f3a942dfe76f95571c3e7405a98931b9147", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170525, "uuid": "448117e1-2980-470b-8c3a-f22a568d359e", "comment": "Malware payload (Loki)", "value": "e1298c12624ef2b6453d8e545877968da8007b658bf6435b5be35b1e8a749c112166ece9e4ad90a5dcaef98745743e2c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170525, "uuid": "18ec589b-73a1-4804-835a-2cc584415bc5", "value": "T154552345DB68F782D5CD1AF22FA049A06720AF97DF31D4462369338194B363B4DB8E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170525, "uuid": "6e5aed65-ff11-4147-9d10-b75dde421cfc", "value": "24576:VJUkj45d0EKEb0JLEBfNNgWGeky/hLitjnT7xHbl9BFUnwQ1p4f3FuEzM:Vmk0cUb0JL0fNNgWhcT7hfYw4pguR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628170525, "uuid": "7e7832d7-3801-4a2f-a65c-891cf1c8493e", "value": 1404928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628170525, "uuid": "41258c50-d59e-485a-9132-6a38b8fae616", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170525, "uuid": "44de8169-c2e7-4c90-97a7-17898ffb401f", "value": "swift.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf33f5a-f5f8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628173235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173235, "uuid": "fe2009ce-267d-4cfb-a108-2419d68244ad", "comment": "Malware payload (AgentTesla)", "value": "53b546cb0d9e9e8a27a1317e55086eb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173235, "uuid": "1563b463-207a-4eaf-acc0-b0165d7665ee", "comment": "Malware payload (AgentTesla)", "value": "8d71a665c2ff60a659ff0854cf31bf09d955714611c2ee3fe9b884fb7c89b0be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173235, "uuid": "0de02956-a7f9-4080-b71b-74d9e788b297", "comment": "Malware payload (AgentTesla)", "value": "32bc0a70a570158a6c53ea7fbfe94d8d7a3d127c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173235, "uuid": "1d7308a8-5b32-49f0-af4f-1d4e7f6becdb", "comment": "Malware payload (AgentTesla)", "value": "6e1ffb89cf7cc25f20b0c18755a34cc2ea203c07f61b099b8fe5588fb5f3b339e40994fc4c3919c300f499bb94ee97dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173235, "uuid": "56a569bc-d91e-42e0-b3cc-922eda4e4a44", "value": "T133056C2229EF154DF3B39BB50FC4F8BE46AAFA73560AB0F639411B964322940CD51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173235, "uuid": "36a864d0-ba85-497d-aba4-eab255d5b8e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173235, "uuid": "d67b2f57-0cc3-44fc-b75a-9f9e631da2ad", "value": "12288:+wjIYAKZpoR65AXwgFvuSSKIBFcGGpy8mH+YdBXx4ZBgSysoUFJJVbBPfHq+DfQC:noR6qgPcyjDdBXGlxfq+D4NSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628173235, "uuid": "1d04cb12-8d1e-4f58-842c-900d82afba6c", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628173235, "uuid": "ee24b036-e260-40a2-9002-b0531fdc5234", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173235, "uuid": "f10204b1-63fa-4846-ae90-a366dfc44ee0", "value": "53b546cb0d9e9e8a27a1317e55086eb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd15724-f595-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628130661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628130661, "uuid": "2d24cde8-1f31-4bee-a1c3-26b205129bf8", "comment": "Malware payload (RedLineStealer)", "value": "78668bea25a84008732085fc0130f1eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628130661, "uuid": "fe233b00-1328-45c8-b0ae-2cba66121370", "comment": "Malware payload (RedLineStealer)", "value": "8daf492e4acbd40e40c6033c4dd68e70283cceacc489cf0e472917721314389b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628130661, "uuid": "28669f17-9e84-44f9-bf5e-fe7631a61be0", "comment": "Malware payload (RedLineStealer)", "value": "46ee0fce707519fd831c1898ea1bd97433e76e9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628130661, "uuid": "6689ba15-bfaa-447e-89ce-c11e1cf70a4e", "comment": "Malware payload (RedLineStealer)", "value": "6855fadb259423734835ba6ff3aeafd95339ceb0f1eaacdd706430ad1b8fab6542b32df0379fad962c74264aebd3dce0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628130661, "uuid": "02a4a02e-d5a8-4d32-a374-e46c4a51da5a", "value": "T1CDF5338438460371E056ADBC1D2D90D89F23FA7EB67D609E795D3B88C7835C8A6713B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628130661, "uuid": "5040b135-37f4-4067-8e7c-a9e16ef1be59", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628130661, "uuid": "5a057ec1-f34f-44e1-b90f-d134a5225440", "value": "98304:Z7nc5OlkopOHJ9H0Juk+jpUwrnOdTr92hJfp:Jnc5OOWOH08zZrnO552vfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628130661, "uuid": "eb7e4d66-2009-4c01-91f4-9f4ac437fb8b", "value": 3490402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628130661, "uuid": "e3be6e9f-f7eb-4cb0-bf26-66fbf1bde583", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628130661, "uuid": "d254839e-a1e6-4009-b8c2-60face659cb9", "value": "78668BEA25A84008732085FC0130F1EB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f7b544-f600-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628176869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176869, "uuid": "99550c6b-18df-4255-ba95-d2b1dab85764", "comment": "Malware payload (Dridex)", "value": "bc6edb528142538f7a2a4f904ff35bc3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176869, "uuid": "0f8c932c-4928-4a1e-a982-6c32f1440041", "comment": "Malware payload (Dridex)", "value": "8debe4a9dbdd8bc8da54aa1c5b034b75d28129743f5994a902a34e70108bad76", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176869, "uuid": "9efe5015-7f7a-4ef3-9718-d8202ba34c1c", "comment": "Malware payload (Dridex)", "value": "56bcf1091988ef44ec9069b488f82bd4755f7f67", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176869, "uuid": "43c63d4a-750f-4672-bb94-3e0237470781", "comment": "Malware payload (Dridex)", "value": "f4bc0d52ece8b3be2d2511fbb3f7c492acd07d029449209c27ac90607af20388e245438a74876da3835e23816e83c299", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176869, "uuid": "22f0651b-abf5-41b2-9936-26764ca750cf", "value": "T18504D042E2CE23D1DC97B83248FC262924F05444D85ADCFEC995EBACD7E1F574A64A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176869, "uuid": "dd6e5bed-7406-49b3-b4b3-f36665e91eda", "value": "6eb7ecc6c2e948f718b1179f888ea193", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176869, "uuid": "4892bb52-388f-4f6b-95f7-2d978d8ad5af", "value": "3072:ScYhzpn9z75jWpmrL3gA99hXkKsorn+AOr4R3jvaT:ScIntom33RDvn+Rrsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176869, "uuid": "b05081af-b794-4608-96ff-17597988a709", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176869, "uuid": "0accdd63-ab2e-46d8-b91e-01c8e1ddb73f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176869, "uuid": "5ca1b572-65d4-4340-b64d-4c37dcaefc05", "value": "bc6edb528142538f7a2a4f904ff35bc3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c44196-f618-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1628187259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187259, "uuid": "7717b267-7199-49e1-a07e-816be24e3aea", "comment": "Malware payload (njrat)", "value": "2a95b8bcfbd5b21dd97e06494d6adf20", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187259, "uuid": "791e293b-356d-4c68-b4af-c8a3b8901786", "comment": "Malware payload (njrat)", "value": "8e3f04d34dfb35e685f6785c406ab5ffdad15ba376c8ac584bf25c7a7b3b547a", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187259, "uuid": "1d3d9d71-db05-4097-a60f-b5b6e86ddcf1", "comment": "Malware payload (njrat)", "value": "403143d1914e3220c026e4a00feff8fd33060497", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187259, "uuid": "9e0b8f4e-2ece-4333-beec-b9c9c02e3f43", "comment": "Malware payload (njrat)", "value": "d6b60100a1ac9b70f9225d2c35fa27b3ac79f8d0f24b7f5ce523537627037a8aca30a4f5be6de6cd4c5a1e056a16c94f", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187259, "uuid": "6ef9a6fa-50b9-4efe-ba1b-07714a6f8faf", "value": "T111A2188E3BE4C628D3AC1AB68CB3A32093B6D2878551EB4E1DDD509B2F733905544EF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187259, "uuid": "73c08b42-adc6-4919-8b80-958c58f9462d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187259, "uuid": "da228aee-36b0-4a6d-9966-0fdcd28ca2f1", "value": "384:nHVGj4DnU+P24h/WHuvZVoCk+NdcF//34Zo6JSTTc31:niEKuvZfk+wH0px31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187259, "uuid": "253e2cfc-3a82-4eaa-a7bb-8c5d7ad4b933", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187259, "uuid": "bd0a8d0d-fa2a-4427-9037-dddf36f3734f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187259, "uuid": "f230f973-f641-4489-b124-926ddf4e838e", "value": "8e3f04d34dfb35e685f6785c406ab5ffdad15ba376c8ac584bf25c7a7b3b547a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01515021-f5b2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628143044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143044, "uuid": "f684abfc-ef46-4af4-ac2e-d9f17183a61a", "comment": "Malware payload (Formbook)", "value": "4d6fc4ea4d0ac131db5dcffe37c50325", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143044, "uuid": "36f7c9a3-81fe-44b3-a492-db480f968bba", "comment": "Malware payload (Formbook)", "value": "8e80b677786aa5e787861ea705c89942460ea7d0176df7e64644278e32addffb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143044, "uuid": "eac588b5-f7ec-4f3d-914c-ef40b71ae130", "comment": "Malware payload (Formbook)", "value": "e0f0c4a123ed0484fe6b45fbe58affa686b84fa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143044, "uuid": "961d0bf7-348a-48d9-9c63-06c71cec3201", "comment": "Malware payload (Formbook)", "value": "18c242a7fb4a95a35a277e322f8c304ba9ab2bf7db5f4bbea664f75e0722f0c7369521074eda5ec954ba397009066f01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143044, "uuid": "cd5bdb10-c556-4401-9311-a29e083211de", "value": "T1193412027654093BF867027B4BBE292E54BEBBB10B0C8AC7E6F094695F519F57C3211E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143044, "uuid": "61824ccd-62da-4c4f-9c5b-a8582bf964d8", "value": "d8dda11e9d039cb0a1c2e717bdda6d64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143044, "uuid": "7fdaf3e1-ff7d-4226-9fd1-cb524f7e6934", "value": "6144:YnbNhRCGaGQPgbM+W9AcOrSMEASPmz2YyN++MA7u:Yx3aGQ4/1yIti3Nv7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628143044, "uuid": "2bfd0408-3137-4907-acf8-d6b9a6e7f9e9", "value": 246166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628143044, "uuid": "62415ddc-26ab-419c-93d0-33f44e60fc16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143044, "uuid": "edb7a449-758e-4c1d-8e52-402a1763e4f4", "value": "4d6fc4ea4d0ac131db5dcffe37c50325.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9bee063-f628-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628194087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628194087, "uuid": "1d1fdef8-4c09-47c4-9729-eba033f69541", "comment": "Malware payload (Mirai)", "value": "31d3276e3bc51d4dee5905a6d14e9559", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628194087, "uuid": "61edf3a4-6d14-4417-8a61-4711ef272806", "comment": "Malware payload (Mirai)", "value": "8e827a2d47ca7b31569ed8ba20a9debae705a0b749f142b21d0fdbe8badc9312", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628194087, "uuid": "9b735285-a115-4b5f-9094-18179097fc6f", "comment": "Malware payload (Mirai)", "value": "708a381d7d505b9d49af1eb51ca9d94d26b9d1c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628194087, "uuid": "441245c0-e514-477f-90bf-6805f8579aad", "comment": "Malware payload (Mirai)", "value": "7553ea52023a490026bf2f90d815e8b5595b6fefa7bace3c339dbb03650263a5421894526d43d893b4689ebbfda36b78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628194087, "uuid": "fd476234-9bc2-4523-99f6-a37c63ba4fb0", "value": "T11173C85A3E319FFCFBA986354BB38E21974823C626E1D6C5D19CD6021E7034E641FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628194087, "uuid": "c01dc066-f1f1-456d-9159-4e17cfd7e2df", "value": "1536:+/YL3M4WcMRgK5TYTO1SDMx3WseaL8JSnq:AYL3HWzRL0TO1SDe3WC6Snq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628194087, "uuid": "aeba4b19-f097-480d-b070-7e4e61fbd8b1", "value": 77440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628194087, "uuid": "c0108411-fbcd-4316-93fc-46ff0db283a8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628194087, "uuid": "455afd8f-705e-491e-86a5-6aff02f9b3ee", "value": "31d3276e3bc51d4dee5905a6d14e9559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa11dfc9-f5c5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628151621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151621, "uuid": "e067a1c9-7d2c-4195-9387-750ab8def8aa", "comment": "Malware payload (NanoCore)", "value": "679ba017a36c5a048bdcba490f2f1c37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151621, "uuid": "4176b701-916b-4cda-ab77-edb32f76e3a5", "comment": "Malware payload (NanoCore)", "value": "8ec4075cc5bce80c2feadf961db8ccc634518273cf55399bd4669c4bd5c96231", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151621, "uuid": "05d73a2b-2524-4dd4-b190-04e231b8326f", "comment": "Malware payload (NanoCore)", "value": "3d9884a5c663b7113932b354e8db2c02bdf16150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151621, "uuid": "380d54e7-439e-4536-84ab-fad0f2ed1016", "comment": "Malware payload (NanoCore)", "value": "dd302299b5025491bf8fd6856bfa82a247cb2414a2a2c629118ee77552107b47a21ca5c84000f330c05d0b1b01201d87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151621, "uuid": "5cb6185a-4caa-4138-bb10-d200771684f8", "value": "T199158C2229EF154DF3B3ABB60FC4F8BE56EAE5735B1AB0B638910B454322940CD51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151621, "uuid": "e14743f3-4596-43bb-a66f-871a06bd5d2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151621, "uuid": "869e0874-5a15-4688-8193-909177a045f5", "value": "12288:QWoR65AXwgFvuSSisDUR6Wqb86trtqSq8T0zlWq4Sih2JKfAq30yT6gg8/5VLF:roR6qgKiB0xt5o2Af/eggMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628151621, "uuid": "a9a8a920-6deb-417a-8fd9-11126242346b", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628151621, "uuid": "ddb78d22-eaa8-4337-b98a-61a0221595a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151621, "uuid": "5b92a537-fd08-4a14-8a3b-8d8e6d69b187", "value": "#RFQ ORDER48447557584848848.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f402745d-f5b5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628144739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144739, "uuid": "ff1774b8-b2e6-4068-ac2d-dd8cb3307bfd", "comment": "Malware payload (RaccoonStealer)", "value": "3394a97f30fa559db3de5682ac97a118", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144739, "uuid": "39590412-12f5-4db2-90a5-5df4cc10165c", "comment": "Malware payload (RaccoonStealer)", "value": "8ed524c96a9aa1a4ea7928ad1d2335a1022e32b5eac96c3a596315da1224b6d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144739, "uuid": "feadb06a-502b-4a78-9e7f-b49ef807e7e3", "comment": "Malware payload (RaccoonStealer)", "value": "94c877bfbb68bd6b198ad75d03be7cce1ac14149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144739, "uuid": "8da1bf95-9414-4717-a512-aa51f613f99e", "comment": "Malware payload (RaccoonStealer)", "value": "6ea1d0164f28e55c65569913952c0206aea17469c6967c0c15bccb066e02e30489cbe4b5d171bd2ab1344d575a9dff12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144739, "uuid": "49a1530c-f220-440b-b03a-d06b995c6011", "value": "T1E8A401227684C333D0504B744819C3E16B7A78784DB85DBB2B95566C7B623E3DF2A23E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144739, "uuid": "39997aec-0828-4ceb-add4-21b98bd689e9", "value": "2a9c1ca66125aeff7a1c36242be63d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144739, "uuid": "e4f9e959-c7a4-44fc-8f91-8e1fe8e90d10", "value": "12288:1S4s6dRsXW4pJs5AYn3hG+oLvIpwiUlKVDi6C:19WXLQ5T8+YvI6Nmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628144739, "uuid": "2e5b5382-fbbd-4d58-9349-422a4387c177", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628144739, "uuid": "79ebfb17-9cfd-4987-b341-30ef1c0eb70b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144739, "uuid": "f068e62b-aee8-44c7-9da0-cc2e7543b237", "value": "3394a97f30fa559db3de5682ac97a118.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24f9fa3-f5f7-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628173003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173003, "uuid": "e18202c5-440c-40c6-8c55-d4487857fc82", "comment": "Malware payload", "value": "f352ed6665879e3d5fafd648aba57967", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173003, "uuid": "45d091b4-ea03-4b48-82f2-3541884d1c4f", "comment": "Malware payload", "value": "8ee02c69bc46f8ffe136c96aa8a22c05f553b00a7a5c1341f043cf76b9461ce2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173003, "uuid": "95b5eed6-032d-4980-bcca-9ed80aabd0ca", "comment": "Malware payload", "value": "97fb8c9c709b186b9dccb9677441aaa7eae2b41a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173003, "uuid": "1ad94a81-2e14-4922-a356-2d2dc029b9a1", "comment": "Malware payload", "value": "07f52f494a5f6e2f1679d6130adaadf4be5db5474fc14e90cdc212624b794bb9fc8c2065fb04d532dac63a1488f579b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173003, "uuid": "79b7c603-9756-4783-956e-39c3a45e370d", "value": "T18C746C73F6C08537C1632A7C9C5F9BA8AD29BE503D2468462BE81D8C9F397817436397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173003, "uuid": "03539611-1f80-4ead-838f-ac3d7b781153", "value": "e8731cf7b250a548d4ce8e544c35435b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173003, "uuid": "05a367f4-daa3-464e-8127-151e9e7d4856", "value": "6144:n1/iXvse4QOwJFLJWk1VlxOkKISMg8hLmbmX6Kt7IZl:1qXvsPEVjOP8hSbtKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628173003, "uuid": "89c2c370-dae5-4798-b76a-7a8664beeb8b", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628173003, "uuid": "20c44082-5fbc-4525-92a5-97e3fe9da47b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173003, "uuid": "bb5477de-081f-4441-aa5b-8aa34fa7d1ac", "value": "f352ed6665879e3d5fafd648aba57967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3c876e-f5f9-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628173773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173773, "uuid": "b094fef9-be5d-41d9-a271-ec0883dec031", "comment": "Malware payload", "value": "3ea53610a5bd86400ebdc5faeb470a7d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173773, "uuid": "6c0ab067-d00c-4f6a-92e2-c3114e591508", "comment": "Malware payload", "value": "8f8a7b318f077598e9a1727e4135c001a98f4605f5d464eeeff480873e9194b7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173773, "uuid": "0f1ef7c8-5cca-4d52-9d6b-615d1d5ca1bb", "comment": "Malware payload", "value": "1f598617c794d3738d77a04b44e772c51476363e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628173773, "uuid": "7a321afb-7918-4483-a390-569b8e7c06a8", "comment": "Malware payload", "value": "a077ff3fef7bcfdf0d6867d378bc9a4c0ea6cb61747f70aab440dcaea9ff0b6423ee139dc58f2e4059d51b3b0b22af37", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173773, "uuid": "43fc6715-a05f-4bf6-b62a-16a1007f9e7d", "value": "T11D732AB6F8431CD991D26951EF6C89145FB3330756D2923EA4F1B39C21B3262AA47C1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173773, "uuid": "a94a7af5-581a-4afd-9ab2-1248760c7ec5", "value": "1536:EYRvKPM8GhHr11AQYyqGJHQYCDEtU6dLTR97w:1vYM8G/xQYNtU6Zvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628173773, "uuid": "a64697cb-9aa6-4b1d-b718-b45365979756", "value": 73473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628173773, "uuid": "fa94b8a6-7ee0-4d1f-91b6-633da0d85d25", "value": "text/xml", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628173773, "uuid": "e5593c84-6c8e-440f-9871-83d24291ffa0", "value": "docs-08.05.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9598bf3-f60a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628181148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181148, "uuid": "84cc7d26-a428-46eb-8b4a-75b5bb24edaf", "comment": "Malware payload (Dridex)", "value": "3ccf6fb53a696e653ba23c254411c081", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181148, "uuid": "ff09ae3d-58fa-4a7b-b20f-cf3037a0904e", "comment": "Malware payload (Dridex)", "value": "900d3f9c8c323bed1ab28c531754a8457e80d17183abdb6d4b121174bc67221b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181148, "uuid": "48ead703-7309-4113-a2e2-1fcd08a39829", "comment": "Malware payload (Dridex)", "value": "92ddd94801e09973b2d828e39e3c74914da1a1b6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181148, "uuid": "3812be5e-86b7-450c-8188-fff791b1091c", "comment": "Malware payload (Dridex)", "value": "4e269470f08095c186ec511156cf1b721af4d7c53f04b6bbf2bd01ccfadad8305412fa5da676f95a015596fe33d203d4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181148, "uuid": "7f7da6cd-7865-4678-b600-981a9b84292e", "value": "T1F004E0C042F7D2A5C3679B7C00B671BFF16929012B76D9588D85CD2CEAAFB91D360272", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181148, "uuid": "0f0b3b38-bd64-4f22-bfba-6aaccda816d4", "value": "39ea6703ace4f75b2e32f9bfc2ceb0a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181148, "uuid": "3d74c241-7410-4468-bea4-2835fdb47f4e", "value": "3072:yDZDVVA+DQ5JTOfEb18qFafjqvTwQJeWLq9NxbKejEGEjh:yzVAfqfER8qFOqv8eeWLqRb3vE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628181148, "uuid": "56b5cf62-d0c7-45c2-8ce0-56dd8829bc2b", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628181148, "uuid": "905edf43-9855-4c22-8d2b-6382c4a1e77e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181148, "uuid": "c5f814aa-1697-48bd-b5de-9a184ebc761f", "value": "YvfI6xYO.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffce7188-f615-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1628185991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185991, "uuid": "cff3301a-e5c3-4ab0-a800-7c2219f8b50a", "comment": "Malware payload (TrickBot)", "value": "d27ac168b5642518471c6e94c894d9c1", "object_relation": "md5", "Tag": [ { "name": "sat3", "colour": "#556EAB", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185991, "uuid": "42c95850-1854-45c1-9cfb-d7a236c20152", "comment": "Malware payload (TrickBot)", "value": "90f48be7100a93a5e5b241ccf8bd5de70fbb3566558926310219256f1013603e", "object_relation": "sha256", "Tag": [ { "name": "sat3", "colour": "#556EAB", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185991, "uuid": "4d0c7f84-cfbc-42dc-bfa1-dc0bf3f2c6dc", "comment": "Malware payload (TrickBot)", "value": "4a082ed1c969028aeafae7773ef86d35e680e4e0", "object_relation": "sha1", "Tag": [ { "name": "sat3", "colour": "#556EAB", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185991, "uuid": "b2d1e980-e584-4395-a319-3496a6b45241", "comment": "Malware payload (TrickBot)", "value": "100bf187b6ccc1561c7d903e5136415957029803a76f91f037c28452d80b09b6ef704ae673ae5beb31b4ae18813f4d1a", "object_relation": "sha3-384", "Tag": [ { "name": "sat3", "colour": "#556EAB", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185991, "uuid": "23685eab-ac40-4847-97a8-a1f24b5ef15f", "value": "T1B07423139F6024AFEECD067ED00417D4672E6724A102D1092794F609AF5BAE7F3CB96E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185991, "uuid": "a0ff8ae4-ed51-4592-a0ca-5e3100bed60d", "value": "6144:OA7d3sarp3rJrrOhGJVbZVAhFDgMID1uY38o4KvhWZNHM6Qu2IAuFG4:J7pXrp3x5JVE6xDcY38o4hnsnIAuFG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628185991, "uuid": "c02d9122-38ef-46a6-a5f3-2c48b2ec17da", "value": 342278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628185991, "uuid": "65aa06bc-4d52-4bdc-93cf-3f4d04fe6e79", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185991, "uuid": "6ef8eb14-1534-43df-959f-92b53716fe99", "value": "Customer_Payment-32_41295101.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2d39e8-f5f4-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628171541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171541, "uuid": "e5d9f62a-9904-44cb-af3d-b5ac66fed3ac", "comment": "Malware payload", "value": "5f9b0665e1c817f2e9449665c91fc892", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171541, "uuid": "0a785010-2ec0-4e94-a49a-c7efc9a3e75c", "comment": "Malware payload", "value": "916b87ea0eb7c46bb7c0cf9f439cade7c32ea0dc4e70cc425d69f31ae9f9ff60", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171541, "uuid": "0b92f5b1-4b7e-4301-a36a-ca40ede0bcf8", "comment": "Malware payload", "value": "81ded9761a6449d22341f295e46a4a532e223963", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171541, "uuid": "9e7a1ed6-2a8e-4a7b-a699-137a31f7a0a8", "comment": "Malware payload", "value": "9f0344c144684048b4e0abb006229965b386ba9c6138b116b772a28f370237b6052c4e01e42071352104aa5e08c310a4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171541, "uuid": "fe82eb47-85bb-4643-b36c-a52731c33c70", "value": "T153D02BF32C0DD1B0622AABC52BE1500D4946C5BC3F62F9745508C5DF312BF15B6D882B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171541, "uuid": "665d2db1-5471-401e-bcc5-1ac14d4feb65", "value": "6:uThiUyYrUsIMCIpeEry6X1hrOB4QrFO6/SUr664N3Nv:uTApYrUiCIpeEnrdQoCr54N3Nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628171541, "uuid": "2e12afac-9baf-4b17-be08-18da2892b0f6", "value": 289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628171541, "uuid": "68cbeeff-b51a-4a80-9112-b259f31f76bc", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171541, "uuid": "c637640a-412c-472d-a954-e05c1a2c225d", "value": "Incoming_swift_slip_TT_dtd_000_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540427e1-f632-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628198158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628198158, "uuid": "98b4d3c4-43be-4e69-96a8-7d67ad067e74", "comment": "Malware payload (RaccoonStealer)", "value": "d6b2e107ac7ba9cb55fceb901651519b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628198158, "uuid": "c06d45f7-ac3f-4ddb-8029-b4910103a8b9", "comment": "Malware payload (RaccoonStealer)", "value": "91eb4aa588c6607ad27fb9b43d61166230a225d8a4aa517d685af28ab4382a26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628198158, "uuid": "9025d29c-e13b-4d96-bd85-a35f15581c2d", "comment": "Malware payload (RaccoonStealer)", "value": "a225e6ebcdc0a7b69e9fb588d1e88b3d576d8392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628198158, "uuid": "82944341-600d-4b25-a084-d3e8726b4f50", "comment": "Malware payload (RaccoonStealer)", "value": "0856c67f2a2c99adc1d1f944bba341ae29c6f6a5e031f5c045cfc627f7f3b8e5c4da607cf4d60770b4c08f651029fb35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628198158, "uuid": "8e551997-a0c3-452a-b527-b28e19d5d714", "value": "T153B4F1DB7E48695ECD99427048D302B12B312C37BC02DA51ADAE311D0DBF7D5AE8F1A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628198158, "uuid": "b6cef857-056a-49b5-8e7b-3c7b1b8f8971", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628198158, "uuid": "bd25394d-02d7-4eaf-9999-c0d440436303", "value": "12288:+xNExf+83gnVZd3OOm9Fd/rL2qsdGG58D:ce28QnVZNOT9F5mGG58D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628198158, "uuid": "eacea697-d5ce-45d2-8c70-9fe3470e780e", "value": 531168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628198158, "uuid": "ba4e6935-680c-4171-8ae7-acd99b3a6b1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628198158, "uuid": "d85845ec-7c08-4043-bc4c-aaacc63b3c1d", "value": "D6B2E107AC7BA9CB55FCEB901651519B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c90196d-f5ff-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628176268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176268, "uuid": "9c98405e-d1d4-4f84-a862-fd25ef94b96a", "comment": "Malware payload (AgentTesla)", "value": "988106a5c68a559242cedf39b379661b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176268, "uuid": "8490c775-f81a-4ecc-8f24-b2c11db3576a", "comment": "Malware payload (AgentTesla)", "value": "9228b7e3b6bebf36bd59a1d3245eb162316e12220422e721931f70e77cd687b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176268, "uuid": "0e3786dc-7662-4f0d-8b6f-f1794766ecca", "comment": "Malware payload (AgentTesla)", "value": "4c724f8df837ee89cfacce1dbce6ee9589cf5b20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176268, "uuid": "47b89963-50c4-4248-8e23-930f7934a6a8", "comment": "Malware payload (AgentTesla)", "value": "34119ffab76d7188487a665f35df5a4cfdff825495287c7af812d37598cba732cdb9fb81e9d9fdd61bd43f07a7fb4b2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176268, "uuid": "392487c0-b936-4e06-b9f0-486dd1e6a831", "value": "T110057C2229EF158DF3B29BB64FC4F8BE56EEE573570AB0B638910B464322940CD51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176268, "uuid": "bdc83e57-89c8-49b7-8f2b-416dffe793e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176268, "uuid": "7a7b974d-2ff1-481c-9db2-466f036b7e3c", "value": "12288:Xp/oR65AXwgFvuSSbsY/kBV0J03w7gTFhMi35KlQVFzQ5gAbLGFXdSuksfsZ+yn5:5/oR6qgisJGlRJGuogAbLGFoTsEnn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176268, "uuid": "84ad8ba1-367a-4819-b25c-2282e0ad92ab", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176268, "uuid": "6a129bc0-8d9c-431d-9d68-f7dbcc5cabdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176268, "uuid": "b4ab5f34-a579-417e-8fac-2e040919f719", "value": "988106a5c68a559242cedf39b379661b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7d9dc2-f5d1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Heodo)", "timestamp": 1628156455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156455, "uuid": "f8341732-d751-4022-af2e-9991b54ade35", "comment": "Malware payload (Heodo)", "value": "712093bfcda6085035a68bb8e2746235", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156455, "uuid": "3cb6ce37-d204-447b-9a0d-d8f1cf96e2c5", "comment": "Malware payload (Heodo)", "value": "932a19d3d1eb0ce0c74a9273de563d47e0f6e941146d31762616a5a1dad416e1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156455, "uuid": "33395a95-a67a-4278-a82a-8774c9c8369b", "comment": "Malware payload (Heodo)", "value": "d2f1621ac625fcf5307b435cbc81b48c5a841a56", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156455, "uuid": "c9bedc17-d29b-4846-b94a-25a455b49811", "comment": "Malware payload (Heodo)", "value": "313fec71accceee387eff25a4bdb6731e69fd09cca6c6c6ad81d2b8561ca9ed03e2b7e8b1e96d9ccab1dc5bd6f50a467", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156455, "uuid": "2aa2981a-d40c-45e5-bb8c-ad398d8d8433", "value": "T1B6B402123599C672E5610178C471CAB5AB2E7CF05C354B8B3FB1769E3EE1292DE2B341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156455, "uuid": "f2dfbf1a-bbc7-4a92-9a3f-856691764a83", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156455, "uuid": "4d8aaa12-baae-40d5-99dc-c0efcffb25b0", "value": "6144:GSCgIrfMI621WQFBmM2aea84wJyeWEcpazig06RKCZxQ2GOn9mJ7A37:RM7X7WSBmLm7x0BRp4OncNA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628156455, "uuid": "ac182a1a-6136-4e3f-83bb-0fac5d50d925", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628156455, "uuid": "b6189650-b864-49a1-8bc7-8fe987093788", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156455, "uuid": "2233bde5-0c67-4c11-a22c-dd8ae4974664", "value": "712093bfcda6085035a68bb8e2746235.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ab95fc-f5f4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628171555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171555, "uuid": "698197a9-5f68-41f1-b803-f720e69d2565", "comment": "Malware payload (Formbook)", "value": "09d10f892565f3715e2819b30b478d9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171555, "uuid": "65719e9c-cd6a-46a2-a2e1-43875e09d9a0", "comment": "Malware payload (Formbook)", "value": "936b53b469b70aa0ed5749f7dfa9c279691c041634fa10ceb442b25512cba4b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171555, "uuid": "05bf3862-ee63-442d-add9-616d942c4fcf", "comment": "Malware payload (Formbook)", "value": "fc8b17c35577a303bd328c63d1927c7ac82ce735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171555, "uuid": "de411545-9b3f-4302-ae76-68ccab96f97a", "comment": "Malware payload (Formbook)", "value": "5de5559b30e6551edd48f62693b9dc00ad8dfb52eaa32df7cad4d536ec1bd5a4d6913614913091d7f3387ef9c42e5de2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171555, "uuid": "edd8afe0-f612-407b-8c33-704c9bbdc71d", "value": "T10FF40129B69807A4E47D5BB41875008027F4F2299727EB4FBFD464EE4EA3B1A43C6707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171555, "uuid": "73f336ad-0c37-4d42-952b-58c0ac1eac37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171555, "uuid": "3b1f69ba-7254-4261-afb0-1155e81d9417", "value": "12288:6djQ7x7agzy/hK9Qu1jR1CTDhFtWl62vI0FIiZih62Uf/EmQwPjeHFt2NjFu:l17L+k9l2DVWlBg2IGm6xvrrKFMNjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628171555, "uuid": "236ec33d-813a-4f77-b9df-5ff15f68d365", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628171555, "uuid": "5f7410d1-858a-4e4b-afb2-f1624ab411d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171555, "uuid": "736d4993-8c6d-48de-9c55-ce9685a2d992", "value": "Nueva orden de compra_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37086cf-f5f1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628170374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170374, "uuid": "fc0b63c2-00a7-45bf-b514-7ec7b6ccada2", "comment": "Malware payload (Formbook)", "value": "e78279b80fb0ec0e2e850fe50eb21040", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170374, "uuid": "47520fbe-c869-4fdd-8cfb-4efcb25fe3eb", "comment": "Malware payload (Formbook)", "value": "93dd2ae7f3871e5624029d321e8ed0de2ff2b98ae5079a73e5bee3d647320232", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170374, "uuid": "a4cebca0-7826-4e2a-85c5-94af1749a52b", "comment": "Malware payload (Formbook)", "value": "088313b1cddf3db251be5fd0de7d516da0a83630", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170374, "uuid": "720a5b26-f4f9-4a42-80ee-f51f8a951701", "comment": "Malware payload (Formbook)", "value": "c236a35942f718dbbc7f4c49c22a5bdefd3752a9615ef7cd19589aeec1f56fa226a03114b7d08db197579f4dc5fb6639", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170374, "uuid": "0aec6ab6-ce88-45c0-a25d-fbfaee04f1a2", "value": "T18A55232979ADAD98E0C300B624EFC451287BDF2517E6CD38F90D754DE2F6860C78BA19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170374, "uuid": "fb9b5567-ab24-4741-90e2-c1370a29ae15", "value": "24576:kmfG0uzsGUoMzQ9+6V8lGBPamYIRAj/sWWQPNOaE708qwfOeNvNWkDvfukVW:tuzsGUvzqL9BPj580mPNOmwfVnWk7f10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628170374, "uuid": "7a2111f6-d326-4e54-b96f-f4df65436bad", "value": 1346520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628170374, "uuid": "b459f1d8-34bf-466d-9710-e6ccba333ce5", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170374, "uuid": "d1737c72-e1bc-403b-a95c-c562bf024d83", "value": "REQUEST FOR QUOTATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347e3418-f612-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628184361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628184361, "uuid": "91dd3e72-ca45-4f9e-a852-3b51f137cb7c", "comment": "Malware payload (RaccoonStealer)", "value": "4aaaaf39f81c205da7538f3453472077", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628184361, "uuid": "1c58407f-8b59-4deb-90ab-1c73c6349196", "comment": "Malware payload (RaccoonStealer)", "value": "94621af999ba04a09e151015858e75ba511836ea3c040d3e94b08574bc4b5421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628184361, "uuid": "9477d45e-8a4c-484b-bd50-0df08746b077", "comment": "Malware payload (RaccoonStealer)", "value": "ed3024e038ce3264dc9ca33e01d53680e80a9549", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628184361, "uuid": "0b3d18c4-6187-4f7b-91da-3decff7d142d", "comment": "Malware payload (RaccoonStealer)", "value": "1181f5c229db0435867604d1173db0d073eb026477e3a573b4b2c5a43b933628201baa2717f3a429dbfea82e53cb32d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628184361, "uuid": "28e09258-5a22-4fbd-8d4c-44786b71f2b1", "value": "T174B402553280CC73F1703AB14826C6765AABFD76C92487877B95A36E3B312C26F32356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628184361, "uuid": "fa4f6056-9c77-4cc2-8b1a-938bfc8e13aa", "value": "7d2c4701a9e00af48c63738cadcb0b55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628184361, "uuid": "45f14265-8a40-47f6-8fd8-02455a9789d3", "value": "12288:ZdsuXMft/sJdK9kub/cW8FH++bIgqVgNhJyvIJPLYL:Zwft/sJmH0W8hk5e8vIdLYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628184361, "uuid": "7ec3fa30-03a2-4021-8a34-4aa6542f798c", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628184361, "uuid": "75e59672-629b-45f1-9d50-d5c53efaec13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628184361, "uuid": "13ec7c61-53aa-4722-ab35-ea625e8293c4", "value": "4aaaaf39f81c205da7538f3453472077.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d45bf8-f5a5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628137597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628137597, "uuid": "05376ea9-e689-4570-a652-bed99222d630", "comment": "Malware payload (Formbook)", "value": "60c872476ad716de77afaa9257857894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628137597, "uuid": "68331c8f-4926-464d-aa6b-e887ffa451b0", "comment": "Malware payload (Formbook)", "value": "9663361e2770f5ec9528e179cefc03240891ea2eae54f1d55b75765b1d8aa4ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628137597, "uuid": "32f21d5a-0fbb-4b33-bf2f-f9f85a23d26a", "comment": "Malware payload (Formbook)", "value": "278079afff294f49cb688e6a96b2b1b95a456559", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628137597, "uuid": "f2f7b03f-3323-4608-91f6-df92209a8c41", "comment": "Malware payload (Formbook)", "value": "7d9f1a3cb59d05812c1ac9a2daaa9795f9a654c5af90e3b115d7059bd46dd850a99335b6da88a64e060041c3988bb6a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628137597, "uuid": "9091961e-83c1-4488-b265-1fa6d46bf0a1", "value": "T140056B2229EB214DF3B79B760FD4F4BE56AEE933161AF0FA34911B958322940CD41736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628137597, "uuid": "352985aa-c443-47a1-8dd4-df9aff44aa12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628137597, "uuid": "a344280c-39d9-4d0c-b5d4-616a64265c53", "value": "12288:ux0GCqMAyhA638+Ok/oUa00V4XWd+VjCwNo/prEBAKZMWoR6Bn5bXwg4uYyI:psWhA63vr/J0V8Wd+0w4JWoR6fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628137597, "uuid": "5b195edc-89a7-4c03-879e-6f7a9b1d0013", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628137597, "uuid": "c228447c-e030-4b31-bd96-c3d0f564c9f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628137597, "uuid": "0810bbac-ee06-4710-92df-869af757544d", "value": "Swift_Soa000095765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31baafb-f5ff-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628176413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176413, "uuid": "cc0ef807-c4ae-4a9a-9695-d0d5150c33ea", "comment": "Malware payload (Dridex)", "value": "1648b8fa77f336b278d4f38202339699", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176413, "uuid": "4d15b570-8b51-44d3-963e-6adf3d5d467b", "comment": "Malware payload (Dridex)", "value": "966795489278e05ad878d4d25381cdb32131987766700eb7c0cb65731838019d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176413, "uuid": "ea715dd2-0610-421c-8659-57c1953dbdd6", "comment": "Malware payload (Dridex)", "value": "1cd9c0633ee8f2d5194a4c7e423ce58ffb011b46", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176413, "uuid": "3ff38f52-f8b7-454f-a99d-64eca552e076", "comment": "Malware payload (Dridex)", "value": "3ab06933aade48fda007353f3ec248953f7db75833d108c941b0cd64b8c311d9e6cf242ba24c6825a31ca4698c6915e0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176413, "uuid": "ce6c3b2c-8e3a-4537-b3d1-7b8fb3da5ce5", "value": "T10F04D042E3CE23D1DC97B43248FC262924F05444D85ADCFEC995EBACD7E1F574A64A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176413, "uuid": "45b08b7c-acc0-4533-b520-19f5cd00e094", "value": "6eb7ecc6c2e948f718b1179f888ea193", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176413, "uuid": "d72ffc4c-80e2-49a3-8209-0ba408b065c1", "value": "3072:ScYhzpn9z75jWpmrL3gA99hXkKsorn+AOr4R0jvaT:ScIntom33RDvn+RrDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176413, "uuid": "196a7e83-89f6-4ad6-adbf-e2c58490a0bf", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176413, "uuid": "dcec9b67-f993-45f2-9631-3120b5b4a0fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176413, "uuid": "01622abf-f9a0-4982-9824-be88eda8170a", "value": "R9TBKBSQzb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48b2504-f5a1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628136150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628136150, "uuid": "56e6cfe3-dba9-4e50-b8fc-7abfc23a4a22", "comment": "Malware payload (AgentTesla)", "value": "958b6cc501ab54e819f4bf2280102e79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628136150, "uuid": "3c527cad-8b06-4e3e-a437-abe59e36650f", "comment": "Malware payload (AgentTesla)", "value": "96992e2515749cd691e4dc12ddd0ac852987f18a79aa679814bc625cab501316", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628136150, "uuid": "b7fece4d-07b4-49e2-a4c6-595d43c87f43", "comment": "Malware payload (AgentTesla)", "value": "e4f049fbbbc891e0abfa569fd79be0cebe2d0653", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628136150, "uuid": "e7cfcdad-7492-4cdf-9c35-17468a5a40cd", "comment": "Malware payload (AgentTesla)", "value": "fad5c64a2583484eb299e038cb3feec3d130a3b90a04752285c14e95f5f7b9c1f84a3f20244b2c5ee9b53531126f2047", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628136150, "uuid": "8ca70a5c-b46b-4ef0-bde9-d306d2ef434e", "value": "T11D057C2229EB114DF3B39BB50FC4F8BF46AAE633561EB0F639411B964722940CE51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628136150, "uuid": "8e5ab4af-508d-4221-868f-a962286b3343", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628136150, "uuid": "c85380e8-2361-4556-a0b8-482641954ba8", "value": "12288:PWjRYwAqZIoR65AXwgFvuSSBIH9uZ4lqD7Q3Ogc64JAnySwB74lPHnY8RqB/HJcq:xzoR6qgc9mc++s1BgPHY8RI/HOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628136150, "uuid": "4457eea8-40e7-4917-9fb1-931b09ac6377", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628136150, "uuid": "8816d273-e01e-49d1-8520-de9657ef16dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628136150, "uuid": "99eb9dae-22ba-4e71-9e4e-d074f52699db", "value": "SecuriteInfo.com.Backdoor.Fynloski.A3.28342.2829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3becab3-f5ec-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628168307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168307, "uuid": "8740afb5-4ce0-4849-872e-b93bf326dabf", "comment": "Malware payload (SnakeKeylogger)", "value": "cb64dddceb29c15b7c0b1c346b0c81ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168307, "uuid": "0a2db09a-4f2f-4fee-a330-c77a2a8f13ee", "comment": "Malware payload (SnakeKeylogger)", "value": "9a3cccbf3ec54e526e6979adac8e32294a092ad0374ed8254bebbe525c63551a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168307, "uuid": "6e4f4f05-4da2-48e2-97cd-4c3cd48ff5e8", "comment": "Malware payload (SnakeKeylogger)", "value": "9778d888d49c13dd3ce071ed60dbd20d5859eb51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168307, "uuid": "7b581231-6145-4d22-813f-95e7b8542632", "comment": "Malware payload (SnakeKeylogger)", "value": "f9217bc01e92351c13325839caf70d914a57a79d67402fd081386be768d2bfb1f5677636fd5dd3c800c61322ad6c7a41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168307, "uuid": "567cef02-e0bc-4b8f-9093-ea1a7c0dc761", "value": "T1C6056B2129EB250DF0B79BB90FD4F4B246BEED6546CEF1BA38810B474739A90C951B31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168307, "uuid": "e3292c24-7d96-413c-8488-f985e377a67a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168307, "uuid": "c647fa70-9794-4fb8-af6d-8a866f32e5a5", "value": "12288:6stYdODLqJmNuoLUzJtd6f7G+ubJT7rarB/oGrr6zJelbefCIx:6stY4PTUWfXuN/yxmzAbefCIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628168307, "uuid": "bd173da9-8353-4618-9034-bafe10760fea", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628168307, "uuid": "9fe15e93-d181-4474-97cd-e77cc473b65c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168307, "uuid": "1d0405b7-da5d-41bb-abdb-429c3cd04c48", "value": "PO27544.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2603ff-f5b3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1628143575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143575, "uuid": "1356aea9-b59d-479e-af28-b65fc77ee6b4", "comment": "Malware payload (AveMariaRAT)", "value": "248b174e3bfac56e353ab21e699a29a4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143575, "uuid": "bb94885f-e864-4c79-9e4c-e0e244a209ad", "comment": "Malware payload (AveMariaRAT)", "value": "9a61ab19c84c784c829fff25f193bbb84f058db455acaf8f98dbc34430d8da78", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143575, "uuid": "5fadca7d-f603-4748-8eca-c5ae965ab704", "comment": "Malware payload (AveMariaRAT)", "value": "ea2c7f65f4e639694d2087e790a465e8cc7f015f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143575, "uuid": "0906b970-cb5a-40e8-9415-00c856c69cec", "comment": "Malware payload (AveMariaRAT)", "value": "562acd47e80b8fc40991d9bcb6e141db967b5ff0bd22aa59a0417e22d03fe9e46e066f597914d2d0d6abd3cdd98b7cb4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143575, "uuid": "01f492f7-f808-4c88-b169-9f3f91a2e52f", "value": "T183C49C6F3650715FE87EC43D6E981D16F524EEE3B6CEC582E4832048C93D9979A801BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143575, "uuid": "4fa6abdb-fd53-4729-abd0-58494e8cc3ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143575, "uuid": "a8295b06-5157-460f-8ceb-0c6902a868c9", "value": "12288:2vuX2TjqRRJM/DSaIgszpXQcij7jRVOMnL4uInK6K9Kjr1oYR:suX27/DSa2zpXQTjh4uInfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628143575, "uuid": "ef7dc050-fce5-47c2-932f-fef1c4acc7f3", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628143575, "uuid": "7f7b811e-c319-4fc3-8a5d-f48d165ecb0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143575, "uuid": "c41ab020-cf75-4ea9-a919-40c40cecb23c", "value": "e9e90714d9ff72d7dd375fddf9610e73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d486ff4d-f62c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628195796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195796, "uuid": "d0195172-ea18-4a94-8143-e3ce682c5e14", "comment": "Malware payload (Mirai)", "value": "69c33da054d0ab6c331a5647f715ef7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195796, "uuid": "082f95c8-a061-4f74-a007-e1dacee917a2", "comment": "Malware payload (Mirai)", "value": "9a80bc2f491c9088ce04fdc8f90f8cf36635923d5a4504c05f3267ccd2a054f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195796, "uuid": "ce1eb107-33b0-482c-adb5-69f39f34525a", "comment": "Malware payload (Mirai)", "value": "05fd0dffb34ca78d9b7597635a6d9ecba1d3b15a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195796, "uuid": "76cd98d8-1726-41a6-9929-e29dae4faf35", "comment": "Malware payload (Mirai)", "value": "201c72c1dd0f996c284545b5cfedfa5cf42f31ae7974d06504f02a7dd8fd4667d520f3e6920b34686954cfb02cabf94c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628195796, "uuid": "15d5e704-66ab-44dc-b38e-09d009e8eb07", "value": "T14E633A95BC819A17CAC51277FA2E418E372617A8D2EF32138C256F2077CB95F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628195796, "uuid": "67747679-0bf1-4e3e-b3bf-b713bd43f36c", "value": "1536:qkWZFfQsRzY+luAN2dovD7VwwqwXKnEhGWDPq/pvr:qkW3fQavlFx7VBH6nuGCkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628195796, "uuid": "d7641f2e-966d-4494-b4fb-dd0a694d79aa", "value": 67640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628195796, "uuid": "330f7ef4-3d23-450d-9204-807b720374f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628195796, "uuid": "fcd12626-572c-4739-8332-15fe1dcc8e6c", "value": "69c33da054d0ab6c331a5647f715ef7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67eb58b1-f5a4-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628137203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628137203, "uuid": "1bf635da-4a2d-4256-9b55-d792b380c933", "comment": "Malware payload", "value": "9423a8abfbc17567619d2ea214bcf1e9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628137203, "uuid": "51e238b7-20a2-4246-b848-9f6e9e1b51a6", "comment": "Malware payload", "value": "9aaa7ad658d085c79bbca64f44df44955cec85261d8e287815ea6cdc85a8e619", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628137203, "uuid": "dd964df0-f427-4ff0-83ef-6121b7c017ba", "comment": "Malware payload", "value": "0d70ec77fbda7c52d59748e45cc9ac4633e9920f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628137203, "uuid": "ecc09ae6-2a66-4115-9a0c-f137c0788328", "comment": "Malware payload", "value": "7e796f62040f736919c46fdfe302b9d50e5e8b6a1bf30b0e37febbf83f2f12df0c1577917f1600f719b28d615485befd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628137203, "uuid": "54388c2d-2367-4bd3-839f-a487dcde38d3", "value": "T1E07318BAE0056CD9C6F15AA39E7C98770FFF37178895346DA0A2F21020C63E69557C2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628137203, "uuid": "39baf751-e2d2-44f7-8db3-fb77c44939ba", "value": "1536:EYeeLfo/0MVHlS5Hr11AQYyqGJHQYCDEtU6dLTR97tr:xLzMVEXxQYNtU6Zvtr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628137203, "uuid": "5afae0a5-655d-4f10-b951-1d0fdb56dbca", "value": 76816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628137203, "uuid": "32d4b638-c4ce-4e6e-9c63-6f72075ae42a", "value": "text/xml", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628137203, "uuid": "b3e1bc22-7520-48a5-9117-898fd4a3d414", "value": "dictate-08.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af0d512-f5c1-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628149717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149717, "uuid": "a989e37f-b431-41b6-ad25-0607a9d6228b", "comment": "Malware payload", "value": "9de2ac65d5693a96649f458d47aff56e", "object_relation": "md5", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149717, "uuid": "b6546349-bf4e-4b2f-a069-c2c07e7869cf", "comment": "Malware payload", "value": "9bb6f6446c4460f5cfc15f2c70bb6202caaf437553ce97b0c3ef196a582fca32", "object_relation": "sha256", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149717, "uuid": "a91a6681-33e6-4efc-a648-4085fae44cf6", "comment": "Malware payload", "value": "dab137a4c3a06ecd87a9b349b340c99d68f55696", "object_relation": "sha1", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149717, "uuid": "dfacd650-eff0-410e-82db-c3916c475efb", "comment": "Malware payload", "value": "63bc9f02846f04417256951de978e94ace7c8e2b0dccd504d6ccc06d55ecae77453c6e429be3ab9beb8f4f54e79fd02c", "object_relation": "sha3-384", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149717, "uuid": "aeb2b61e-a916-4c42-b56e-ba686d15f0b0", "value": "T13DF5013FB268A53ED5AA0B3246B39360987BBB61781A8C1F07F0090DCF665711E3F655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149717, "uuid": "222f0a04-56fd-413c-9dde-79170b796257", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149717, "uuid": "9b8d8990-ce51-4fc6-95f0-cf369b742f55", "value": "98304:cSibX3GsZwRJcbwt2t9P+DidXvh6d204OOR5qJK:ILaRJWwAggJ6M8YY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628149717, "uuid": "8ab13575-21cd-4e54-bb58-59e9a2a89c2c", "value": 3629400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628149717, "uuid": "9ab050a7-3bc7-4c1b-92ab-b72e4d85c307", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149717, "uuid": "a3ef4624-53bc-47d8-9afa-966b7e9334a7", "value": "9bb6f6446c4460f5cfc15f2c70bb6202caaf437553ce97b0c3ef196a582fca32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbfdd94-f61b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628188380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188380, "uuid": "37530ea2-ba38-436a-aefc-b0a55a7a900a", "comment": "Malware payload (DanaBot)", "value": "667855dd1aed39886e5fd8109f2fd9e5", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188380, "uuid": "18809946-691a-411c-9de5-968b8d5c36e5", "comment": "Malware payload (DanaBot)", "value": "9c5648d95372a7b7fd70bab86725db07dab9e0e66826f9a06a7deb7b134902ef", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188380, "uuid": "0fb7a7d6-6be1-412a-b0c6-a263a285d6df", "comment": "Malware payload (DanaBot)", "value": "2a563d2f412bfe6678031817f3cd6e37f59f935a", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188380, "uuid": "606fa614-0b4d-4648-b980-2f4e2f7ae941", "comment": "Malware payload (DanaBot)", "value": "55fae49d4fe595be6e19a38bfd8c3677cefccb45f6413d9a6169e068db8bc5ea664536a4b85fee59869c8a8f4b5a7bfd", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188380, "uuid": "f6051fa7-6b1d-47b0-9a38-1db12cc3da81", "value": "T1EC3522153181CC72F6643F79946AC7B16623FCA8C964D793BA819B5D2B322C1AFF1306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188380, "uuid": "407744f2-3dcf-4315-abbc-dbdd772e05bc", "value": "7d2c4701a9e00af48c63738cadcb0b55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188380, "uuid": "456245fb-19e9-4aab-be29-f36fab6af0fa", "value": "24576:7pIsdzARA+zy7Bw73WARIaTWTSFjdLYmhyNiN/Dq4ZAOchk7ATYL:nd03zy03PBTWOFjdLBWOkhAATYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188380, "uuid": "1b768159-d3f3-4743-9c7d-992bacdf15d1", "value": 1137152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188380, "uuid": "00300000-3c86-4675-aed8-1e1cfc545f4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188380, "uuid": "07ca437e-775f-40b9-9be8-26d031946b2a", "value": "667855dd1aed39886e5fd8109f2fd9e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7caacb-f5ff-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1628176273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176273, "uuid": "849efec0-4d41-4de6-a268-5a4e0db7c8c4", "comment": "Malware payload (Smoke Loader)", "value": "99ec7b8d3088ed88905be149bddecc62", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176273, "uuid": "3ce225ea-3bd2-441d-b142-416035e83c91", "comment": "Malware payload (Smoke Loader)", "value": "9d4306483d7f9aa28e5a20b9d82c75a1403d5cfd2ccfd52866dc4a9de9776ea3", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176273, "uuid": "2ffaaf89-8eb9-4e4d-9123-68ecfbaf5cc6", "comment": "Malware payload (Smoke Loader)", "value": "4d059eca95c323abb6259150545512be0e6ee741", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176273, "uuid": "d6b15ec1-4318-4904-9957-1de1b86ed502", "comment": "Malware payload (Smoke Loader)", "value": "bcdecfdd2b2e0c8eebfcbd5ffca6cda0183f7061ad40cf8502c61aea79f875adb58b85b7e46cf4b0038f370a3e5e54c4", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176273, "uuid": "9ab1fdab-f384-4db1-8f07-6c153a4232c6", "value": "T12C14BE113581C773E02206738875C6F2EF2ABD791D25875B3BB5AEDE1F622E29E24305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176273, "uuid": "c1f262ba-76b4-4507-9c39-81d0afaf23dc", "value": "e905b204d022a4a3f9803ba3895bcbd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176273, "uuid": "73360b2f-2cf0-401c-b669-6810b4460cbe", "value": "3072:b0XNtEXmtswUc8iUIyYLASXoZb155uK1dFKGXOauuYBK:2QwUc8iU3+jXoTuA9uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176273, "uuid": "382cb324-c0b6-40a1-bdaf-40ece9870a24", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176273, "uuid": "914caa56-f2c9-42a9-95bf-bcb30abafd28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176273, "uuid": "f5f4d18c-1434-45f1-8a37-b5b93a15812d", "value": "99ec7b8d3088ed88905be149bddecc62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0d2452-f5cf-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628155784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155784, "uuid": "ab8ce232-8017-4f8b-92a8-bc04f3597f7a", "comment": "Malware payload", "value": "4c9b22390a80767e5703559caff03bdd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Sistema LLC", "colour": "#328F8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155784, "uuid": "29e914ab-4eaa-4d12-8659-fe64e5842351", "comment": "Malware payload", "value": "9d7f7c72370ec20ffa8d25341c1e94626785feb7e964005feb8a474894cfd32a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Sistema LLC", "colour": "#328F8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155784, "uuid": "fd2649d1-be09-4a44-b032-c2de9198e8f9", "comment": "Malware payload", "value": "001100a7b24c44d699d5d21711149470e52e0488", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Sistema LLC", "colour": "#328F8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155784, "uuid": "307fa341-b16f-499e-b6ba-9ed551df1af2", "comment": "Malware payload", "value": "11b14b429894c1fb9399a5a2ab1c1b39082188a4b367ed199c3a4823e3a819d520ff56765eae440293cd75b22a46f1cd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Sistema LLC", "colour": "#328F8D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155784, "uuid": "fb6e7458-6a7a-47c3-8e7e-a858622d15f2", "value": "T1A9728D3B1B381461DE4D4CB9E0C84AA21D707B70AF89406392FAC44E8E957F5677C32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155784, "uuid": "963f1331-7ed0-426b-9cde-645a52bc8784", "value": "1dcdb5550f0e3d7e686b361f67a1f2d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155784, "uuid": "415e8be2-9d97-4452-803a-dde112140764", "value": "192:Nx3j+vEMbdJkwKdEQs6JH5OhLLxTGdeGzFRl6WKpPIKfhig1/C5cEWXSaAg2Mf3z:jab6JHwRT8TvapwKNsenvazs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628155784, "uuid": "4b26c97d-d1b2-4d05-93f8-c6d353b64096", "value": 16312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628155784, "uuid": "76c9c409-a287-43ad-b77f-1af3d8a56140", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155784, "uuid": "89e60b04-5c55-4174-911d-e46971fc1709", "value": "9d7f7c72370ec20ffa8d25341c1e94626785feb7e964005feb8a474894cfd32a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6cabb40-f59c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628133953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628133953, "uuid": "384b8ae3-6000-481f-9e14-a4833f43e818", "comment": "Malware payload (RaccoonStealer)", "value": "9501287a60ba3dc0b7012ebb61f9d20a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628133953, "uuid": "4b393da3-6294-4d22-9db5-ca31369b04eb", "comment": "Malware payload (RaccoonStealer)", "value": "9d893c14bd42939f5ccdac8878da2219eb815b960f3159be9cb4f3daa407fd2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628133953, "uuid": "e73defef-e4df-4109-9fe3-92920eb543a1", "comment": "Malware payload (RaccoonStealer)", "value": "35d5413109e4e6969d3f877b54547dcdac67515c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628133953, "uuid": "5ea64821-0c19-4737-aeae-acd35cbbecb8", "comment": "Malware payload (RaccoonStealer)", "value": "a41cba901b24a73d601f24ec5cd793502aca0f8fbd0304b94dff6f836c76ecc206e80637c0a7cda2a5f31d9b2727bdb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628133953, "uuid": "47da8b9d-8c4d-405d-a19e-d1ecaacc9c39", "value": "T18DD4E030B690C035E1B712F845B983BD6839BEA1972450CB62D53AEF16356F4EC313A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628133953, "uuid": "2fdaf00f-f0f6-4913-a929-a688e3131b90", "value": "57bb9b4b2dab4ca0a9a9d0cdae0c89c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628133953, "uuid": "9fc09fd1-f463-409a-a35e-6d0d642b639c", "value": "12288:PespzaD8KHmRHa4WmsXjZTFnoKHOeodwgaZFyLGI0:3zm87XsNTVrHtiwByiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628133953, "uuid": "5db842a8-4ad0-4116-a3bf-ab32d279d553", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628133953, "uuid": "197089ed-8c27-4491-a9bc-38fdee35aa76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628133953, "uuid": "5468193b-ac45-40ca-b51e-fbf2a3ecd721", "value": "9501287A60BA3DC0B7012EBB61F9D20A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d957a08-f5fc-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628175035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175035, "uuid": "69492849-7801-4d11-b7f4-3407601e75b4", "comment": "Malware payload", "value": "21e01d164563f90fc3f7aa2f85324a9c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175035, "uuid": "5110ab82-8fcb-498f-9521-794459b9dbb4", "comment": "Malware payload", "value": "9dda457413fc9a0a9fb500b8b4904175927ef4019c8f3b58089484f79742b6d6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175035, "uuid": "c15d9657-242b-4128-89d3-77c74ac44407", "comment": "Malware payload", "value": "6678be9e536d54d4bd60ed8f536fddc77eb3384d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175035, "uuid": "e7ec6228-6447-4736-90f1-26b71fc7dd85", "comment": "Malware payload", "value": "e19904ce04b85e24d628a6ac5712c1e6ea314d4a61428a2a21da604ea4f8566c7c0790d087cac408640297cfc41a6b7d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175035, "uuid": "5a0ecfa7-df43-42d8-9aac-8be0c2a78a6c", "value": "T135E533D4A03ACB6180D228029E5BD3EF58597DC6B95E3322EF012AC5EB8F7C3D545C66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175035, "uuid": "41d3ceda-d1cf-46c1-8640-0256850edcab", "value": "49152:YXZ1ULu2fbU9RH2VdFJJu+284Xa1GuOPbPbb+gOK6VGA7QO1ViZOaW:YXZku2fbF3uPXBumzbb+hxH1b1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628175035, "uuid": "8953fd52-e677-4ef8-98ed-bf8e52978a60", "value": 3073072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628175035, "uuid": "bb2571cd-fe20-4c2d-8c98-14ce72226d08", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175035, "uuid": "502f28f5-0563-4724-9942-29ab49f138ae", "value": "Factura__Pdf__Electr\u00f3nica__2021__02__CZJXFSJFSDLCHHAERIAOJELADJASDHKLZJTJQHSDW.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f55f8a7-f620-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1628190365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628190365, "uuid": "dedd4cb8-d4ae-4a0c-8cf2-10c0409aa13e", "comment": "Malware payload (Adware.FileTour)", "value": "a831e658b5144fce65d5792fec93c5bb", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628190365, "uuid": "74dc842e-a558-48f7-9b7c-103a36404aad", "comment": "Malware payload (Adware.FileTour)", "value": "9e74b137b73150bea9b3ef6b987d3af1b3c445163c8ea469e6608d3ebc6062d9", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628190365, "uuid": "646c057e-95a1-46b0-a072-0c93f172da15", "comment": "Malware payload (Adware.FileTour)", "value": "65552151087cd73c37ddff91da1fba390073aafe", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628190365, "uuid": "57173501-4c87-4516-96aa-463f1ac6d572", "comment": "Malware payload (Adware.FileTour)", "value": "ca516f1753e1da0cced5ba56dc8195209873bb128d839183dcf976eefb9a298440b24393c7e2af5e167b14609db7b850", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628190365, "uuid": "21b1f406-efdc-42a6-aefc-04dbd027a098", "value": "T11B0633C44716A5BED3E083F356B86EBC7B5089FC672855DB7263AA32077E4C235E4260", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628190365, "uuid": "ec745516-896d-4fa0-b1c7-148dff1951a7", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628190365, "uuid": "fc3da43d-9218-41c8-b5e3-2a9f035521f1", "value": "98304:JtV+ZkLdDjG4yi9/8c++DukiL112YjU9gu2qZ2qg:Jb+kLdXyi9kcICYQ9gL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628190365, "uuid": "d35e491c-67ea-4301-866a-d269206b1c58", "value": 3729743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628190365, "uuid": "848299b0-8659-4ce6-982e-a5c97492cf33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628190365, "uuid": "e2bfc642-1c22-4738-973c-243880262fea", "value": "a831e658b5144fce65d5792fec93c5bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f312ea-f5ac-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628140548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628140548, "uuid": "221ab358-5215-4061-94c1-aa69d5c03244", "comment": "Malware payload (RaccoonStealer)", "value": "c857d1c121d19ef45ed5b8c9d5812d43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628140548, "uuid": "7cd23209-df49-4f41-be3a-93dd186946a2", "comment": "Malware payload (RaccoonStealer)", "value": "9eac1828152c86d73ece95e636fdf83d54b8658a8f7175aac48e96127e13f064", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628140548, "uuid": "798fffab-dfe9-4658-a464-2cf28405c3d3", "comment": "Malware payload (RaccoonStealer)", "value": "3f28fbea50abc4e491a8524a86b63aa83abf4fd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628140548, "uuid": "d3822d01-535e-4105-9561-5848f1c4496a", "comment": "Malware payload (RaccoonStealer)", "value": "14081b68d68886adee8fa2b65dc24e51d7becb188c61ea65cabd68f50f0b864926094b47322eb55038e8e159c2e1bc5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628140548, "uuid": "b4495ece-40b7-4011-9f2f-4c0ec8fb2f3f", "value": "T1B7A41230B880C432D1B556315DD3CAA17EAD7D20A9BD980737942BEE2FB52D0AF7E251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628140548, "uuid": "bf9f51fd-83d7-423d-bea5-9dcc87af57d1", "value": "1cd2cdaf0d3244745bbba0ea35647dc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628140548, "uuid": "5fec14db-e0fc-4406-8d27-014ea09a9087", "value": "6144:sGZEeEkidKB4kk3SKFuR2QS4SvpXKbM3d3vFd1p1NLVBhLyXczl:PZkkiYq33U7SZFd3vFd1p1NZXysz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628140548, "uuid": "6934a799-9f61-4518-a116-876d689fb78b", "value": 477184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628140548, "uuid": "c776dc65-520a-4618-aefb-4f3196376db9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628140548, "uuid": "bad8faec-dadf-46ce-952e-b6bb55dcc4d2", "value": "C857D1C121D19EF45ED5B8C9D5812D43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289a4913-f5ba-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628146545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146545, "uuid": "6bace775-6980-41fc-aca3-45b70f7505cc", "comment": "Malware payload (RaccoonStealer)", "value": "29f53ffd06e643565b75419a34ad68f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146545, "uuid": "93f2f5b6-4008-4290-801d-fd17f59ea174", "comment": "Malware payload (RaccoonStealer)", "value": "9f0f7b15e5cd48c237301893d63eca7635639d221ff853d829625007200f4041", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146545, "uuid": "a19e3a93-e9f9-45c8-a306-1eea173ebd10", "comment": "Malware payload (RaccoonStealer)", "value": "98561d3a1719fce466ca4b2f7bd77e8772e49a04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146545, "uuid": "a5bd0a63-3b48-49ee-b4fc-c8868464348f", "comment": "Malware payload (RaccoonStealer)", "value": "cb7e1b7ca55496ae37bc2d0adda8e32fac5e1517493f05cc182416632071e70c821defc66494858ff4c2f7fac683fbc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146545, "uuid": "1200aa51-cd4e-4924-8dfe-a0c0de0b896a", "value": "T1A8A412117AE1C037E62707B04C60C7A59B6AB8345DBAAA8F3FD9577C2F712D2AB14305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146545, "uuid": "78063302-8b77-4d33-ad38-0672cf44c057", "value": "2a9c1ca66125aeff7a1c36242be63d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146545, "uuid": "6ae146e6-044b-45bf-abf1-fd0f8a14af90", "value": "12288:/dWUoZNHwsGNNp4p9lxROoDNPHml4pvNtke:/Fww1e9pVE2p1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628146545, "uuid": "3ba16d45-50e3-4796-afc2-43ddac38716b", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628146545, "uuid": "c9b618b6-f211-4d60-9f01-2eaefc5feb7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146545, "uuid": "5ef8c777-9833-44d5-8f64-2cad6eda8be2", "value": "29f53ffd06e643565b75419a34ad68f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965f80f1-f5b9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1628146300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146300, "uuid": "b3e610b2-ad46-4ba7-a730-34039810127d", "comment": "Malware payload (BitRAT)", "value": "68222440e7fab33d7b5ec1b6e2672962", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146300, "uuid": "dbe27520-feb6-45e5-81ff-088d4869d66e", "comment": "Malware payload (BitRAT)", "value": "9f853c69ec51eef3b38c508c2cdfaad6230c9cac218b6c1e2c1aade3e2aaa684", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146300, "uuid": "aa4c614e-e5b2-4159-896f-3f3e1926fdf5", "comment": "Malware payload (BitRAT)", "value": "9e756880fc27ce0e0aa9f746039ec5fc0ca60294", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628146300, "uuid": "3adb3950-55cd-4832-b15c-a6a74f82b7d5", "comment": "Malware payload (BitRAT)", "value": "c74b7bfe2120862957796bbfa34e6e2b25a2a0a2917fa0d092b0a195f81082df88746959d859cf2e1dcfef42f77a6dd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146300, "uuid": "2a199af3-5048-4cf6-83f6-3f2cf867faad", "value": "T185D5331453B96432F22E01F43EAAEB97487BFB35CD0A8E1323807ACC1D35BC59596766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146300, "uuid": "3c4194b1-79e2-4583-a386-be7ad4536a77", "value": "4e0230218d44198d72f8950221b8a209", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146300, "uuid": "768da89f-341e-4ad5-a1c6-18068a078baa", "value": "49152:wvibll7s0eIB4GzdH21N9vGHE5S9H5EsHBTzPfEAuj0/XN+fX+4T38mc:wS00SGzdHAuPmKJzXEAfXcuwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628146300, "uuid": "0c685297-7b9f-474e-8717-277e8c5f076c", "value": 2753192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628146300, "uuid": "d886b970-e772-4d43-a0d5-1aafba67eb55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628146300, "uuid": "e8bffdac-879b-4bfa-88c7-d8d53958351a", "value": "68222440e7fab33d7b5ec1b6e2672962", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4f4841-f5b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628142203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142203, "uuid": "11a5f706-eead-43b4-923e-3e60b05e54fe", "comment": "Malware payload (AgentTesla)", "value": "28d00d87d406268217ece94fd43872ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142203, "uuid": "7545dd2a-7207-4579-9ead-ce7def28ed3b", "comment": "Malware payload (AgentTesla)", "value": "a0f0f5f8d52668129652ae074bf54b936f038b3192bcb22d562d1542730b28ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142203, "uuid": "1ab7c303-f839-4639-a1bf-dbc6633a41fa", "comment": "Malware payload (AgentTesla)", "value": "ba43a560933c6e39ff849a5912d864151649cb3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142203, "uuid": "5ae5c09b-62b9-4608-b61e-7321de5acc2a", "comment": "Malware payload (AgentTesla)", "value": "d110aaaec222eb28eacd7e89d363519a0ec4fdd9c83a31f4d6cc26b7c22447365ae62e25324e182704009137c3f95d78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142203, "uuid": "89d82886-fd22-4322-9417-f0668417c6c3", "value": "T148158D2229EF214DF3B69BB60FD4F8BE56AEE973161AF0F638811B954321940CD41736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142203, "uuid": "9932db56-2e50-49fd-9aba-b9fcf4fdff6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142203, "uuid": "7e41cfd0-594b-4c8b-aa29-782ae49c451b", "value": "12288:ojkKpz/w/aYulS/XcmY28JHRsFD8+81KZcRA4meT0uAdU/AnZgoR6vgF0wS2u5XL:4h/w/JuqXcmcHaFD/ZdBeT0ofoR6vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628142203, "uuid": "e9b61ff5-f6c5-4802-85e4-3a981c93b50f", "value": 907776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628142203, "uuid": "3cfdd177-11bd-4c14-b66e-0d9287d1b180", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142203, "uuid": "89881cd6-833e-4bc8-be2e-9a27fba86ba0", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2524f659-f60b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628181329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181329, "uuid": "e8c7fe1a-7904-413f-a32f-0c7454213a91", "comment": "Malware payload (Dridex)", "value": "b2c92bf5e9b61d5a8ec68fda5e205208", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181329, "uuid": "67adafef-efe4-49c6-8a97-c1983c66184b", "comment": "Malware payload (Dridex)", "value": "a12cbc75dc6cf03d8e031e14a632ad79b7a580adcf07e7f3043afcceea279fd2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181329, "uuid": "3c447de4-ba3a-420c-940d-7d2d78d3f075", "comment": "Malware payload (Dridex)", "value": "95a5e99eab61e9a6bba9bf04c15a6c1954d60c5e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181329, "uuid": "116c88a4-ed94-456d-a4b8-1ef375acbcdd", "comment": "Malware payload (Dridex)", "value": "aef108629f10324c63f4152493dd4a9701cef41567a4b6c9edd0c1d2697fec934f95a335e3615391ccc4531bdd49d968", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181329, "uuid": "63f0df6c-f5c0-4521-9f5d-117138fe6595", "value": "T1BC04D042E3CE23D1DC97B83248FC262924F05444D85ADCFEC995EBACD7E1F574A64A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181329, "uuid": "cc7cfcd2-7593-426f-abd7-c8efcf723b08", "value": "6eb7ecc6c2e948f718b1179f888ea193", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181329, "uuid": "0e8aa08d-7dd1-4cfe-a9b7-42cb56183d5a", "value": "3072:7cYhzpn9z75jWpmrL3gA99hXkKsorn+AOr4R1jvaT:7cIntom33RDvn+Rrer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628181329, "uuid": "ee1b126b-1c0a-4372-8fcf-56c78ef034d1", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628181329, "uuid": "b84a0424-8805-4d8d-8a2a-27ed1c6908cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181329, "uuid": "80e4b621-8fa3-45e6-b5f0-cb8f6e98d245", "value": "sKphGp4RvA3Wc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c434883-f5ff-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628176214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176214, "uuid": "8805d011-ad5b-480c-a074-0fde8e8d2f7f", "comment": "Malware payload (RedLineStealer)", "value": "bddd7d0a1ecd1f661016618374e1632d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176214, "uuid": "81548767-8beb-4c66-aac6-91be07ab05d3", "comment": "Malware payload (RedLineStealer)", "value": "a26803d8e53b6a759a71245e8b973ac9c8eaf9ebfe7356d7e4b4cd5e03bb5414", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176214, "uuid": "cd19cf8e-6998-4f2d-b139-f16deabba717", "comment": "Malware payload (RedLineStealer)", "value": "f57a741e4a6166ae8304ea8010cdb7d7c1184c15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176214, "uuid": "722ceb26-fae0-49f8-b6c8-6b9e8fdecc0f", "comment": "Malware payload (RedLineStealer)", "value": "45477a5d57c9b1ffadbdef56afcc3528cef7f7ad50b13310bc269f33a531de02699cf481c7471f0f09fefec92892c859", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176214, "uuid": "3ac365d6-5c84-4573-918d-a3948d04e549", "value": "T1E5D402003644CC76F6677970A819CAB50B3BFC75EA2986077B859B8E4E322F29F35345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176214, "uuid": "c14d7eb9-4a51-4c65-83f2-f9c839cd837c", "value": "5db1361d34b46103924e72350663b6e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176214, "uuid": "175f6313-858c-4731-ade7-3162460cb28e", "value": "12288:OEPGgBjRc9RtA9K89hZWR2mAeUWPYb0Md4sQwQgPCgw:5GgBjmLG919hZWRIBsQZd4sQwQ8Cgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176214, "uuid": "65b072bc-6d6e-4ce6-9b0f-5e658aafe069", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176214, "uuid": "0d002ef4-db08-401a-a405-a3909c784ece", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176214, "uuid": "bef291df-8309-4e87-8fdb-0876a5a1c9ca", "value": "bddd7d0a1ecd1f661016618374e1632d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fecb4a17-f5b1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628143039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143039, "uuid": "0d120860-16ed-450d-9d3c-16561f6eaec2", "comment": "Malware payload (Formbook)", "value": "c9679e89c82e025b9855189876f92761", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143039, "uuid": "8bdb5632-1176-445a-b3da-71bc2e575039", "comment": "Malware payload (Formbook)", "value": "a2c6a9d6809c3cf2ea1108aae86677aaba31ef7e2f10017331716bedd2a8f91c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143039, "uuid": "2ea24a28-102a-4778-a44d-d5495b1c78af", "comment": "Malware payload (Formbook)", "value": "95657425b7d3a3bd81426e76637ba77d3ccd3d8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143039, "uuid": "a5154ae6-0fdd-41f0-ae68-87adf952f662", "comment": "Malware payload (Formbook)", "value": "2fecefcc541ee5b3fbe36aa3dbb3616f29022264c84b03370f17877de95166a19ddfa0b604121ceb8614db62b9b230b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143039, "uuid": "cae7d9b4-c9e8-4d3a-9221-fe5541a92088", "value": "T12C54F111F1804536E4320AFACDB96755001FBB702F7967E3E2A82C5E4DB96D23E3958B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143039, "uuid": "523551b1-a81d-41a0-bb46-49b5a5cffe35", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143039, "uuid": "4338b8e5-319f-43c9-b220-9029a8ef097d", "value": "6144:k9PsOLUu1ITOgcWXg38+UT0Tf3OkKNqos0f3boqReR0+:kZQ1Zg38+UMOLL8RR0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628143039, "uuid": "61baba5d-da44-4891-be19-d995074dc393", "value": 289149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628143039, "uuid": "222ad80e-1db4-4e16-9b81-578171ff3ded", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143039, "uuid": "74109af6-e74a-45d6-8b4c-7f2a3d9143b7", "value": "c9679e89c82e025b9855189876f92761.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f49f91-f5d8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628159458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628159458, "uuid": "334b2c39-1f7a-40d5-8572-1859815e6588", "comment": "Malware payload (RaccoonStealer)", "value": "90ba98cd1e82fe56b6298d223fce19e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628159458, "uuid": "78720b51-8da4-466a-9367-f88242d93b30", "comment": "Malware payload (RaccoonStealer)", "value": "a2f1c5af04a6f8e79461bdaa3847ba47c7a7bb03d2689c9577035a4f49b6f133", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628159458, "uuid": "95519d5a-02ba-4a0f-baf7-91900a034ccd", "comment": "Malware payload (RaccoonStealer)", "value": "3be8aae5fe56079539f6031678ac33f6ac79e37b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628159458, "uuid": "6a0803d6-f1ce-4102-b65e-b085c802277e", "comment": "Malware payload (RaccoonStealer)", "value": "48968be2121209c2e8f6dc0d4aead2dd643c7628f02d46626715ffa461a5af8343a2a8d5fdc612ef42087d987b95c815", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628159458, "uuid": "18158235-75ed-46d3-b4f5-c249f81b5eae", "value": "T1F6B4021175D0C637E17447B08C36CAA5ABA6BC742D249A8B3BF6666D3F253C39B1C309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628159458, "uuid": "471dc0b7-aec0-4adb-9aab-9986fe5f0f2e", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628159458, "uuid": "ced5fde1-6154-48cc-a58f-70c1505aa66f", "value": "6144:zuAKghYlfP7Fz5Fgo+S0wHhzViVM+zncJ0Pnqr1zwl/EIoB3i3GllxH9/OfSGKP2:+fgoRHF8MGeYC5iIbpPVUxJAAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628159458, "uuid": "5583bad9-bed5-474f-8a0c-f126f55b388a", "value": 496128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628159458, "uuid": "09a5fa37-e4cb-4920-babb-2342828ed0ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628159458, "uuid": "2207efbf-2f4d-4f36-92cc-d2bdf78bc1ee", "value": "90ba98cd1e82fe56b6298d223fce19e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39da507d-f5d1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628156453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156453, "uuid": "cbfad4f4-dca8-41c2-902c-d4cb6ddf8154", "comment": "Malware payload (RaccoonStealer)", "value": "1fcf08f6bc8513cdea7ca7069e88c1c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156453, "uuid": "af79c97c-3e9f-4bb0-84f7-0859c0cb86c9", "comment": "Malware payload (RaccoonStealer)", "value": "a3ca7396af2d3551e5582f20eb52db82a72f6bca8f1bcc93b738dc2d4026aec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156453, "uuid": "750db613-cd88-41e0-b8c3-080deea24a49", "comment": "Malware payload (RaccoonStealer)", "value": "16393dad6564afe1baff9b86a25bb54c8b0097ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628156453, "uuid": "def05192-23df-4555-baf8-3189e25c4758", "comment": "Malware payload (RaccoonStealer)", "value": "681b223ccf416306dac853549ce61de5546cfc5094dcb3f4a59a96c43b46266cb1c0846d7a0cdd5bf6b1bf3d81ebdd2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156453, "uuid": "8d55d0f8-02e5-44ea-897b-ffad2ea3269e", "value": "T1F5B402117581CB77E0515A708871CAA47BAEBCB11D3496CB3FB16B9E3E222D2AF35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156453, "uuid": "46230913-e9bf-4fe2-bb59-f9f4961f7d65", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156453, "uuid": "e6a521a9-3ded-4beb-8d34-f884d0b691f7", "value": "12288:SNOnMhSOG74kE4rocwfmlWaJfzTUZb45Aud:wU8SF74gropaJf3Ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628156453, "uuid": "ae5efb8d-7908-44e2-abbc-d6aee6ed59ab", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628156453, "uuid": "8ecb385f-3cba-4370-9371-9cfea9e66e10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628156453, "uuid": "51ce55c5-ad9d-4524-a5b0-faa7291e3854", "value": "1fcf08f6bc8513cdea7ca7069e88c1c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907d53c7-f5f1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628170342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170342, "uuid": "39980f4c-5540-4696-a3e3-a0dc2f2ba238", "comment": "Malware payload (Formbook)", "value": "0cf3d9eedba4a3f207da831f7fbb2ea8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170342, "uuid": "3c7a8d64-fb59-4134-a216-240ae8a4a7e9", "comment": "Malware payload (Formbook)", "value": "a430c4c3f55897e166e55d91ace396814d7cc865dd457bb2f17b76a75d340f33", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170342, "uuid": "c0a5876a-f07d-4660-99d6-933e046c1813", "comment": "Malware payload (Formbook)", "value": "a2b876d19cc96df552ac612ade1620d4bccc1b40", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170342, "uuid": "c7adb132-c824-4c96-812c-0455bb9ec8cb", "comment": "Malware payload (Formbook)", "value": "9823c4322bf0190b825e029171cf03b54ddb04a47d71572462a5382faf79f03a970d1f78ede01b52f3642826241e23d1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170342, "uuid": "15f1fe99-bf74-4ecd-aef4-1eda896a8634", "value": "T129653356B58E1FB7D9BEC43CAA5E65090970CDEB56680C6F6F4CB701383327A63C124A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170342, "uuid": "ad729cb0-c592-49fe-a309-d079b5045881", "value": "24576:CJfWYH5t++YlF7KDRFvLy03SHknYiRFVrYhtTJi7bcGjRqSbKJI40ffHYWExOz0s:cuYHHlMaBy0iHkDVrYLTJLGFPOaJn4WL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628170342, "uuid": "e68a1f06-8ad2-4444-a629-4e39c7c278a4", "value": 1422848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628170342, "uuid": "a6574af4-c4fc-4c9e-adf9-59f92c15402c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170342, "uuid": "7a631d39-0801-4716-9e7e-4123bcd7a246", "value": "PI (Sharif Home Trading Limited)_03.08.2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0dd08bd-f61c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628188892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188892, "uuid": "cae237c8-b73e-4490-8081-ae99fc53a91b", "comment": "Malware payload (AgentTesla)", "value": "d25813cffd6ecbdbcff30e73538c706c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188892, "uuid": "31a7e555-0dc1-46a0-9efe-e7075d977f30", "comment": "Malware payload (AgentTesla)", "value": "a46daf608f092b3dfeccd1bd6f9709cf1b6f60dcc0ac5040b7b8321ac00f22cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188892, "uuid": "b792da44-b151-461f-96fe-329e50fd009c", "comment": "Malware payload (AgentTesla)", "value": "4ef804196d7fca0ab8ad416447c65a421d1067f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188892, "uuid": "4563a596-bf75-4098-bcb0-59d8e5883ce5", "comment": "Malware payload (AgentTesla)", "value": "10abf942c6803fc1f3bf763f7a1d63a77abb65aa3753efbd3f9d6d075d537c301e15e330ceacf63038586f527f10e8f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188892, "uuid": "45a60af1-d8c0-4c5e-aa55-bd8b33a8b083", "value": "T17E25F1223BC06F8FC72E8D76C1531900A2E0E567220BF2D66CE251DD158D79A9B526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188892, "uuid": "286c7abd-010d-49da-9c3c-81b1a6ba646d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188892, "uuid": "cc25ed3c-b96c-4ce4-b39f-2b970eea7db7", "value": "24576:RQx/2UfYalpM6lUQUtdPEZjxTffDKh7/pQAKK7nHLT1d:KlRfeQUncZdfDKhTKanl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188892, "uuid": "b4e5d8a2-e46c-4cb1-b789-e4e7a21622a9", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188892, "uuid": "1519ea20-b1c3-46b3-9f2b-2201d5312a97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188892, "uuid": "c5105a71-589c-4208-9e42-8d69d039ef75", "value": "d25813cffd6ecbdbcff30e73538c706c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a94ec09-f62c-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628195565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195565, "uuid": "731adad2-9562-4bb7-a6dc-5693cf186dec", "comment": "Malware payload", "value": "6bbd37a745495233a5273393e3573815", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195565, "uuid": "a4840d39-5fd0-44d0-96ad-9953bb19efec", "comment": "Malware payload", "value": "a514f0ca924692ce32d35da9aab7b0ca806b8ae1542c24b42b5438f10925e9eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195565, "uuid": "3dc529a1-a86d-4ead-8453-61780bf1abd4", "comment": "Malware payload", "value": "d46a1a708f2fc91815c3ed848c607dd6a5d9ec69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195565, "uuid": "a1689b86-1f81-433d-b735-1682e23940da", "comment": "Malware payload", "value": "7d44993bb44dcc7493b162eb1d89178050aab0ebb7e123b654791622c7ac4df0ad9d361fef23aa772869f7bccc8ec849", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628195565, "uuid": "2370673b-98ee-4aa4-af89-d8f3d80a19bf", "value": "T12A447E76F39619A9F5C3C87EE306B2B1D1032C266BAAE591543F03F34075095DE66E23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628195565, "uuid": "1ffba07a-26cd-46e8-b89b-18395f1c1e99", "value": "6144:a/tGD3qpWqqLZ3J2wYtJkLJPSPuEZ6tcUxHW68waW4+T0kU5URG52H5HH5d:a/cDxqqLVJ2wqaV6PuS6tcUxHW6naW4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628195565, "uuid": "91470643-852c-4a4a-ab27-f60290e9c9bf", "value": 267795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628195565, "uuid": "3669eb27-d77e-4177-a68f-3cffe4c22e2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628195565, "uuid": "eb2181ef-4188-44ac-8f66-233c4d03c43a", "value": "d46a1a708f2fc91815c3ed848c607dd6a5d9ec69.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99fa3c73-f608-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1628180236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628180236, "uuid": "fdc71725-28c6-4821-8970-4aeb11ae658c", "comment": "Malware payload (NetWire)", "value": "04e96a27c8ae98f43ec0d31cb06ee44b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628180236, "uuid": "ffaba614-fae1-49bd-bfc2-7a96011c158d", "comment": "Malware payload (NetWire)", "value": "a659b12b3702908176e925fa920e42ff67435a60e025a608b52acd81f44e6f1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628180236, "uuid": "ab24cddc-5525-4388-b4ed-2b1464c7818b", "comment": "Malware payload (NetWire)", "value": "b5c0777f701fe128f66ceccdc8b532703f34625c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628180236, "uuid": "ab399b6c-c431-46f9-9c9b-3b1714f957b9", "comment": "Malware payload (NetWire)", "value": "27e832faf319ba003e71e0622d02c304f1620c48fe3454929967dc7dfe33fd182e4a2a098551a0a3c04eb47f6e3011c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628180236, "uuid": "5dfca2da-c6cd-4a21-8ad3-b9dcb0a79800", "value": "T1BAB4578F21B9A0F6F9F11A32C4E09550B5F8B92CCB104A5763582A793E731F1D92297F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628180236, "uuid": "0ce5f76f-bad0-456c-82bb-fe07e247a474", "value": "ea8de473df0698dc330fdb95b5eda1f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628180236, "uuid": "2317c4ee-18c6-43fb-994b-2e0bce0016ec", "value": "6144:rSH+MbiH2r0uS11MMvEV9SlVwGP2b/xVz8I+1FudBFNc+186DClQ:rc+Mbip1BEV9o/2DuFyFNcWLDkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628180236, "uuid": "82bb5fa3-7894-43c6-98a9-5dc136786752", "value": 496895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628180236, "uuid": "34bbbe43-2655-4a43-8c6a-5ca3b93de9b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628180236, "uuid": "a2e4f428-a115-4f7f-a920-a72924f8597a", "value": "PaymentAdvice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039b0f56-f5e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628163663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163663, "uuid": "2e10b1eb-3066-44d4-8705-6ffaf1caec4b", "comment": "Malware payload (AgentTesla)", "value": "b2b8e5b05a4b8235a0d280265fec39ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163663, "uuid": "14295179-f0da-4c6d-a20b-08bf69fb081a", "comment": "Malware payload (AgentTesla)", "value": "a840a76e0a932c4b771b77bfeeee8804cecf0285ea37e6e757e955ab72586462", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163663, "uuid": "dced720b-f5b3-4e2e-b921-138814cebc97", "comment": "Malware payload (AgentTesla)", "value": "b4c27fdd60b5d67e3f3d81e0bc9357d94edddc38", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163663, "uuid": "f0e6a1b4-ef44-4c13-b8e8-3355d8894744", "comment": "Malware payload (AgentTesla)", "value": "b8431a86d947f8887a85fe9e66d4a57e2da118c415e930bd5c070b9d77c255f2c39a04388744c0314844498a173b1d7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163663, "uuid": "863afdc6-2f9e-4b30-a19d-3592898ff02c", "value": "T1B6057B2229EF158DF3B3AB764FC4F8BE56EAE577570AB0B638910B454322900CD61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163663, "uuid": "c1a1a218-3c21-4d4a-a245-dff6ea149418", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163663, "uuid": "fe326449-cd67-431e-b29b-16169b387b5e", "value": "24576:x/oR6qgXTnbmuMU/gFC2nKqAGqjCTXnMAUfUeE:us7muMUJ2KqArCTXnPUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163663, "uuid": "9396e1d7-dbe5-4b02-bbd7-e12d7a4436ab", "value": 870400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163663, "uuid": "9c3a5e65-7c0a-4028-ab40-1a1dc4e1f1cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163663, "uuid": "651986bf-ca24-45e0-a057-c0000fe3ba8a", "value": "184285013-044310-sanlccjavap0003-7069_pdf (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21690d6b-f619-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1628187336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187336, "uuid": "fde05205-9a45-4dea-be3f-ab79ae5ed714", "comment": "Malware payload (njrat)", "value": "3b0c19dc192dec271f3d14cf7bd51863", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187336, "uuid": "6165e1e4-85e0-4838-af2a-9644efddbdbd", "comment": "Malware payload (njrat)", "value": "a8768e632a5c8fbb7c7b201f1e6df6362ed48d77efa74c62eaa900e0e73eebee", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187336, "uuid": "2e74b0c7-33dc-4ed6-aa14-d8b5850d1a32", "comment": "Malware payload (njrat)", "value": "8ee3c8d79ca88d9eb0692c03423169fcfb1af6a0", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187336, "uuid": "3c5601ff-9483-4a95-9a0b-2c93157b7b99", "comment": "Malware payload (njrat)", "value": "07fb43455a8729dce002d0de323ebd3898582dd05a4f8a150a77bbedc7dae9b27fb7957ddb99041058c9741e3a98ac03", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187336, "uuid": "bd984a1e-5c5e-4024-8e0a-6989a58a342b", "value": "T1D9A23B8E3BE4C625D6AD2EB64CB363105376D2878652DB1E4DED50DB1E737A00980EF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187336, "uuid": "60144253-7a5b-44fe-88d5-34a88cd5bc68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187336, "uuid": "9c55811b-f474-43eb-a3ac-559b8720d336", "value": "384:sIz4+r36P52FRVfgb1EQw6dc0/l34ZoZSTDs+:Zz4+r3u2+b1EQwSt0i+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187336, "uuid": "484618cc-e811-4243-8a20-c0224fa84dd3", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187336, "uuid": "9bdc8eb7-b2db-4687-9137-c0969ab407d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187336, "uuid": "da0a27ee-2315-4b51-930c-67902a4a062e", "value": "a8768e632a5c8fbb7c7b201f1e6df6362ed48d77efa74c62eaa900e0e73eebee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8580ad5-f61c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628188931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188931, "uuid": "b7fa88e1-1d82-414f-8109-9e8e9fed3107", "comment": "Malware payload (AgentTesla)", "value": "7576d0cf0b60965127fbe253a599c2ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188931, "uuid": "729592be-086a-42eb-853d-dfea773b9a4d", "comment": "Malware payload (AgentTesla)", "value": "a8a459f4d2976c7aca51862d982dd146eaee35f19d6e434d7224cbfdad6665cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188931, "uuid": "3429b90e-340d-4fc6-926f-fc08666b3eca", "comment": "Malware payload (AgentTesla)", "value": "6823fff1d48aac4f2da4ced06c84d8a7d44a348e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188931, "uuid": "3237bb35-2657-4700-9f55-03c41b845d6b", "comment": "Malware payload (AgentTesla)", "value": "2ea6b0917672a5a46df380885acfd4b55d7a905c77297ba2e5503fec7caf8e47cc21fa36ff83ab020a77bc991a759f95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188931, "uuid": "6496b6fb-a338-42ad-ab68-0335dd7f635f", "value": "T1BA25281B2FEDD10CF1E6EA3D5BF8A2457F17D9A6411E8ECA48C6231E14A1C41F972932", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188931, "uuid": "97a7b78a-4506-4986-9b26-7f8a0ff3db26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188931, "uuid": "62f8728e-af8a-4f8c-8a06-1a21db2bb581", "value": "12288:nmMrvgzj/pg0QpuuMTM6W3aBaWJiOZlwlkzM8I33xSCPmRn1XN5GnTOdU+CHpZg5:bvmj/pg3pmC3aBaiirUM1xSdDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188931, "uuid": "a42a3c63-05ba-4214-a389-7b488887175f", "value": 997376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188931, "uuid": "7073835a-2cf9-4d75-97fb-99863850f614", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188931, "uuid": "132449c5-f076-4278-bec7-102ef1cf1df8", "value": "7576d0cf0b60965127fbe253a599c2ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33a2fa3-f604-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628178588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178588, "uuid": "be96f70b-1321-4387-9780-508b05ece776", "comment": "Malware payload (RedLineStealer)", "value": "78b9e3ed0f88643a927d7a44451c1c3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178588, "uuid": "32df7cf3-f773-4e20-bcd5-8f21cfc6bc29", "comment": "Malware payload (RedLineStealer)", "value": "a8aa6deb2d60d51d0474c80623aba4fa0eaae6c160364a2021cfa52d41f5bc09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178588, "uuid": "fed35506-d49f-43b5-90de-9756acfd395d", "comment": "Malware payload (RedLineStealer)", "value": "7b48a0115bd5ff656fbb02d6356d07f13c296e56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178588, "uuid": "bc9691f7-f94d-4023-aaa3-3ebee44fe0a6", "comment": "Malware payload (RedLineStealer)", "value": "f33827af2aae13aa63be6fb8409bb0f37f40375a79c1dd8c6fe78a39cc00bc945c0264458e0f80e96736851083e38d1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178588, "uuid": "c1911f5b-d369-4c38-8cb4-619ddf5f9cec", "value": "T13A54E0123695C837E9650BB58C61CBA96A2F3C350C65978F3BC5669C4F322E2FF21306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178588, "uuid": "33bc71cc-f2ec-481e-8f5d-c2e0a6927dc8", "value": "e2ba8e1f75a8e02687cc194905c50074", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178588, "uuid": "024596b9-625b-4ed0-9577-c41a2687d770", "value": "6144:NTX9rKrLC2lJ5QwRPjLkFQGJ78At/Zp7I1Vhv:JIrzJGwNABZp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628178588, "uuid": "d0c8f487-1e74-4009-9009-4bd908516f8e", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628178588, "uuid": "44c3c6a5-93d9-4c79-a9b7-ca2a284293b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178588, "uuid": "edf5d142-09c9-4dad-ace7-8600bded1b92", "value": "78b9e3ed0f88643a927d7a44451c1c3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52d835c-f5b5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628144741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144741, "uuid": "0d078179-278b-46e0-a870-1d6ed3e446b5", "comment": "Malware payload (RaccoonStealer)", "value": "4d4378bb475277a54d629e5ac757ff32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144741, "uuid": "d1f05170-db60-4fe9-a142-6b7c6b86ce78", "comment": "Malware payload (RaccoonStealer)", "value": "a8b913ce201179d8e302d9924fed2cb40508d23741fa11554420cccce9caa772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144741, "uuid": "4b6850e5-ad1a-4db0-ac44-a6f378728c31", "comment": "Malware payload (RaccoonStealer)", "value": "c7d7d7799102b0a90df13b9f02c1c714733d5e8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144741, "uuid": "117a5e51-fb70-40b8-8666-b27322d9f513", "comment": "Malware payload (RaccoonStealer)", "value": "9e67c63b8185f7806a1d82e4379f59f4f205892bc6cb32a73214342fba3d7d8092b87e69fad15dea38b7ec9c575dd262", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144741, "uuid": "f8b1261a-9c85-4610-b014-e5a6aeb847ca", "value": "T1D8A4120236E1F333D5659AB04C65E692AFEB7C700D745A8B3B8052AD3F213D2DE66316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144741, "uuid": "1e267c93-a54d-4aea-b3dc-a52f21640cb0", "value": "2a9c1ca66125aeff7a1c36242be63d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144741, "uuid": "0bd6eadd-e1fe-4801-85f8-4070c6e1af8c", "value": "12288:2i9yo/9gABLEbAzRUqtaEVhymC81INZV:2fw95BLEbAz2qtaECWINZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628144741, "uuid": "2ecb8a0c-4332-40ea-9484-4dd3048f73e1", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628144741, "uuid": "4a662550-a68b-47b0-9df2-697926a2618c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144741, "uuid": "568c9a7e-2bed-42e4-aec4-8af31f5af187", "value": "4d4378bb475277a54d629e5ac757ff32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b820ed2-f60b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628181366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181366, "uuid": "0004370e-10e1-4a25-9a75-527ff52f74a6", "comment": "Malware payload (Dridex)", "value": "edfd50f04b22ea76ac00ccd886a31146", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181366, "uuid": "c166f35a-4b99-4888-8919-fbba57637c03", "comment": "Malware payload (Dridex)", "value": "ab052068c38c07ee3da41a2ed7670710b5fff0689bb9a6bad61d816b5b6bc0c1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181366, "uuid": "d96a61ce-6c90-43ef-82fd-d99563920c84", "comment": "Malware payload (Dridex)", "value": "24c0d99b09bb2d1fe58061881bec5ea59462fb2c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181366, "uuid": "b9f1eae7-48bb-4853-ab6b-5d900811c171", "comment": "Malware payload (Dridex)", "value": "252c6ac59f0a5613f8dd311ba6c0ce5f0be16b00766fdadd095975356cd2d56c347791b22606207dbafccceff78d60ed", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181366, "uuid": "71b5284f-202d-48cc-820a-5f26ddb470ca", "value": "T16204E0C042F7D2A5C3679B7C00B671BFF16929012B76D9588D85CD2CEAAFB91D360272", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181366, "uuid": "e21d28dc-33af-4021-9339-5ac5f47724dd", "value": "39ea6703ace4f75b2e32f9bfc2ceb0a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181366, "uuid": "b42fe984-8438-4400-b4b0-82ff91fac7e1", "value": "3072:FDZDVVA+DQ5JTOfEb18qFafjqvTwQJeWLq9NxbKejXGEjh:FzVAfqfER8qFOqv8eeWLqRb36E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628181366, "uuid": "5d74fd78-d4c4-4621-9342-73a1ec0dcd6a", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628181366, "uuid": "51b568b7-b55d-408c-ac53-1bc4947ee124", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181366, "uuid": "8b6cba15-97e1-4424-9128-79dffe18acea", "value": "FNPMocwm5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bb7e18-f5f2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1628170641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170641, "uuid": "d4caf0f6-8db7-4629-9144-10147651e5f8", "comment": "Malware payload (AZORult)", "value": "883153b68335d2a6b3956ae967f38641", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170641, "uuid": "564979ee-e6ef-41d4-97a9-b18c5e3d097d", "comment": "Malware payload (AZORult)", "value": "ab8023d2e9ab87937b572bb2e136c6003181b6745746d06e6e289e0f22e9f0c5", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170641, "uuid": "dffe4462-c92b-4a7d-b197-b84ea3c69d62", "comment": "Malware payload (AZORult)", "value": "6c0f3f6088544f07c5cc0c6e4c8a7b54376740e4", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170641, "uuid": "40e510ce-d607-4929-82ce-fb477ed5814b", "comment": "Malware payload (AZORult)", "value": "f50b478612bb8ff83f52b334e9c4a99c7858e49bf749bdb387e095795372710f70331a0a5b758e4199f0178fdd07baac", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170641, "uuid": "16d59e51-170e-4452-b314-2abd7184905c", "value": "T1C134F187F15935D6EA5307311CE9880878044ED76511D1FF7A43E1B228A1FFBACA9A2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170641, "uuid": "8c901998-1973-4803-9dba-08695d16235e", "value": "6144:9/UR/GEh8pw/MDlHOENWjxUIkKGW+ab1uvr8mLzeGI4cR4mCyewu:RSkpwkBOEN2GFu+aS64ccn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628170641, "uuid": "4f1c80f0-96c2-4cb6-ae70-053344248310", "value": 237505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628170641, "uuid": "1ad52741-3500-4322-af57-e5a91ce8fecd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170641, "uuid": "c3ace72d-2ffe-4965-929e-b5cf0b4382fd", "value": "24_AUGUST.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938f656e-f61b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1628188386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188386, "uuid": "51d967ef-d45f-4c09-bcf1-a16e520f51ed", "comment": "Malware payload (Smoke Loader)", "value": "7b62a1c07bb4ef3cdf606c51b4c1ea22", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188386, "uuid": "abe65168-d62e-4714-8245-385de557fab4", "comment": "Malware payload (Smoke Loader)", "value": "ac8e358db8788a68b31260355ead5b4017652e015125f6f6cf98ca143d2521be", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188386, "uuid": "6e6e9c5c-5f67-40b2-a7e9-426b0d8ccb6d", "comment": "Malware payload (Smoke Loader)", "value": "78c368b91137e7242df7e90803706cd993489c85", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188386, "uuid": "7910524a-7848-485c-a337-d57554a7bd25", "comment": "Malware payload (Smoke Loader)", "value": "588f0f9a324ce5c9727acbf9dc8e7cf083383ce1a7fb1843de00bc775a2493f75fd7fbd7eab6c0027c5dda74b100870b", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188386, "uuid": "f85668ba-53aa-4b48-b815-58fa2e8f7310", "value": "T15014AD123680FC73F6113570A851CAB53A2BFCE5D9215A877F8153AE6F352D29B36342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188386, "uuid": "24d3abf9-55ca-4203-96ce-12a181aecc02", "value": "5db1361d34b46103924e72350663b6e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188386, "uuid": "a9a1dd3f-bc0b-4ddf-a00f-852ceb0adbcf", "value": "3072:bMkOSbiXPEZ42nryGMD5SdDkGD0QS5Kn:15iXg42ni0dP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188386, "uuid": "549ede72-e2d9-4e1d-b71a-ecb5b8cc313e", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188386, "uuid": "b7e36d93-654d-4641-b353-13b50bbce1a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188386, "uuid": "5c5553c9-2beb-4e65-bd73-d9ac916759e2", "value": "7b62a1c07bb4ef3cdf606c51b4c1ea22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b6cbc4-f5e8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628166356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166356, "uuid": "8fff23ec-6e86-48a6-b498-c268064b1344", "comment": "Malware payload (RaccoonStealer)", "value": "091c6003f021ce92255b92d3d77ffd55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166356, "uuid": "8e53fc04-3a65-4267-9d60-6ba53f5aa94c", "comment": "Malware payload (RaccoonStealer)", "value": "ad4ca32077de360715461f9c802e5f9c31fc387daf8e8d0c02e299dd51ffc4bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166356, "uuid": "0fbf00f6-57a1-465b-9ef1-49a4128eb8a9", "comment": "Malware payload (RaccoonStealer)", "value": "e6d2f89cc7728a27e459d0b9d6a639bbbf880308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166356, "uuid": "e13ec399-8482-4945-ab15-3ed07251472b", "comment": "Malware payload (RaccoonStealer)", "value": "168a54962115ca0e376f20f8ad053e3c7dc25b2aafe0dd5c5c867fe11b219655f87b9d3cabd56da590d8f6669f3e460b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166356, "uuid": "b5191e23-fbeb-4eb8-9358-237872d093a8", "value": "T1CBB402113652C737E0B205704835C6A86B2A78B50F7196CB3BF97A9E6F612C2DF3534A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166356, "uuid": "68589539-8f04-49b7-a104-291e4df52490", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166356, "uuid": "baf4a5d6-081d-4553-a80c-e61bc1ca60f3", "value": "12288:JOoeWPBOEZ81DACdYFI3rBptk8JiwJ4Al:+8PZ8GCdq4BDkaij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628166356, "uuid": "cd54d9a8-b1c2-47fe-88ea-7c157a069743", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628166356, "uuid": "c36a13d2-46e4-4550-a1e3-633ac42017f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166356, "uuid": "93bc2857-aec2-4c4e-9759-e563f9794641", "value": "091c6003f021ce92255b92d3d77ffd55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af0e574-f5d6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628158736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628158736, "uuid": "4fda136b-7fda-491d-97c7-f405a4d7c87e", "comment": "Malware payload (Formbook)", "value": "1421f8b770cb41d7b33fe2e80c6691e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628158736, "uuid": "a6ab8eab-66f0-44db-be77-037666922c74", "comment": "Malware payload (Formbook)", "value": "ada5044d0bbf03ca1dabe6feedc1b265179b4a2623de9d6f8e2bde31f7f03d5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628158736, "uuid": "3d9e34be-593b-426b-b5e7-ebbdfad47438", "comment": "Malware payload (Formbook)", "value": "53c8ef980ff4d378ffc66ce85b7f0194f11e7342", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628158736, "uuid": "52ae9ca4-a51c-4411-826d-2184121eebeb", "comment": "Malware payload (Formbook)", "value": "e37a0f606e64ae65756f2b068d6eaee5c6e10eff8a4681e5e960df7cb0a80d19dfcef7e9d5dedfc42deff19aa7306926", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628158736, "uuid": "971294ed-41df-4e18-b148-ab0587d2922b", "value": "T1DF64E100F780CE3ED5A5067648B5C2F8663ABC755C34598BFBE577AD8F322D2AA15302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628158736, "uuid": "00866cea-4c17-495d-9afb-6c4949f5438b", "value": "a53a5d09afe43fd7acdde28b47e9dc35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628158736, "uuid": "ae1a7273-97f3-4d42-922f-bc5ffc3bfa9b", "value": "6144:hC3ZxTPGcMDjzKeml0uhCvzXHe9ZLsooBRwoOL:hKb8DjzKeQ0ucXHe9ZooAwoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628158736, "uuid": "c37d0aa9-8b50-4fc0-8773-02176db27cda", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628158736, "uuid": "e07eeaf1-9529-41ad-8906-bb18e7e91d52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628158736, "uuid": "4bb160e8-ba48-4615-a46a-2bec20fc14b9", "value": "1421f8b770cb41d7b33fe2e80c6691e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae3687c-f61b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628188371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188371, "uuid": "34172866-564b-4b21-98b6-c0152c635327", "comment": "Malware payload (AgentTesla)", "value": "629516dcbc3fef655b6408a4de1ef0f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188371, "uuid": "22d61313-6bfc-406d-bf67-7d400712bdd4", "comment": "Malware payload (AgentTesla)", "value": "ae42f98606a2dbeafa5aa9d992ba45e93349f60698af35c8f3f008d40808eec9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188371, "uuid": "e65e37eb-dea9-4065-ab99-1179a0757117", "comment": "Malware payload (AgentTesla)", "value": "b7843c701dfb21e2eeb5d89e846fc542c7d60d68", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188371, "uuid": "020181cf-f2d4-4298-99a2-ae8e93b8a22a", "comment": "Malware payload (AgentTesla)", "value": "8b6b86bdae40e4a37ccf709857caa7c38594f57b306353847e2326475d20d4f7583c12b181583caa35d3218cc376249b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188371, "uuid": "73dc6409-bf11-418a-b57a-3995dc325f69", "value": "T1A1F40128B3845BA0E43E67B41974009537F4F5289B26EB4E7FC5A0DE4BE3B15439BB06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188371, "uuid": "1b6b91bd-25d8-4dd6-b58f-d20716c613bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188371, "uuid": "c943a944-1138-4e2a-af94-516747ac0177", "value": "12288:c2xdpvZRPq4OUnH8k9SXxPXStsR2a8nLHKIZtY44XSL1baw4t2NjFV:NvZRxOUHrSXxPitzn7hbY7CLc5MNjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188371, "uuid": "308fee66-00a3-44bc-bd24-0bbe9984f3a7", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188371, "uuid": "affb0614-3648-45ee-a24b-fc3b3f6f6104", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188371, "uuid": "6853a176-3439-4235-87ee-ab477fada0a7", "value": "629516dcbc3fef655b6408a4de1ef0f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0a2b93-f5c8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628152829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628152829, "uuid": "1791e34c-53c8-4551-b073-30612bbaaf7e", "comment": "Malware payload (RedLineStealer)", "value": "ca4ee62a55322203b2e0c5081a544603", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628152829, "uuid": "29f44b4f-6d68-468f-a10e-15ef90a906d9", "comment": "Malware payload (RedLineStealer)", "value": "af11c77941022f0efc33a3ebdf9c43dd4c2ffda084ee26522909c9ad5f06d513", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628152829, "uuid": "ffe9a670-d675-44fa-9e51-cb2e4cae392a", "comment": "Malware payload (RedLineStealer)", "value": "8369cf9a19a4cc0dfa16818fac162103edd69370", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628152829, "uuid": "31415d89-c8bb-4e2b-a467-a35b2a88c1b9", "comment": "Malware payload (RedLineStealer)", "value": "74d1eb80b7202fb97a3bf8373ad39f55a550d9ef18cc56abbddc5388fc746e5d314b12e6d137a8cffd13a0b559001f5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628152829, "uuid": "a2665412-e840-4204-aad8-b92846702fc1", "value": "T1ABA34B2563ECC62DF3BE0B356470092A07F1E08F6412E75B4EC174EA2E767826558AF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628152829, "uuid": "4469c797-2844-44f4-b52e-c2488a746504", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628152829, "uuid": "e45e1e1b-e7dc-480f-97c3-dd444d090d27", "value": "1536:2m386AEAVvSBj0HrPjcTBqQz77Hgbue7vGuvOyAsd3ei1xQeTExkG6WAaoigt:2i86AdteCQz7c3Gumyddvsvxe9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628152829, "uuid": "b2e5d36b-4008-458d-8a54-11ab4e817460", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628152829, "uuid": "d968890b-fd66-4a80-bce3-c9f27177959e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628152829, "uuid": "da77e2ee-975e-46f5-84ac-9fd4c513f201", "value": "ca4ee62a55322203b2e0c5081a544603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79de08d-f590-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628128854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628128854, "uuid": "3f4469c7-0ac2-4d12-a3b7-9ee194bcfeb0", "comment": "Malware payload (RaccoonStealer)", "value": "6bb2444563f03f98bcbb81453af4e8c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628128854, "uuid": "8b983534-f1ab-4b5d-a4f6-8c0d6c44cb79", "comment": "Malware payload (RaccoonStealer)", "value": "af1beafe8b2042586f291bd09192e420349c87bfaf48233c9ae5ceae4b19df4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628128854, "uuid": "d2a856fb-ca91-4e38-9d10-de34ba8040b5", "comment": "Malware payload (RaccoonStealer)", "value": "97f7d6c15d2a1cd34d32e6d6106fcf5e8a0515ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628128854, "uuid": "28ee36b0-c852-421e-a8c7-64b720632f68", "comment": "Malware payload (RaccoonStealer)", "value": "d9fdc632737b24ce07645883c230135fbb8f152170c601ab57ab5e3e1a0d30b7809a010e9db4c87ac077d757ab4d5fcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628128854, "uuid": "07fa8414-1aca-4777-9968-32215cbd6025", "value": "T1B0C4E0D17BD23A4FC5A6427181D34BF23DB4456A399A4C6087F2A61F8CA73C2F61E9C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628128854, "uuid": "2c47a904-c6cc-40ee-bbc0-727cb2d111be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628128854, "uuid": "3dff5b6e-7149-4386-acee-75a738beec3b", "value": "6144:EbcmFgkJchzvcykzqib3gnPNZFXRu2kNOm9u2uC/rQrqQTWg/otXM566wOGrc2ur:df5vcZ3gnVZd3OOm9Fd/rL2qsdG5ufj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628128854, "uuid": "d9ace9b6-e008-47dd-9fb1-d98b95d60154", "value": 550576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628128854, "uuid": "ec632ad1-d3c0-4354-9b29-277b975b96a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628128854, "uuid": "828934a4-49d6-4d5f-a365-2920673ed1d3", "value": "6BB2444563F03F98BCBB81453AF4E8C0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d24e67-f60a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628181174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181174, "uuid": "501c777a-49d3-456e-aba5-1a65ac9d94c0", "comment": "Malware payload (Dridex)", "value": "6ac4d91bc412bcaa719b91ee5a63c33b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181174, "uuid": "8676b4de-0306-47b3-921e-03390fd096f2", "comment": "Malware payload (Dridex)", "value": "af8cc3de3c7c149a1f8e0d5d7530762cf75754547866f2da550f2d350ec315c7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181174, "uuid": "087b060e-5be8-4111-8c38-21c50cd34922", "comment": "Malware payload (Dridex)", "value": "ea6810f38b109606d1661296118f7f68fa6432ac", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181174, "uuid": "8811d876-d3f4-4b7f-882f-4167499ae4b0", "comment": "Malware payload (Dridex)", "value": "c5b7ab3d9714bf0d7222cc01cd98fb643427618667d6c58e4ae8fb3c08c81cb63c00311c041d40a4a14dc4d4a06b0e04", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181174, "uuid": "385b45b2-71d6-41fc-a5d9-4e4edcb37e6a", "value": "T10804D042E2CE23D1DC97B43248FC262924F05444D85ADCFEC995EBACD7E1F574A64A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181174, "uuid": "2c4f3bf5-219a-48f4-8967-7ef0c397f6e4", "value": "6eb7ecc6c2e948f718b1179f888ea193", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181174, "uuid": "e5d80206-1243-493e-87e8-3d5fe514c275", "value": "3072:QcYhzpn9z75jWpmrL3gA99hXkKsorn+AOr4RFjvaT:QcIntom33RDvn+RrOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628181174, "uuid": "96c64b0c-bba8-4078-9fb1-0cced2bf4bd4", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628181174, "uuid": "3960d693-d5e7-4fc6-860a-9e6cfbf4cafd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181174, "uuid": "a844306c-e81f-4434-a4f3-312390263c01", "value": "FZl6CRinAs.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20fc766-f5c6-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628152037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628152037, "uuid": "b03b83b0-8303-40cd-ad37-bca1bf14c67e", "comment": "Malware payload (AgentTesla)", "value": "f9498f69bd30eae4621cdefd49b2532c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628152037, "uuid": "18c725fd-605f-48c5-99a4-29dd785e1242", "comment": "Malware payload (AgentTesla)", "value": "b175b47baedbb3fca9f91e253535b99d735af5e9ea14e9644b2ce4851f8849ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628152037, "uuid": "cc999683-4e0a-4baa-b6db-44e06179f78c", "comment": "Malware payload (AgentTesla)", "value": "414a58addfb034a4aba06bfc8d462644216388ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628152037, "uuid": "399fe254-e060-4ca8-8bcb-ca5be6e28ff0", "comment": "Malware payload (AgentTesla)", "value": "d89f17ce3a3467b385c48e0cc96cb77a75b7dbdbfd689f8f50744a2598fddc38047e71f6f494a4b32c033bf0a151cce1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628152037, "uuid": "ac6c2c9b-7f0b-4572-a6d6-98cc6e28742e", "value": "T15A2501067250BF01D7D85B70D6C394294BA7E6A362B6E74B3E887EE43D41234DB4B386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628152037, "uuid": "be8b3e4a-69a1-4319-93b8-90c6ead4399a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628152037, "uuid": "eb975247-ea7a-432a-a821-77931d107445", "value": "24576:intTlzbnqJxP17gT7JfES8IbQXv/lRRbrX:2hVb+5VgvSMQf/lH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628152037, "uuid": "84b1ab55-580c-49fa-ac7f-318a331067a8", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628152037, "uuid": "2b77b645-cab1-49c9-932e-37dd38e26d13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628152037, "uuid": "e09b8f49-b987-4979-8063-c0e8f2fcb5f2", "value": "New Submission.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25741bf-f5e0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628163071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163071, "uuid": "1af0e31b-4fdd-4d7e-9358-13cfd07244aa", "comment": "Malware payload (RaccoonStealer)", "value": "06e6fbc9fbf752c5b133d03fb1fb0e7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163071, "uuid": "2d2c8a71-b82d-4553-960a-0240a3c17dc9", "comment": "Malware payload (RaccoonStealer)", "value": "b1f38f5cd07a1eb5ba0af0be636be2d3414e54c51d673044a3626b257249f39d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163071, "uuid": "f9bd8530-9715-4ece-8a06-5f65cce23487", "comment": "Malware payload (RaccoonStealer)", "value": "92197e2a4df26ae1413f7f6db6506f8e388f55f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163071, "uuid": "3b417ac6-66f6-4b0d-929a-db901c666c9a", "comment": "Malware payload (RaccoonStealer)", "value": "7bbfd01b8a0e6e116ae90f1b9dd1a08f75bd2bf4ff823ac3782dbce16597a311df59effe4f59ba65e3b299f3a2b6e4dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163071, "uuid": "441d2763-c2e7-4a82-9e0c-1ebfbb837a9f", "value": "T147B4F1223A92C777F152457088F1CAA2A63978705C35A9973BF1678E7E323919F2D307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163071, "uuid": "ab739899-5457-4a4b-9bba-6066ff2282ba", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163071, "uuid": "53b4174e-bf9a-4d2c-99cc-3d1a67105774", "value": "6144:RxAD/T94HAiljyPt7l3KCfkqK9mqh5KaxQjMhI1uHa3TBSmebUmfD+aunEmWHwA0:qCMGbmqWaN2173TBZeb5unNWQAeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163071, "uuid": "a5b52dcc-4914-4fb4-a5d2-db877a477e97", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163071, "uuid": "dd25d1f2-f624-4447-95f4-005c763e8847", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163071, "uuid": "a3de6e53-f242-4e19-ab9f-cf2984898ef2", "value": "06e6fbc9fbf752c5b133d03fb1fb0e7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75ee2f4-f5e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628164072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628164072, "uuid": "d01311af-b24c-43ce-8928-bc54b71dcf15", "comment": "Malware payload (Loki)", "value": "d07fd206bfadd24bc7e4939c7b24e098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628164072, "uuid": "eb95fda9-e599-41ea-b8fc-ba46751b8ccf", "comment": "Malware payload (Loki)", "value": "b236304dad4fcf402b8dddc467038cbaf623284155ccc5671c972f57d238e088", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628164072, "uuid": "aaeae524-4d9e-4168-83f3-029bb0c3798a", "comment": "Malware payload (Loki)", "value": "e829b677f7231c1cf5d544deb6da1a2b2a5bc5ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628164072, "uuid": "7f383a24-95f4-43d8-b1fc-17b764f1c6ed", "comment": "Malware payload (Loki)", "value": "dfb7f89d5dbe0605f6ea59b6a5d02c331634f433adce3e0f1da2c61a7cdec0dc0e5c18e0b6296da3eda3db18b437776f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628164072, "uuid": "e683f20d-ec82-4469-a5ce-ac867cad101b", "value": "T15264F105B9D4A173E5A665305A24DA60073EF5310F302F9FBBE863798F112D1CA36EB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628164072, "uuid": "4e5fd7ff-5d76-48df-bf0b-796c66a524a0", "value": "7f3a4a0e96d9bcc5b3425ad3dca611da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628164072, "uuid": "3eb66fc2-d24a-4881-96bb-115eb05e85e3", "value": "6144:zYrf0xh3Hfr5YwuLpVvIssmMsvGOBQ5B+e4RYgcEppaL3hdJKCjRX/:8rf0P3HD5YOs3IspR5cEgxFjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628164072, "uuid": "5a7d57e6-f39e-4270-9a23-74bec00c427d", "value": 334977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628164072, "uuid": "7fe78880-ffd3-4a79-9476-207f08d7e5f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628164072, "uuid": "d9c8a9d5-2da1-4e09-8b20-07e43db6c98e", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "789f695f-f5f4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1628171590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171590, "uuid": "99581cd2-32db-4bf2-a9d9-d2ad360f2810", "comment": "Malware payload (Vjw0rm)", "value": "883d87e7b34ac592789086eedbd6b42a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171590, "uuid": "7bd58bf5-4000-4061-bef2-25e439ec5847", "comment": "Malware payload (Vjw0rm)", "value": "b33cba05272e309fcc4be1b2fc07c719eaa0118c28f14f9636431f1b0d844121", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171590, "uuid": "abc5828d-89d1-4d47-a544-7e1799e38eba", "comment": "Malware payload (Vjw0rm)", "value": "dc4c1dff91b1955f9ff83ca9ad6bb06329667814", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171590, "uuid": "b8712729-1ec8-4baf-a3d8-36bdafaf5d91", "comment": "Malware payload (Vjw0rm)", "value": "5b477b3e8330c79b3ae05c8f2140f6b5eff28c384f50e4c1323ac5a90b39ef289a72dba0467f8fb4c7d5fbbdf4780d62", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171590, "uuid": "8310cf2b-b9da-45f6-a827-1a2300a1b0b9", "value": "T1B2A29DD2AE157E8CFB78144249FEEE2D17EC83839810DC4D3923D50016E2D4AB66E6DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171590, "uuid": "d7ab4a8d-4fcd-4ad3-96a7-0fa142de126d", "value": "384:KjxC/7U+wHOfpGPD20Xbxm7k8+M5rOPw27Dkf+U4Rn+PVCJdSv4VKMnXTi4Ap9bF:h7zwHORGL1m7k8+wryreus4oMnXTi4A1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628171590, "uuid": "0595bc6f-0a6d-40c0-86e1-1239fc79d656", "value": 22574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628171590, "uuid": "c796ffe8-288a-47c2-9b27-f81f41ab7137", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171590, "uuid": "5054d327-e3a6-4f43-8276-386635a21876", "value": "Company Profile Shelton 3.5-pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b1db51-f5c1-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628149765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149765, "uuid": "3524ae05-891b-41f2-9e58-f3ee2dca1f08", "comment": "Malware payload", "value": "38daa65155587e7fea048f60ab55ee6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149765, "uuid": "6ad77d5f-ff7b-48ec-82b1-d955c9d25ad8", "comment": "Malware payload", "value": "b3a2bc42672492c4a0d3a7fa4f0ad1352f3ccbc245903fd6010079903656f884", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149765, "uuid": "67ace282-a80a-44a0-9105-af88bdad3278", "comment": "Malware payload", "value": "dee0ebac7bcd49109d56a896d12dbc142e46f3db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149765, "uuid": "4fbdf703-3e14-4812-b435-c490f796fbe3", "comment": "Malware payload", "value": "4e389f3cfb59d463fb33766cf68b3fb49dda6f3b21542314dee7479344a043b8c10dee7b5fd9c8a2bc32a0f492671c88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Knassar DK ApS", "colour": "#9E6EF1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149765, "uuid": "cd34a630-defd-4275-b345-46327fe54e8f", "value": "T14536123FB268653ED46A0B3246B3D350987BBA61B91A8C1F17F0091DCF664A10E3F756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149765, "uuid": "da69af0e-5cd7-4ae8-a3a5-e9c4b3e450fa", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149765, "uuid": "ed26b465-fb5b-47ff-b9bf-7b985230a96e", "value": "98304:8SijExiybDRi7Eh6M4NnyWrsh85GraC/MDkr+DidXvh6d204OOR5qUf:GExiWR1kMAybhRmpLgJ6M8YYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628149765, "uuid": "ece735a2-9ea3-4a54-952a-283c2eaacdb6", "value": 4968336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628149765, "uuid": "da36b13b-b417-4242-ac12-36d0a736f58c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149765, "uuid": "e626e6ab-4c2a-483b-8137-a2e6d572a9ae", "value": "b3a2bc42672492c4a0d3a7fa4f0ad1352f3ccbc245903fd6010079903656f884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64575225-f5af-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628141921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141921, "uuid": "89f22888-4212-4ece-af0a-a4c8eecafe77", "comment": "Malware payload (Formbook)", "value": "369e1851186d2e818147b765ff6a1cea", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141921, "uuid": "d7b444a7-59ec-4538-b82d-764335e9546c", "comment": "Malware payload (Formbook)", "value": "b4c614bf403f35f5b360c419580bd6595783c8d75d5b16daa4824a7787596b3c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141921, "uuid": "930e567f-8652-4a9c-a15a-a9ef5fb00f42", "comment": "Malware payload (Formbook)", "value": "6c55890b3f749d93d2dad831a180f440aa186ae5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141921, "uuid": "0a34e3e0-774f-409f-8956-44a1782b91fb", "comment": "Malware payload (Formbook)", "value": "266ab1a3c97ff73416e03ac37eb639131b3fce0752f779793a0e4c5b996bbdc4e024f6ecd8e0b16eb770218cbed906c4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141921, "uuid": "f9c8a547-ae57-40f6-9dad-0f675ffbb2ff", "value": "T14DD42355C367AC6E7B6F896F07762890DE65AD23F8FD3E90689C0301EED2E20891CD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141921, "uuid": "0f700c2b-940b-4d20-9996-c9a64799edda", "value": "12288:43dEb8sESBp+TNsq3h70mZxbGxzdWRJINeU8Kq2HSwctFP7c4C:0Eb8sXos4h73xSgRJINdzctFPHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628141921, "uuid": "f7cf0c20-cb87-47b2-8cee-4fefcba4b16e", "value": 655678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628141921, "uuid": "641a775c-f068-4ffa-a6bb-c4a5d326a23b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141921, "uuid": "c30bc7da-f972-444d-a7ba-bd01db98281a", "value": "Swift Payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2e6440-f5b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628142575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142575, "uuid": "ccc8f6f1-4a44-4767-b8c3-b8b76800c631", "comment": "Malware payload (SnakeKeylogger)", "value": "01c5a9c25d0845676b9cdf936b2d0ca7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142575, "uuid": "2b06612b-72b9-4613-b13f-740ad660861a", "comment": "Malware payload (SnakeKeylogger)", "value": "b57bcde0c16936851d14d4c44d47263bbecdd524b0d7140fce2bb8fb3b4a47a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142575, "uuid": "bc6118c7-61be-4346-ad7b-11f1d8cf8b15", "comment": "Malware payload (SnakeKeylogger)", "value": "deee8c642a88c6ed77e494ab76626b7cb6c7e768", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142575, "uuid": "1f86359e-6315-49a0-9a2c-7fa6dcfd016e", "comment": "Malware payload (SnakeKeylogger)", "value": "728e08b106371b574b8673642a9707a11cb9d18cc85b9417b974c263a7f68a810bf81d850ee48ab507aff84b1077a5f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142575, "uuid": "258411ad-3896-4c13-ace7-ed091d88a672", "value": "T147257C2229EB5089F3B29FB10FC4F8BE4A6AED73561970B934C11F47A7329818D51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142575, "uuid": "ae9854fa-8f5e-460c-873b-35f63cc7a06b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142575, "uuid": "beee3548-a1db-4638-8754-979166a7b588", "value": "24576:5o2A4dQvEoC1p3Qtq/h3740LjD/NJKaoL:mbxvhC1p3xjXpJKlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628142575, "uuid": "77783670-0063-40a2-ae70-f53068cae854", "value": 1049600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628142575, "uuid": "4ea92b95-e24b-4662-919d-d31b061273e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142575, "uuid": "9df9ccc1-e3c3-4acb-bf76-026ae6ae31fe", "value": "MACHINE SPECIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0bbd7a-f600-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628176859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176859, "uuid": "8bf34ae3-5c37-4168-ad26-0eaa72bbbe30", "comment": "Malware payload (AgentTesla)", "value": "39bcaf98fdba87785d7fdb3b3fe88a41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176859, "uuid": "5417413a-d5ac-461f-989a-969cc1b9ebd7", "comment": "Malware payload (AgentTesla)", "value": "b59c1cae2b7d87b625d60313e2f308ffa1d7fe712581f34936ac2f3566d16f80", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176859, "uuid": "698c8dbb-f2d0-4db3-83b1-a8946ca3fc39", "comment": "Malware payload (AgentTesla)", "value": "4d130f7da839b499166f72d527233e0424141050", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176859, "uuid": "5dca4957-56a4-4409-8af2-8c334d037bb6", "comment": "Malware payload (AgentTesla)", "value": "993a77a363972e324ad9eaf952d9996f886ea2985a3f12f1dd7ec8acd60e2727e392bc46035b8fdaabd205966f9b7cd1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176859, "uuid": "64be2989-a663-446f-88e2-af2582c32a55", "value": "T15C25C411DBDA0089FF62BA774BC4F77E477BA9F3150F6CA524E226464232580CAB4B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176859, "uuid": "3ec27879-9749-4471-bff1-70e0d463e018", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176859, "uuid": "f6b38f6b-f2a6-43d3-aae0-9ebbbb7ad904", "value": "12288:JajvLAVZeoR65AXwgFvuSSfILHbUZxkFWUMuUsy+8CeJ2hCgMNlXF0l0o/mT8KA3:2oR6qgm9BJEvVwNIqeo/mpNjXHKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176859, "uuid": "1f2a6416-acc8-46b1-b8b2-6267e813a5be", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176859, "uuid": "2b9f924d-711d-4708-ad25-cc3ebe3fc054", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176859, "uuid": "99eebcbc-7ef9-41e5-b6c1-a9693052f6da", "value": "39bcaf98fdba87785d7fdb3b3fe88a41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636a2238-f5b7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Heodo)", "timestamp": 1628145356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145356, "uuid": "30239e04-7ccb-4000-b3a2-572f0cc13c96", "comment": "Malware payload (Heodo)", "value": "be87880730e635231f265b9d066de3d5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145356, "uuid": "b98447d2-4462-4e9c-b50f-377e1a2a7808", "comment": "Malware payload (Heodo)", "value": "b5fd106631bc5d774eec316f178d32534463d1b1279493cbf34466ec2f527298", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145356, "uuid": "4010535f-a1db-406a-9425-de0a30179fd5", "comment": "Malware payload (Heodo)", "value": "7b94bfbe567c190d294a06911a182720136e14c1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145356, "uuid": "34f38113-3fca-4eac-addf-513e3ba95b35", "comment": "Malware payload (Heodo)", "value": "4cf5a9d17643c196d3ae6a3be857adbe0a474261a738d8bec85be460ee62a08f78f0a21a7566c454107afa4e349e7e8c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145356, "uuid": "a7c6a07f-d97c-4650-bd1e-5e3c14f652a7", "value": "T158B402D13AA6C672F51101704831C6A66B6A7CBACC7095873BB1B79E7F321E1DE2C316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145356, "uuid": "9145feeb-1756-4f85-806c-cfb48ece1010", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145356, "uuid": "2a025e68-8ef7-4d26-b090-e363c6cfa996", "value": "12288:cmeEfnhq9Q7GsjAtybhZPt2dFBisY9BAX:cD4nhq92GyfvP+WvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628145356, "uuid": "d3e10fc4-5de2-431c-b939-e80057c31a38", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628145356, "uuid": "a1704bdc-7889-4530-8bfa-08181cc76cd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145356, "uuid": "cdd0160e-3fc7-4a5e-a885-4883fd435e59", "value": "be87880730e635231f265b9d066de3d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e936b4-f5b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1628142383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142383, "uuid": "bd5d459a-9753-4f97-b70a-edd8558f19a0", "comment": "Malware payload (CobaltStrike)", "value": "03670fc52aa24fa82d2fdf0178b3d76f", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142383, "uuid": "9d73502c-9335-4c72-b6cf-ce1df4cab2f8", "comment": "Malware payload (CobaltStrike)", "value": "b620e1d6736e5951a319a1af7e17d77f46929d200532dbee0d41b15f4318fc7d", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142383, "uuid": "0efc99c6-b851-4669-95eb-bd40361ffc76", "comment": "Malware payload (CobaltStrike)", "value": "d308cc32317c3caacaf9305bd7569f55561a8582", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142383, "uuid": "b4eb0380-9aaf-4dfc-841d-c413c5880eaa", "comment": "Malware payload (CobaltStrike)", "value": "a8bdef51f8261e1a8490db70acd537a0628e38070472b2748545f44e4f9fa0baa3b7df02dec3949edd52f79dd25d4850", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142383, "uuid": "739417f3-ab58-4ea9-87db-140b6b18ca4d", "value": "T1B324DFB9D8E19CCFF7868771C5A57EF26C618283CC47A19BF840BF34156242E6A20D9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142383, "uuid": "94c79473-463e-485b-a394-e4cfc10648b2", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142383, "uuid": "502c7e2b-9d50-4a7c-8e87-3e980912d713", "value": "3072:Lty6NsDIS+V7ZDIMugN/HsdI6mwTk1Z02rdS74ljurtFat03xLVhOdnJK/wJ0E:oLDl8lIE/KTk1vljoFat03dWJe9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628142383, "uuid": "bbc27162-f428-4395-8bec-55dd77c9f6db", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628142383, "uuid": "4a35fbfe-640d-4d6a-a35a-cf12a32bf95e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142383, "uuid": "b7580b50-ccae-4a4b-9047-293958354a28", "value": "03670fc52aa24fa82d2fdf0178b3d76f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47b4286-f5bf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628148954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148954, "uuid": "c6113842-2450-4fb6-9724-70697f31d99c", "comment": "Malware payload (RaccoonStealer)", "value": "f67f17d54de5a1bab70766d6f9a124d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148954, "uuid": "884e6693-e464-4117-b291-9af3da63ae3b", "comment": "Malware payload (RaccoonStealer)", "value": "b6c2dd68123cf6d1066a1a7321f6401432ef32c0a81637b0f2ca4ff57fab7e00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148954, "uuid": "1e0ea7da-85be-41af-98bc-b93cb6736664", "comment": "Malware payload (RaccoonStealer)", "value": "4d9510346e0519c2927e08a06fb517c1dab4ffaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148954, "uuid": "f4fc0f4e-b9c7-4b23-85c5-5c5eb5b4768d", "comment": "Malware payload (RaccoonStealer)", "value": "f7391adf2901033f68590f6aae7fb4addacfb985bca3a01489df80911cbd15fd1caf95809b659ece5b3d8abae45c90a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148954, "uuid": "771edde8-3e73-4c8c-a690-40808e6c57d7", "value": "T1C3A412023693F433E066C9704CBCC7B4AABA7C7449240A9F3F86576E7E766939E51312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148954, "uuid": "59240508-9bed-457d-9f0c-c98bccb2c25b", "value": "2a9c1ca66125aeff7a1c36242be63d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148954, "uuid": "2ca81492-a357-4908-ac13-93f5227f5dc3", "value": "6144:I4BSL1D6SyIuKOP0qfBN3RaLAUwZ+Fxj8N4KtqyBbRx5tzSIXneftm3ykZIpq6fh:ISSQSjHOP04B+wZ+svBbRx5tGIGjNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628148954, "uuid": "1a8f6a5a-ba76-45ea-b9e7-69352f359cbd", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628148954, "uuid": "70b238ec-9596-4ab2-be78-6d27115527c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148954, "uuid": "4ea136a5-5ad7-4b13-b51e-d5a909267cc3", "value": "f67f17d54de5a1bab70766d6f9a124d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84be3dde-f61c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628188791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188791, "uuid": "3b9a5b74-c437-4963-96cf-98303bf3c16c", "comment": "Malware payload (Formbook)", "value": "3cbb3413f0326aba622bee17f556a293", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188791, "uuid": "471d84e6-ea67-41a6-a2ff-6573db63bd56", "comment": "Malware payload (Formbook)", "value": "b7259e9f3050809248c04326cc3af49d4eed3a0bd19c0905b32993a9c219bd3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188791, "uuid": "bc65413e-6390-4295-9d65-c3a533b3a918", "comment": "Malware payload (Formbook)", "value": "b88d01c455322fd6d2d1e1dc04f691de95d044b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188791, "uuid": "4b1580d9-bc40-48e2-acee-9b527be625f2", "comment": "Malware payload (Formbook)", "value": "6d22c11661cb9625a934213076e679e9e67aca47c5f9a17004e1b3cf5d50a38a5a491a6b8f72c8d5bcc2fc40226fbce5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188791, "uuid": "4338fa39-f2bf-4c8e-8e98-fdb01662688c", "value": "T1D465294D7DE0718FF457887DB6D81CE1A560BC2E8B0AAE939C43B3E9550C54ADA370A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188791, "uuid": "1c4d6d9e-74b8-415f-b5f5-5d0e7394c5d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188791, "uuid": "ce37140f-e19e-42b2-b941-43837657d156", "value": "24576:wmIkkua/yFuKR/lvecdFBWKUaLrIpBOJAs8CN/NcJWGEQuiNB/eJyM:wHVua/VlpB2DlcJWNQuiNB/eQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188791, "uuid": "77ee582e-ac97-4e6d-a84c-c8ce0df7c4a5", "value": 1504768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188791, "uuid": "d5868aa5-c596-41e0-ab2a-19ef3a33e8d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188791, "uuid": "e8736a9c-63b2-4d51-a8b8-a167fd3df401", "value": "3cbb3413f0326aba622bee17f556a293.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c937df59-f618-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628187188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187188, "uuid": "e0dd85e1-a9ea-4edb-bb42-dfb4f30357c3", "comment": "Malware payload", "value": "8ff555dea1402789ef19afa7efd06c76", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187188, "uuid": "3256c550-2d2f-42ed-96b9-8565c4448a01", "comment": "Malware payload", "value": "b7ce2df21b8a9e8cba08e86700f435d42937b07d2103d9191767737de67ea82b", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187188, "uuid": "7d61d27a-39dc-400c-be01-e3e2dcb8cbcb", "comment": "Malware payload", "value": "c6113a1479efb548f7120523174560fb29ad9cac", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187188, "uuid": "e8e90cbf-657f-496b-ab33-160d4fd6664e", "comment": "Malware payload", "value": "3ef51ff4bd191b7eb30f8a7ba1bc940d3253e0b82e21032a5958ac92a7e1070c0e6814669dc95c572ffac015a47262a1", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187188, "uuid": "252feb5a-91e3-41d8-be5b-f0e314dd9cdc", "value": "T125621908FFE99376C5FD5EB11C72A20003F9D242AC22EB6F5DCCA46A6A53BC546247D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187188, "uuid": "5663f4cc-15bb-4a47-a4ee-fbb3ed59533b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187188, "uuid": "68cfb379-0500-46d2-bad7-134ba34b456e", "value": "384:HcjBimsTCG1i6lqobCa9oCAt9pTWuy/y:Wsk6TbE5KuyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187188, "uuid": "9ab800fd-aeda-4ece-a282-1364f401b7f4", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187188, "uuid": "ce1a1400-ae33-48f4-bab4-37828c2017c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187188, "uuid": "af92c67e-c5b3-4e6a-a3a8-d887d7d93878", "value": "b7ce2df21b8a9e8cba08e86700f435d42937b07d2103d9191767737de67ea82b(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def497d2-f63d-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628203115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628203115, "uuid": "aea86c95-d2bd-4649-a449-683d00fa634e", "comment": "Malware payload", "value": "d2212f9d1b3a2d5765c6c8bf841a2c4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628203115, "uuid": "85e141f6-a8ba-4959-b747-f52da6c591a8", "comment": "Malware payload", "value": "b8815cbd58920dd1cf0d7cab8b2bd6c5a58624d7ab187f762a6bd83398096fe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628203115, "uuid": "924a4c38-2ae3-44f8-bc44-5390091a1804", "comment": "Malware payload", "value": "e2f1853371bf8b79a23f02e0bea1073134788d0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628203115, "uuid": "f281d781-8349-4c74-9d21-e4322fd9622d", "comment": "Malware payload", "value": "a14ca19a94a07e399e24c0ca39b47a1d89635e9fc595ea516ed8775e763150ad0834ee7dbac5c43ae46bcdd5e144a007", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628203115, "uuid": "fac3c544-cec8-4765-b1a7-40865075a81b", "value": "T103C49E823145DCDAE04329F258AFD57060B97D9E8164C60E3743BF2BA5E734234AB79E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628203115, "uuid": "28a44077-0d6b-490c-b3c2-f0cf82ab51c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628203115, "uuid": "68c7113b-6842-493e-9127-bd74e3d052a8", "value": "12288:aJdTLr1ZIK757Zr/PYOOFSVjchi98HSi7qpK:aJRLFjP2SNvkdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628203115, "uuid": "9c14407b-13d2-4e08-962b-eaf7c3856b75", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628203115, "uuid": "35aa5d53-b593-4979-aef7-d4c51528029a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628203115, "uuid": "d57cc49d-4ea9-430d-8b66-c74cca496089", "value": "01_extracted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2234929-f628-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628193994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628193994, "uuid": "42839069-0971-4c10-8c08-266f2f5be44b", "comment": "Malware payload (Loki)", "value": "dcf46745aa81fb749e067f73607744ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628193994, "uuid": "985ca351-9081-472a-860f-0fbf3691b3fb", "comment": "Malware payload (Loki)", "value": "b8992951c68760df7e72db19e76ee35e1bc3379119c6ff4ddc47da461c4b41f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628193994, "uuid": "ba275b4b-5716-49c3-a7a4-1e9bda629f01", "comment": "Malware payload (Loki)", "value": "20b5fdcacc4f7eacaeca306e5a5a725e70982fb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628193994, "uuid": "4296ebd7-4bba-4196-98be-5d553d1cf7cb", "comment": "Malware payload (Loki)", "value": "8a699b12a9b79c40b7499ab42a3c2b0070db9079e0d7df061461db8e061f9c214a7dfefd5ecfcf99971a668778b02cca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628193994, "uuid": "528f4675-e4f3-4973-8fda-bf1e085bf283", "value": "T175E4013D93508FABDD3D25F8576201421BF8E1543B46F7E6BEE8A0E60AD239D03C2956", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628193994, "uuid": "9d3299f0-9b31-47b7-8b28-ebe8fb324b90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628193994, "uuid": "ae6b224f-f56e-4fef-bb7c-0a9147dbf79a", "value": "12288:GtRulXTWAFjMaqD3UZmJ44yXJJOk6ZfFK0sDGKV8t1t2NjFdFZ:kuvFgaqA8JzGJcpIJV8t1MNjTFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628193994, "uuid": "06aa11c3-ae28-4373-b080-49993edeeb05", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628193994, "uuid": "95657605-1f14-43cf-81ec-cd2ad62316e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628193994, "uuid": "64ab0ec5-ba3a-4f47-9dc4-3ec0aa4ed6cd", "value": "transferencia001.PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c7deb2-f5af-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628142165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142165, "uuid": "aff30fc7-d1b1-4901-8e37-6d37672701f9", "comment": "Malware payload (NanoCore)", "value": "890b7c0f09c0bb7f8d539698bb1643d6", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142165, "uuid": "51903dde-e7d7-4ca5-94ad-afd3b056a022", "comment": "Malware payload (NanoCore)", "value": "b911f32ff4fe71ffdabcaefac949d37b087fc16faaa2cf450b56b2f3f9c14a8d", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142165, "uuid": "2c982329-95e8-40bf-b954-1483efc5bdca", "comment": "Malware payload (NanoCore)", "value": "11362936bbcf9a6f85b28f9c8a01a2d23cc32475", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142165, "uuid": "3beb3ea1-1f8b-452f-aa15-eb413fa3e1b8", "comment": "Malware payload (NanoCore)", "value": "59f3baaaceef4b4d7dc2002b95a0e359eb7cb88972b10c2e545ad9a95b86d50f2d699ebf97976004c9e3f2d3e1474a9d", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142165, "uuid": "adf96431-ea23-4739-ada5-9f6d9749dcb4", "value": "T1A2B412102599CF50C78F853394278051676B5D82CE22EBEA748FBFC277373856622B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142165, "uuid": "3f9f144f-12b4-48f8-9f84-36369e31b255", "value": "12288:Z2Z3+dCHzW99m/YiZGOVcL5TSuCdmVofGRQNA:Z2Z3+o/qOVclGuCdmVofGRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628142165, "uuid": "ff84f466-5e16-443a-8acf-f73a7f93c853", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628142165, "uuid": "b6643c29-c950-4b7a-b413-b0c9d3621516", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142165, "uuid": "94b4e158-f4cd-49ef-8ff8-7a0e6523252b", "value": "Payment_check.pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d60b83-f600-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628176636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176636, "uuid": "48d0debf-2cdb-4776-90c9-1b460f402a11", "comment": "Malware payload (RaccoonStealer)", "value": "f97054aaa5b42015f5fd24bd6d66fb5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176636, "uuid": "4f195210-65ac-4621-8f04-fa51543d0fb0", "comment": "Malware payload (RaccoonStealer)", "value": "b987b62195f982a1b4b8bccfc559b20f96581c945b1fa3c7a4685ff8c7112db5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176636, "uuid": "c4dbc89e-4008-45fc-925b-72a19e9c3b3e", "comment": "Malware payload (RaccoonStealer)", "value": "9d5173179863c1d37138ecdc247e0c5ae9a1eb7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176636, "uuid": "fe648d37-fc43-453c-bc1f-90784dd5fe06", "comment": "Malware payload (RaccoonStealer)", "value": "9f05c153bc84fa7c2ade9094a4e7d3a3388ebc7ef3c0b41f7ccc8b45583e8e0ac82c790bfffc89a890679b344b23ff6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176636, "uuid": "953c79fb-ae66-4e94-9786-e1b37cf39c30", "value": "T17DB4F1247261CC72F056B9718896C7A166ABFC71C9749A473BC593AD3F312E39B3034A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176636, "uuid": "1c54c2a4-76e8-4ccc-b1b3-c40770bf4b9c", "value": "5db1361d34b46103924e72350663b6e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176636, "uuid": "28bc3b99-fcd7-4867-bcd0-263b8ef7723a", "value": "6144:8Vaqs32HMBdaUjwwaFOTF4A1Otgqpm5kIha+NQUYhXTtyMShcp2TNrPSBxJg:QOdxjjaFkftqcVha+Ihic0BP2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176636, "uuid": "7908bb6b-32ea-4c19-9d39-20bf6c47b979", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176636, "uuid": "c805b820-641b-463a-b9fa-3fb62b2d946d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176636, "uuid": "68f83b88-40ee-4bea-a209-5003fac11a1f", "value": "f97054aaa5b42015f5fd24bd6d66fb5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4139686-f5ee-11eb-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1628169194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628169194, "uuid": "5326123a-eba2-4a54-9c02-227227d1e26c", "comment": "Malware payload (DanaBot)", "value": "bee0fa12d96526269535f2ea0fa07206", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628169194, "uuid": "9e7083c7-3276-4de8-a928-d5e3c24c9d6d", "comment": "Malware payload (DanaBot)", "value": "bb0d46e89bf7c71a236836cf722a4f6874869527b13c338cc084dfa0cd3279ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628169194, "uuid": "5b6affc3-fab3-48b7-bd5d-2fca47b75ae3", "comment": "Malware payload (DanaBot)", "value": "cc1586c365157b66e476d4302b425b55d8b1f2ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628169194, "uuid": "97bd5201-751f-4824-a453-f394c9a7714e", "comment": "Malware payload (DanaBot)", "value": "ceed38408e66c11242443fc7607d04546ca33e59f60fe0cff55fe9f13af85d75398b011c4437a43afc5145826aa3e619", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628169194, "uuid": "0cc6e3fa-78a1-4a96-8157-e3a467257b68", "value": "T16F352210B291CCB6F216703294A2CAA2CB97B5F0CE618E7A3BE5979D0F305D1DE75346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628169194, "uuid": "538798e5-53e7-4be2-b9fc-75efaf331fa1", "value": "5db1361d34b46103924e72350663b6e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628169194, "uuid": "c053e4d9-7185-445a-bcda-f9b4b174ea7c", "value": "24576:CswyGc7/arhe4LnNoEebxedyKkShnRSIvdMSYqOjnE:R2aarhe4ZweJRRdMnhnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628169194, "uuid": "f6f214bc-58b3-47e8-aa5d-f78611ef5596", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628169194, "uuid": "df5d0a31-0956-4c2c-a768-01ecc7fcb3af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628169194, "uuid": "09412f58-203a-4fa9-b2ae-78251e112846", "value": "bee0fa12d96526269535f2ea0fa07206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1daa98-f61b-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628188350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188350, "uuid": "26440db9-23fe-406e-bb40-9a70151f807a", "comment": "Malware payload", "value": "a4579e15af982f864c88df0a1c1dbf0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188350, "uuid": "dcd3711a-d56c-46af-a3e7-29e3310848ce", "comment": "Malware payload", "value": "bc19e3e01dca70098a0d215f9ca4f7779ef62a76d2a4bfefe164dfd542035b0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188350, "uuid": "412a3ca8-cdf8-4d1a-9573-9138a440ef46", "comment": "Malware payload", "value": "ede5c14efcb9bc3d863df6289e09f47ea7c65b1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188350, "uuid": "73afe78c-3b2b-4a41-b103-16d3c239451a", "comment": "Malware payload", "value": "68617d565282d11c2c556adfa02ce1fdac4f4dd6887b1efa90029f91a260615bc645b44f863dadb3bb235e32f9bb5640", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188350, "uuid": "42506a3c-b959-4b26-b4a8-8dde01f9b261", "value": "T139C4E0B85184BF4BDF6C227A1AA0424083F995B64ED6E6673D937CF534CE685C38321E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188350, "uuid": "ddbdabab-8ee5-44f9-953c-b5bef6f82512", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188350, "uuid": "179f87b7-3901-404a-9345-454a02018f57", "value": "12288:ydv3BzKv38y51FvvpCeCqZLjkvWHBOlvbK3K2G2pv5E+t4bulI:yvKv33bvvpsc3kvWHAluK5k4WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188350, "uuid": "dad2fa76-ab0b-47b3-b2c3-37f6986964ee", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188350, "uuid": "b668b832-151e-42a5-9ffc-7d5a2bbb88ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188350, "uuid": "0bfddd24-723a-4965-83a3-3b413a3da5c2", "value": "a4579e15af982f864c88df0a1c1dbf0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a5d3a1-f5ef-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628169277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628169277, "uuid": "591f4d59-224f-4dd3-a5fc-03b7f07efcbf", "comment": "Malware payload (AgentTesla)", "value": "72ba855738ef40507e89b12e6fb0ab96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628169277, "uuid": "69938e98-1b0f-472a-9c15-1855c620cbfd", "comment": "Malware payload (AgentTesla)", "value": "bd0c6248385512dedcb4b5fc5012463cd11ae4e6e2ef2de612621b868fbb9687", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628169277, "uuid": "075a0c31-08d6-4736-b70e-7457a4609972", "comment": "Malware payload (AgentTesla)", "value": "65f3c38e1d05b683903b9729bd55e4b3cecf1bd3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628169277, "uuid": "c7a90285-f4b8-4ada-9b21-559df3d3a414", "comment": "Malware payload (AgentTesla)", "value": "152aad2f3c796028751f8ed3da8b1e49776018a071c0b2b60eac26227fedeb63b5de89ab6fc54e26c398b4f43e32c91a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628169277, "uuid": "a8cc05c7-15d9-40b4-b445-2ed8cef16cba", "value": "T1F9158D2229EF158DF3B39BB60FC4F8BE16EAE577571AB0B638910B464322940CD51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628169277, "uuid": "69bd86b1-f1d1-4c58-bf36-4da291d8d196", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628169277, "uuid": "43d1b85d-8cb3-4e2f-b45b-a960cdefc616", "value": "12288:OKfoR65AXwgFvuSS+sy08MyjVcB8dp0lsTw+lizxuXIFWemSyOpnuw/CGI3A2:foR6qgdQnT2sc+leEXI0PSykZKX3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628169277, "uuid": "6c999639-f3db-4c27-ac46-4220d095381d", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628169277, "uuid": "808576e3-98e0-43d0-8708-c445cc9d3f00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628169277, "uuid": "d6a12149-dd79-4d04-b54c-0ed8063c0dc3", "value": "Nalog_za_placanje.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b137071c-f600-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1628176839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176839, "uuid": "80c48e9f-fa7b-4732-8fee-5e93bdc8e173", "comment": "Malware payload (ArkeiStealer)", "value": "20d1831c297a9a25148c48695a38cde5", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176839, "uuid": "c65c5e84-9f66-4003-97c9-924d72cf499e", "comment": "Malware payload (ArkeiStealer)", "value": "bd9cde1e9bb1cff550575161a3d967753a8b7667fb4824fae2d1c2274f552f47", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176839, "uuid": "609a26db-d39a-4d44-bb1b-464112e81aff", "comment": "Malware payload (ArkeiStealer)", "value": "105b45fede41ff4da28a9214b102f399ffdb531e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176839, "uuid": "11c83274-07c1-4ebd-a63e-ddbdc83062fe", "comment": "Malware payload (ArkeiStealer)", "value": "2c801d0edc2148f8677d6adfbf045be51cbc758188c38172e5eb7616f08e419ab55faa035a78fa4250be69280e40422a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176839, "uuid": "ab220837-d934-4248-9dc4-03a7ebdcec9a", "value": "T1A8F41250BD87C437D252E2718839C9B5CB22A8306975CF5B2B8187794F722D2EE2F356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176839, "uuid": "01445919-50ca-4900-80be-a6881f9322f8", "value": "e2ba8e1f75a8e02687cc194905c50074", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176839, "uuid": "fc5d9a32-1106-4bbe-a71c-48a913047ea9", "value": "12288:b7eXGCAANdSq6zXgEeGnDmUVk5BymPSOsK4uFI4iZFQOUL5TrJ:b72AA8XKUBVkNSOsVubWFALz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176839, "uuid": "0e7d4098-1d78-4270-baad-f1f4ceba1a3a", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176839, "uuid": "67c73201-bcd5-4f10-9b03-c30c2af52ff9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176839, "uuid": "ee1b8bef-8ee9-47f0-a261-4e6b4215b981", "value": "20d1831c297a9a25148c48695a38cde5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d4d02d-f5e8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628166410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166410, "uuid": "5bfc44c5-d540-4475-901b-542681b9cbc7", "comment": "Malware payload (RaccoonStealer)", "value": "231ba4b57d5a783e6c82423f18b6ae07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166410, "uuid": "12ae4061-073f-4e20-91c1-077ca9164532", "comment": "Malware payload (RaccoonStealer)", "value": "bdd152bfd75db3f3d15f1b14742ffb0908da9ba9deff5281af49c9db9216cdbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166410, "uuid": "a0039346-d2cc-40f8-91c4-c374a81a7e79", "comment": "Malware payload (RaccoonStealer)", "value": "5a12adcd56f7632dc0e1b566c4cd2698d7990e99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166410, "uuid": "a8ceb82d-e670-4f4a-a0ac-6823a4472f3c", "comment": "Malware payload (RaccoonStealer)", "value": "f7b66293082cc5ba71f95c263f87fd0e935edbdae740107aad1db56348f1f896de7ea4176387b486c3e1147853b38218", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166410, "uuid": "136e7edf-44b2-4e80-ad7c-b1084f0e44d4", "value": "T1F2B4F2023A54CC36F15536714465C6649A27FCF6DB242A8A3B819BEE3FB16C2EF35306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166410, "uuid": "8e0f81fe-e57d-4b0e-899c-4ab83a6782bb", "value": "e905b204d022a4a3f9803ba3895bcbd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166410, "uuid": "759dd3b8-4781-4ae0-a059-53adeafe6ede", "value": "12288:kt82R8LAbNoM+NvavRvtYmX5vye7PPjNAMM4P3:68I0AbNoBNvavkSQe7zNALE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628166410, "uuid": "49f89414-4ac9-4608-beb7-319044d1b300", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628166410, "uuid": "a55fc009-73a1-4c6a-ad82-c739ee4887cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166410, "uuid": "42ed412a-e105-4036-91bf-4b7cd841cad6", "value": "231ba4b57d5a783e6c82423f18b6ae07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2226326d-f5dd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628161567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161567, "uuid": "0e7f4450-786e-428a-b2da-1932e9b0136a", "comment": "Malware payload (RaccoonStealer)", "value": "f532b69347eb29d7645887d00d295a4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161567, "uuid": "e444827c-2eed-408d-9f40-b69d6277593c", "comment": "Malware payload (RaccoonStealer)", "value": "bdd1c9c415b3d4d061096b1f225e8259a958afb1b3166b27415419603044b1e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161567, "uuid": "534a9026-1389-4b28-875b-7c1c19e93ec5", "comment": "Malware payload (RaccoonStealer)", "value": "a8635e918ccda82a974e949a70a0fbafd759419d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161567, "uuid": "511e20f9-ed97-4bfe-af20-eaa57da43ee3", "comment": "Malware payload (RaccoonStealer)", "value": "a11ae4c8859aab16bdbda2a79ea6f1c1ef14dd2d0a9e430ba10b26231b2bc64688a04ec12f348808b76dda1e80572a47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161567, "uuid": "0d5b59f4-b03f-431e-a7f6-f8560b72d3a3", "value": "T118B4021D3991CC76F5567AB08421C3A15AA6F871DC748A4B3B81A3AE3F343E2AF34355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161567, "uuid": "af85786c-44a0-4a84-9d2d-bfa996173210", "value": "e905b204d022a4a3f9803ba3895bcbd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161567, "uuid": "3e3bf809-41cf-4275-9608-9533a8f7958e", "value": "6144:i+Qc+sZZTDhV2gEn4Rh88W/2SPBWbYQUz2ifcc+aO0VtIsQQ/02xV0J3tPy1d2BI:VdxDXJG/7+USsc2hQQM2z07Pq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628161567, "uuid": "d3b999c4-72c4-4ee7-9c72-51c53f43da32", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628161567, "uuid": "1791dc1d-8b20-49f2-9654-538cf58cd11b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161567, "uuid": "38faa64d-1e4e-4db3-aace-91381235deed", "value": "f532b69347eb29d7645887d00d295a4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110f0104-f606-11eb-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1628179148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628179148, "uuid": "659b9e77-8a26-4335-bcb9-acef2ace3cf7", "comment": "Malware payload (TrickBot)", "value": "7c44e0a43e508476eda5f699d39a0c7f", "object_relation": "md5", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake img", "colour": "#5F189C", "exportable": true, "hide_tag": false }, { "name": "rob120", "colour": "#9DB942", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628179148, "uuid": "99c9b2cb-39fc-4192-a38e-35a8c9be791d", "comment": "Malware payload (TrickBot)", "value": "bf81ad343dce8b514941ffd47576b78e02b41c23aec991fd5a48ad00c67ad942", "object_relation": "sha256", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake img", "colour": "#5F189C", "exportable": true, "hide_tag": false }, { "name": "rob120", "colour": "#9DB942", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628179148, "uuid": "74696ff8-f5d3-4258-9530-4a17fa07230c", "comment": "Malware payload (TrickBot)", "value": "f7233d983272e37c5c74949dafbb07ff767b8bf7", "object_relation": "sha1", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake img", "colour": "#5F189C", "exportable": true, "hide_tag": false }, { "name": "rob120", "colour": "#9DB942", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628179148, "uuid": "bd696745-d9dd-4335-84e6-aaa1dddc3f81", "comment": "Malware payload (TrickBot)", "value": "e776c0022a81c794e802d728cb25011c69e3fc68f4ef87181ab9bfd36782a89e3a4309abf1fec5dec1c8b6e011df7952", "object_relation": "sha3-384", "Tag": [ { "name": "3362289", "colour": "#7E1ECE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake img", "colour": "#5F189C", "exportable": true, "hide_tag": false }, { "name": "rob120", "colour": "#9DB942", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628179148, "uuid": "a6507b76-d4c9-4a9a-94b1-528a75ca7fa3", "value": "T18CE4CF20B6E4813AD5BE36341A673F2452F5FCB0197AC683F7C4993F69336414A2772A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628179148, "uuid": "1a3e6509-e4ff-453e-b1f3-db6d197a412e", "value": "8b7fb8fc4de24822c3d2cd067d85f8ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628179148, "uuid": "a5da014a-09df-454f-8910-b4e2964339e2", "value": "12288:5bjfhtlWxycV80o3xKA3cHfnoEQOuG/ENYIm8MxxO9qrcOJz8:5bj9ZcG0CxKA3cHPoEQRjNXNYxtnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628179148, "uuid": "aba2ca88-a342-471b-a6f2-599b01d49e27", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628179148, "uuid": "da28f8f5-c17d-4a57-bf58-ce8993be4372", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628179148, "uuid": "b6f2a834-3845-4e63-bb7e-70a46744925a", "value": "dHAfdxR.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7522303-f600-11eb-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1628176876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176876, "uuid": "731eea87-9c36-4777-985a-defb61fa06f2", "comment": "Malware payload (SnakeKeylogger)", "value": "739553a72bb9c7829f3fb208ef24fedd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176876, "uuid": "2e3b026c-6867-403b-906d-0fcfb86609be", "comment": "Malware payload (SnakeKeylogger)", "value": "c20b9a9069991754dad5972ec6572f3cb3b4172a05edc2e28c2024eaa5b0171e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176876, "uuid": "af6086e6-5b7c-41c8-8077-b61e63a7a7d7", "comment": "Malware payload (SnakeKeylogger)", "value": "27825da27c3bd446db9e4effa21e6262118d376c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176876, "uuid": "d904c4ac-d8bc-4a5e-b361-3b86738ef647", "comment": "Malware payload (SnakeKeylogger)", "value": "8e9a06ac3e2d4f7d7b95497c22d2628e9dc33173139e8a03184f0e1e9263b83378a8f1d9f07d2d91c9a8980a95075b40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176876, "uuid": "3fbb4de3-4042-4279-a2a8-16e53eefce0a", "value": "T11AE2F127D30F2B71EE59507082754FEAA4176CEF9A06A03B726366A762F93DC1037724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176876, "uuid": "011b1f93-a6e7-49f8-92da-96e621f7f027", "value": "768:GiNCgAu/Z5LhX/qiN/VM+3WncTLGgG/q06YYWz:GOIeZ3H/VM+3kW7ch3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176876, "uuid": "6ba26724-9c9d-421a-9c70-feed6a48f9ca", "value": 33943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176876, "uuid": "d47132cc-8db1-4724-af64-dfcabf8d9b8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176876, "uuid": "6ffeb18b-0096-4c43-8b81-5e48cd2a812f", "value": "739553a72bb9c7829f3fb208ef24fedd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806e4d2b-f5fc-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628175040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175040, "uuid": "c1a3fd1e-d9c0-4608-ab05-28979832261b", "comment": "Malware payload", "value": "815045acf94433f870f9e6373e9c5911", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175040, "uuid": "7e85e19a-cf75-4fb2-af99-f819c5b78b75", "comment": "Malware payload", "value": "c34970993726cb8f01642faca4c48dc6c368fb138df30f26f7678f830efa5e5f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175040, "uuid": "a722ceb1-5c5c-411e-b285-3b9a02689c64", "comment": "Malware payload", "value": "4e2a674dfaf6baf2b44e8fea7986f1e90ac25ffb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175040, "uuid": "3b6dccd4-42fc-4160-b99f-b673c0fc48ee", "comment": "Malware payload", "value": "ba8758f15da6dfded65275c082b9421532c05812a0655f8ae5a5550f661c7c7abea82cf155e269b46332b41708e1ef64", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175040, "uuid": "b60de976-f2c6-4c34-8450-b72e7d45563d", "value": "T1EAE533C4A03ACB6180D224029E5BD3EF6C597D96B95E3722AF0136C6DB8F3C3D645C66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175040, "uuid": "35986331-371d-4c87-93fc-bb44fe87c903", "value": "49152:QXZ1ULu2fbU9RH2VdFJJu+284Xa1GuOPbPbb+gOK6VGA7QO1ViZOaM:QXZku2fbF3uPXBumzbb+hxH1b1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628175040, "uuid": "3b62ceb2-1625-4303-bfde-83ed8ee52709", "value": 3073072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628175040, "uuid": "7bee940f-89b7-438b-8f51-be9588488e4e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175040, "uuid": "9011f1d9-eeb6-4d50-aef4-01c5736d6899", "value": "Factura__Pdf__Electr\u00f3nica__2021__02__FSJCTERIAOJQHSDWCLZJXFSJELAHHADDJASDHKLZJ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a6b67b-f596-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628131258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628131258, "uuid": "81a16ef0-2c1f-42bb-9fb2-5dd2c13b5494", "comment": "Malware payload (RaccoonStealer)", "value": "825802c985a419817e33a395ea924787", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628131258, "uuid": "815b157b-705b-4f74-85f9-415b00694c76", "comment": "Malware payload (RaccoonStealer)", "value": "c4e7522db67d9ccd282873cbff6d97a3ddee685b5028f664b7338589d0db2772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628131258, "uuid": "0d1cf8a0-6511-4bdc-bc76-62b89e0d911a", "comment": "Malware payload (RaccoonStealer)", "value": "4f0e7ffa6a77de7eed5084a783a04e6b8b597dbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628131258, "uuid": "15a8a43a-f1ec-4717-bb42-8df986d78d75", "comment": "Malware payload (RaccoonStealer)", "value": "9b6db0de70cd83b186259ab2a47f1ab59641b17d701a7fe5ada46746abf411b2aa10f8b6505c1e55ff436249e48590e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628131258, "uuid": "e5737c8f-5d08-4087-9c39-a8553483d731", "value": "T110D4E030BA90C035F4B716F445BAD3B8652DBE91972401CFA2D53AEE06356E9EC3079B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628131258, "uuid": "d531063f-4f02-4192-950f-7073ea1c9988", "value": "4de43a5962a4721ead959e24c980016c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628131258, "uuid": "4147aae4-fda9-4655-b51b-83eb6c7d9a11", "value": "12288:W9akf2n8Ids2TYNqJZzoT1NZfBp17/0qVOkp6:Ealo2TYN+hoJzf1/0OOkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628131258, "uuid": "cc657ce6-de80-442b-9ebc-bcc634f04604", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628131258, "uuid": "ea7ce9d3-02d5-4f8a-ae79-6087a17f88bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628131258, "uuid": "72e986ca-d183-43ef-9c04-6a1751dd7d6b", "value": "825802C985A419817E33A395EA924787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc0da99-f5ff-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628176322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176322, "uuid": "80c38364-0122-461b-8efe-4f042718f322", "comment": "Malware payload", "value": "6439889cfd410e3b57422781c93e26cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176322, "uuid": "205886cf-c8ce-44fe-abe7-1ca360fa8992", "comment": "Malware payload", "value": "c58ec23d6e9d1f548d0d9375009bf23ebfb9f40eb9bb14fccc4e10f385f53d5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176322, "uuid": "7bde202d-d820-4aab-b687-b64079cd19d2", "comment": "Malware payload", "value": "12280091094281fa60fa8321006abfc7c4bd4e33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176322, "uuid": "1ca43856-5618-4cf9-a80b-2e11a2e405fd", "comment": "Malware payload", "value": "0197c9e205f8a4a192f4648c6681a91b56df45bd76247f01471c316985ba0cdd15cd19ac7303c6f233f266aff2a44160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176322, "uuid": "e5404e0c-cabd-4848-b775-76f8c9524313", "value": "T1C9A46BAF3650619FF47AC47D6E641D16F524EEE3B2CEC583E4831048CA3D9879A841BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176322, "uuid": "a13709b5-3517-4aff-8b96-13f446b99962", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176322, "uuid": "d06736e1-90ff-4368-a127-84bac622c0de", "value": "12288:pD7irNMyXB/qiYdhJvG+vDSIn+PFmAvZmcpWb8aoL8UO1vhhAAh:pD7+MyXhYdhJvGMDhnwFmmZmcYb8aLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176322, "uuid": "0eaebbaa-f33a-4468-b3a9-dddbc5cccadf", "value": 465920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176322, "uuid": "65a5413b-8b31-410f-908c-b8e932221485", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176322, "uuid": "fda2f421-0687-454f-b8d6-7fc9638ac1ef", "value": "6439889cfd410e3b57422781c93e26cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d59e36bd-f58b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628126649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628126649, "uuid": "4d4756c0-ac7e-42d1-b608-fcae101314ca", "comment": "Malware payload (AgentTesla)", "value": "a417cfa9464265d2621e6fe8c0a63b5a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628126649, "uuid": "b862983a-59c0-4501-b933-1f8a628d2fd9", "comment": "Malware payload (AgentTesla)", "value": "c5bf88556a01cc66703fe980986b7b7adade8a711b8651e35c8615cada08af09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628126649, "uuid": "cecb8628-e187-4628-bf68-ef2ea0728d8b", "comment": "Malware payload (AgentTesla)", "value": "08c726ca06aebe3638b0481cb4814b53ea3e77a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628126649, "uuid": "b7238c43-302b-4072-a170-f50a47014812", "comment": "Malware payload (AgentTesla)", "value": "9e31c3b02c4f1715338c29f778406a63e2ccf7f616af919811a1bb56b4d350080a88bbb912fbaf9f0a90fcb10e3a2c90", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628126649, "uuid": "c156d30c-1d22-4723-adf0-e78dcc5096db", "value": "T1CB155B2125EB240DF0B69BB90FD4F4B246BAED6552CEF1BA38810B47473EA91CD51B31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628126649, "uuid": "ea8d40ff-bb10-4f29-9d65-243909f865be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628126649, "uuid": "23302ebf-879e-44f1-aee3-69f5e718296d", "value": "12288:PnstYdODLqJmNuoLMWA/k+9gkO6K6G0b+EC8RaV1dKMzJnH4Iia77NN:PnstY4PT7MQ6oya8qHR73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628126649, "uuid": "5a1bbe06-cc10-4e23-b2a1-7667c90afd9d", "value": 924672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628126649, "uuid": "71a08622-f600-4c45-bf6a-1a6faf2e9b61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628126649, "uuid": "70c010ca-adcf-4a26-92e0-9589a8f58457", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.DMC.genEldorado.8876.29516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b41f5c-f601-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628176978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176978, "uuid": "eaae85b5-e637-44ff-a4af-4869550eeb04", "comment": "Malware payload (RemcosRAT)", "value": "de9d4c9c1009d24b1fb38205a5277beb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176978, "uuid": "87e36bb0-7ed1-41ee-ab34-7949cec5725b", "comment": "Malware payload (RemcosRAT)", "value": "c64129ee795961963a0df968f6f460704f8bbe0622bea2e8958109a67e1c471a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176978, "uuid": "4976844d-78d7-4cb2-8484-dbc41bfa6347", "comment": "Malware payload (RemcosRAT)", "value": "46f4afb0f5763067fa52060fbcb387e3951fb4bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176978, "uuid": "561adee8-7dbe-4a73-9155-7f74db5e4bea", "comment": "Malware payload (RemcosRAT)", "value": "5a23e9c827c11b2692763f50de05b776e145b136eefe0f595db892d63abaa37db3c5f4dffa28b961efda75a4809a0ad9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176978, "uuid": "71a87499-8cf3-436c-a70b-5b4a5a091ee7", "value": "T16693D813FA4AD0B2E46591F146426F32CEBCBC3636492173D38FCA419D79892D416EBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176978, "uuid": "797b3478-9c55-4ec3-bb3c-87a9aaaba8f6", "value": "d3a62971944197f0701c7049a9c739d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176978, "uuid": "8b9dbfb8-9a08-4e37-8c99-7368c8490df8", "value": "1536:IhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6vrv:OhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176978, "uuid": "f7980906-e30e-46fc-a895-314dcd975d71", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176978, "uuid": "4e34c91e-0ab3-447f-b557-8c283d9a4ecb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176978, "uuid": "5417a001-0929-49d2-9b07-25aef1781b50", "value": "de9d4c9c1009d24b1fb38205a5277beb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b230c0d-f5b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1628142443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142443, "uuid": "e4916d5b-c0fa-4581-bda0-d3adff6dd8bd", "comment": "Malware payload (CobaltStrike)", "value": "09f7d6f2d7f42fcf55aa01a06b366816", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142443, "uuid": "0525d8f0-26b0-4b50-8c96-c5b364cb5884", "comment": "Malware payload (CobaltStrike)", "value": "c738f197bc0a44a2b82d58f7ebe25196809f4a656e214e4edabc45def3b58ea2", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142443, "uuid": "2a102b04-5231-4b77-9209-aaf7bd78afb4", "comment": "Malware payload (CobaltStrike)", "value": "2557c07c820d3f856f59c55a76706e29c0dcf9c4", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142443, "uuid": "f05f8c79-6b96-4a59-9969-a916e24d1457", "comment": "Malware payload (CobaltStrike)", "value": "832c6764fb132d77d358576cd242ee23591dba29bfa886b6344c8a9076f33c7ed33078166487eda1da0a40d0b696ec9f", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142443, "uuid": "79d4c36d-7396-4d38-a5c0-817e72af149d", "value": "T1D0E5331DEA2175C5F81923BF35B28E9F4B25A432CC7F15AAB486351B1D3426380AFC87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142443, "uuid": "bb602de7-0084-4726-b583-c51a3a4d4aed", "value": "5e5ac8ab7be27ac2d1c548e5589378b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142443, "uuid": "9dfd8f1d-8187-43be-a765-52ad3b10b565", "value": "49152:5vSyPHT6Qpi2QPK+9XHgmig3556HHRXSu7qNrbVmjR+3YZ1TpnTiOfzpKZahL+:5vZPz+pRtia5wHRNqpVbsTiOxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628142443, "uuid": "cb14d4ff-4d0e-4918-a2ec-a23520a735a6", "value": 3172352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628142443, "uuid": "bb0dcf92-b821-4c4b-b86b-1b1e9dc35966", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142443, "uuid": "9e790d08-da79-48e1-a1a4-86dc9d615841", "value": "09f7d6f2d7f42fcf55aa01a06b366816.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f820a25-f619-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1628187386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187386, "uuid": "87feccde-50c9-4488-8a05-7d2e45c7c546", "comment": "Malware payload (njrat)", "value": "a3e614d1a2956cde029cb3ce1b499d12", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187386, "uuid": "69865998-db23-4a1e-9a80-c6983d49dadc", "comment": "Malware payload (njrat)", "value": "c79ab21cf7fc23b9a096c4d9aa5b7cd02d968b8dfc58b137c2df44b1e55307b6", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187386, "uuid": "36af7ad9-12c2-48e9-b5e8-34e3e3db141c", "comment": "Malware payload (njrat)", "value": "25d50e62803d2e4032e19993b5075e3dee139007", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187386, "uuid": "bf12e2c7-95a9-4ec0-8cc5-034f578dcd90", "comment": "Malware payload (njrat)", "value": "1ff6b1b9a0a5f49c1bee4f59bb0b77c24f30a7249bdaec76f7548db35887c882a1787c4d33b46dc2165c4d7b8717d482", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187386, "uuid": "b5507688-fa29-4efb-8780-0a6c9e5209c5", "value": "T11764B002B9C189B2D53219355A39AB11693D7C201F38CEEFA3E4692DDB311D1B635BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187386, "uuid": "02b460e6-40f3-475d-999d-0f1ba8eb90aa", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187386, "uuid": "630ca21a-5824-4816-a025-49bde126eaf8", "value": "6144:5dRVzSkGTxSLD8uq5CaOPs47bhqUdUtX+t49fk5X:5hqxSLo5C1Ps4XhitX+t4985X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187386, "uuid": "9bbdd2f2-cc8d-4222-bcec-b96b1dc2f3ea", "value": 326902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187386, "uuid": "5a07b604-5c81-4d8d-8a3a-8a424298d85e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187386, "uuid": "c5cba061-ac25-4dc3-95ee-c137502554e2", "value": "c79ab21cf7fc23b9a096c4d9aa5b7cd02d968b8dfc58b137c2df44b1e55307b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eccd93e4-f5cd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetSupport)", "timestamp": 1628155035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155035, "uuid": "6b21d76e-b986-4575-ae98-3c06001994e7", "comment": "Malware payload (NetSupport)", "value": "ce767e1ab4d5615f0109a771681f6c95", "object_relation": "md5", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gavrilov Andrei Alekseevich", "colour": "#6EE303", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155035, "uuid": "1962d157-41ef-4722-92bf-251c3853651d", "comment": "Malware payload (NetSupport)", "value": "c8425cf994f02784d3f8eeb570b6ac1edc5876908b64b40b532e2534a84a19ad", "object_relation": "sha256", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gavrilov Andrei Alekseevich", "colour": "#6EE303", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155035, "uuid": "90e36de0-635a-423e-987f-2444fb95ae16", "comment": "Malware payload (NetSupport)", "value": "80f5064f32b8b63effbf7c6229202bf514d380c4", "object_relation": "sha1", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gavrilov Andrei Alekseevich", "colour": "#6EE303", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155035, "uuid": "fd245b3c-5ed0-431b-8a2d-c801a5de4dd5", "comment": "Malware payload (NetSupport)", "value": "c90b2fa9248d391b9ca2dcfa2fe45052d8e7bceb3afce071dc47957fcf2a491827d2b5955556b3b5af7e9a3563d2f54d", "object_relation": "sha3-384", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gavrilov Andrei Alekseevich", "colour": "#6EE303", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155035, "uuid": "8fbd8f8a-b861-4552-80a2-078c3f55b7ed", "value": "T1C5A52343FAA281F1D5350532092EA756697CFA342F24896F77C94E1CBE781A333358A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155035, "uuid": "edde745a-f9d2-440b-830b-678c2378486f", "value": "027ea80e8125c6dda271246922d4c3b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155035, "uuid": "f7844c88-df0b-4e45-b98b-37441febd03c", "value": "49152:ZhMM0ZmnyAqs1p0/xjMW4uJ5yV4YoGgHGcGK:7MMV/1psgIIoGaGcGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628155035, "uuid": "66a29bac-755a-43ef-9262-5ecd4346ffc6", "value": 2214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628155035, "uuid": "9559c8ef-4cac-489f-881a-44f039717677", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155035, "uuid": "21e1a386-2410-4b67-8d95-1f9febfe281f", "value": "c8425cf994f02784d3f8eeb570b6ac1edc5876908b64b40b532e2534a84a19ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58756bcf-f5b0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1628142331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142331, "uuid": "7a7bca9e-3171-4b58-a182-3ae82b3ce814", "comment": "Malware payload (AZORult)", "value": "312062576b8c6ce5e204e37f5745bd52", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142331, "uuid": "377a7a22-95e1-487a-97bb-0bd663db9982", "comment": "Malware payload (AZORult)", "value": "c881770186468637dd024971988c9147593f437833e767e6ca252be27b7ca82b", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142331, "uuid": "84e314c1-7c9b-41b0-9dd4-7ca9867de17d", "comment": "Malware payload (AZORult)", "value": "63ee07859ba27b4440422450ab5716903347321a", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142331, "uuid": "6c2754f2-120f-493d-9a49-3a36f9cbfd8d", "comment": "Malware payload (AZORult)", "value": "6b6f6b077757515aafa3a0b429b6f8702bd3362697ac16637335aeddc77fd0c1ab5c0129c47536c2969ce734432ee1e5", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142331, "uuid": "83d5053d-6285-4cb6-8787-0f3af1db1810", "value": "T1F8817C64D9C3C21251180CE3962A1FED7CC32B45ADA01CDF34B3F2880ABC997DB9620E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142331, "uuid": "596a77d9-a95f-4e76-ab7d-b8bead805f8e", "value": "96:ZSiJrNZn3gvm2YH9Jox9DE59/iIZ0RS9fuK/48NT1F:Z/nQeXH9JojEr0RQxNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628142331, "uuid": "ab1f9696-e893-4dc9-bfc6-54525ec68cdb", "value": 3879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628142331, "uuid": "c77e3634-be06-4387-b4a0-df1545a8c576", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142331, "uuid": "94e4b5aa-eff0-45ae-8088-c8fc2adde42f", "value": "RECEIPT_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc5bb88-f5f4-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628171599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171599, "uuid": "47cb118f-69f2-468b-80d5-30befbf17f70", "comment": "Malware payload (AgentTesla)", "value": "eaa32255388b5ecc678b611c68cd274d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171599, "uuid": "e3574b88-22bb-41c5-8bac-384dec5e9a55", "comment": "Malware payload (AgentTesla)", "value": "c9fae10d5d7d2177caff01384688e386f651232e5ff24c1729b4db443f857fd9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171599, "uuid": "32938b25-16f9-4b2a-ac7d-cacab8fc6904", "comment": "Malware payload (AgentTesla)", "value": "31a0601ec436df8223e88ed686035b4746d85bd2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171599, "uuid": "6a4585f7-c355-467f-80db-7f7bc2326c52", "comment": "Malware payload (AgentTesla)", "value": "3cb8d6bfa8c9f28100d69233ab54c893cb4188466a0f6c8adf5d6f1a0171ab7766d3114f2e3a0e64ce2d3feece083e0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171599, "uuid": "68b8467e-d6c6-416e-a8ab-4248e9a83dda", "value": "T195057C2229EF154DF3B39B764FC4F8BE5AEAE573570AB0B638910B464322940CD61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171599, "uuid": "b4dd632e-08b5-4fda-b03d-154fd7ba829a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171599, "uuid": "ec47d39d-14b1-41ae-85d4-35f49c5d0f55", "value": "12288:S9oR65AXwgFvuSS/sppyibjbtoKsf0Y1L87zy1B+81ctTfbq8UQLEM31Cr:uoR6qgjOjbtpsLykk8GTfbNPPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628171599, "uuid": "d60a3c61-cbe0-42bd-ad5b-0f3157fefb26", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628171599, "uuid": "6d5223fc-d383-491c-a8ba-5d75c65000bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171599, "uuid": "a14a155e-07b9-4101-bef5-2b8325c83a86", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9189ac6e-f60a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628181081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181081, "uuid": "122a826a-e25f-4967-97fd-7a11e767ae99", "comment": "Malware payload (Dridex)", "value": "d35c22d2e3cc029f71852ea0b4d9cbce", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181081, "uuid": "d98c5f90-2eb7-4d91-a8f5-5b6c25518ea2", "comment": "Malware payload (Dridex)", "value": "cccd32ec4aa1a51610c243b1099ce79fc241452ed8ab90200008c6932df0c82c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181081, "uuid": "8ececfa8-c327-4351-b404-86339d94d549", "comment": "Malware payload (Dridex)", "value": "4cdee0c6986b5e215642e1e3dd46af0154d4bb4a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181081, "uuid": "5b9ca244-1c30-4e9f-b1bb-fc51dd924317", "comment": "Malware payload (Dridex)", "value": "a6f31f9a919224fba420d48061abcac1ab99e6b654c5ea20a22a39fddb0c92b0b84bcb2127cdc547e6ecb5fbd0607cfe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181081, "uuid": "26066e2d-7a9a-4efc-ad08-4081e510a8ad", "value": "T12004E0C042F7D2A5C3679B7C00B671BFF16929012B76D9588D85CD2CEAAFB91D360272", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181081, "uuid": "06960351-7e22-451e-9b88-44a5373a3910", "value": "39ea6703ace4f75b2e32f9bfc2ceb0a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181081, "uuid": "19a083c3-0904-4564-9105-40936b794bd8", "value": "3072:dDZDVVA+DQ5JTOfEb18qFafjqvTwQJeWLq9NxbKejRGEjh:dzVAfqfER8qFOqv8eeWLqRb3QE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628181081, "uuid": "1a32abee-4a1c-401a-b66e-1685e19b1d70", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628181081, "uuid": "55451ecf-9a73-4fbc-a7ae-e8136a2ed8dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181081, "uuid": "83c40ce1-9fca-42b1-93e2-fb3cf062091b", "value": "y0xcR3dVtO3p.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2a6af7-f619-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1628187298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187298, "uuid": "56e3f904-535b-4805-a955-3c03e3134494", "comment": "Malware payload (njrat)", "value": "9b46ae38570378427e9c264c35ac6b35", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187298, "uuid": "f607094a-a21a-4094-ba8c-e408a986b63f", "comment": "Malware payload (njrat)", "value": "cfab22ecfcfb03a2a3c7a6c272f5bc0477d23d1ae1e466f69d026be9f38160a3", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187298, "uuid": "3a9c8f66-d7c4-4ddf-bb80-2c666399642d", "comment": "Malware payload (njrat)", "value": "31280d1ae12828b14cac5306b0e4d537ab9cddf7", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187298, "uuid": "424e6c7e-b5d6-4537-ac38-4fba80fe9552", "comment": "Malware payload (njrat)", "value": "de96dc08665c564814c07de405115ff50160df5831f48247a28cc1162bdb11005d3e37ca9c5b24babdcd567255e0b7f9", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187298, "uuid": "a968fd66-ebf1-4c45-bd41-5f4fe03f5079", "value": "T1C4624A18FFD88376C5EE6DB11D73A74803F8E202A827EF2B1DC8945B2E937964611790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187298, "uuid": "507307c5-0705-42f2-869a-6335e089931d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187298, "uuid": "f521f075-9747-42e9-97fd-4988f21584d6", "value": "384:23SK1fKP+uHryE/jfbx9o/AtTwx6s4xzt+U3Kw:q/1fKWu5bE3x6s4xztH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187298, "uuid": "38f0b37f-3482-4c23-ba95-552ac5f9a8cf", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187298, "uuid": "2a57ef82-af84-43cb-a591-4a522f36d248", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187298, "uuid": "204a79ed-5dd4-48ee-abe3-9b8f63583083", "value": "cfab22ecfcfb03a2a3c7a6c272f5bc0477d23d1ae1e466f69d026be9f38160a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d857fd73-f62c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628195803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195803, "uuid": "afe232d2-071a-4ff4-8175-ad8b70f9ff04", "comment": "Malware payload (Mirai)", "value": "63d605e3b92261a6bb1d41e3d92f91ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195803, "uuid": "27d1a502-4517-4487-a4af-e0d203273661", "comment": "Malware payload (Mirai)", "value": "cfad3c4a899479e34f7e87ebfd75137cc9027602380e0cdfd9851ace0f625b3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195803, "uuid": "84dbcb81-91eb-4489-99b2-aa0dbfbc49d6", "comment": "Malware payload (Mirai)", "value": "a5675bed42f6aa74246a8aff6673a6b736f53c9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195803, "uuid": "6aa8f27b-98b4-456c-9dbc-0851e36dcae1", "comment": "Malware payload (Mirai)", "value": "d8986bdc2d4fc397a2e8314ed8a29d3ca1ff64c53d0226c28e12f0e7b37038c961b4a425699e5bc9d12921e46030200b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628195803, "uuid": "4aec29c4-bdba-4978-a696-8ea489ae6aa5", "value": "T1EA83D619BFA11FF7E8AFCC374AA91705288C955A21A83F767934C818B64F24F45E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628195803, "uuid": "009668d0-92ae-4530-970f-de9c9043c89b", "value": "1536:tNsuii1stpAj1gjHma19viwZkhbKinZWwqtcU8:t+1iitpAJgjGJhbKinhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628195803, "uuid": "2ec559d5-1b78-411e-b46a-cd37c33a4338", "value": 85688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628195803, "uuid": "89a20179-7298-4b01-a964-ddd9e612331d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628195803, "uuid": "237b2356-ee27-479f-86dc-15e4cec2a7d0", "value": "63d605e3b92261a6bb1d41e3d92f91ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5bb513-f5cf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628155838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155838, "uuid": "41a9f50b-6008-4fac-8d1c-c8dda5a0e8fd", "comment": "Malware payload (RaccoonStealer)", "value": "8ae74a97d04958e8ef77e18ffbc1f261", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155838, "uuid": "b9b956c1-8e78-42a7-b233-c2bf2003ce31", "comment": "Malware payload (RaccoonStealer)", "value": "d0d1589456c533d045c0b5a67c1145a5d80cc675273e200fb0a915be07bed591", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155838, "uuid": "c2cf0c9b-d431-4a2f-b1af-0f1d768a70aa", "comment": "Malware payload (RaccoonStealer)", "value": "e412e85d70d2f8a709d73d5ad57d90f419f84d6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155838, "uuid": "e6100b4c-4270-4a20-9a54-4a60533e6b11", "comment": "Malware payload (RaccoonStealer)", "value": "9465b88eef9b69c1ad10f4ab6600ff566642bf48be1e65f2e3a27fd97c5cc1779c128ce8e8bbca8b5b3999e87e3ea227", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155838, "uuid": "e3a241f6-5358-4cee-885e-b6cc13db7e1b", "value": "T1F4B40202366CC3F3D16145708876C7E5AE6ABC720C354A8B3BB5659E3E721D3AF1930A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155838, "uuid": "c2ed91b3-7dc9-46e6-8a82-07b7ada3e638", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155838, "uuid": "e28d65a2-d97b-4c46-ad3b-8d792af84a0f", "value": "6144:w8AQzxScKPvTt+Ob1pRqrm1lG1YUnunNcXcfVpFO4mBeymlAqOaRA+bd:McKzIObnnqn8lpYtJmKvsA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628155838, "uuid": "5a1c6d94-3992-4af4-9d96-c9485857f1a4", "value": 495104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628155838, "uuid": "d0a3d453-945b-4511-a8be-0aa0cad9f873", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155838, "uuid": "e304b2d9-af91-4ce3-9e70-ab9dfc5669ec", "value": "8ae74a97d04958e8ef77e18ffbc1f261.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad01f20e-f614-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1628185422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185422, "uuid": "c9854bd3-3318-45ba-9c6a-2c7084b591ac", "comment": "Malware payload (AveMariaRAT)", "value": "45ee81b15b6c5b7b73fa6ba2530e4764", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185422, "uuid": "63ebd2ca-9577-407f-b092-606abd34e1dd", "comment": "Malware payload (AveMariaRAT)", "value": "d153e4163269a30e8c77868685269d598872eda2218f6659f0772824c7598f3b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185422, "uuid": "fe8507a0-3c9e-4238-b28d-cd62ad466726", "comment": "Malware payload (AveMariaRAT)", "value": "0e456ae2a9e868ef0ae7a13c80635ff1608c2d54", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185422, "uuid": "7420ff31-e1f8-49fe-91f0-faacbc3e2b39", "comment": "Malware payload (AveMariaRAT)", "value": "b18bab672835b680b488d0135de03ca6fe1f99153b960871c41b47bc801830d23bb1554cf716e8c6ade0250104c34823", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185422, "uuid": "a85b3571-7bec-4b3b-b99e-c1cd9dbfd736", "value": "T1F6E4022577985BA1E43D5B740970004427F4F119EB2AEB8EBED4A0DA4EF3B25838B747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185422, "uuid": "c1e6b9e6-cccf-4211-9eea-f3ad00acf844", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185422, "uuid": "0a72b030-1c4b-49f8-b3db-34eb8b407992", "value": "12288:dURQU7qnqg7radmlJMw6mFXGyq6SVwkqst2NjFj:G7G9Cd8ywHLRlkqsMNjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628185422, "uuid": "5ca8c64b-134b-4773-a88a-3624521e5f6a", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628185422, "uuid": "365b8f1a-6038-4ea1-9271-b4fa9b8dd88e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185422, "uuid": "76e54ba8-1078-4dd7-a111-08359aacaaad", "value": "revised invoice and bank information.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43afdded-f619-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628187393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187393, "uuid": "d97f689e-2769-4298-8d2c-46fc294a1d67", "comment": "Malware payload", "value": "5eb632ed8d5c69a5090a0feba7af595d", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187393, "uuid": "4c9ca741-374f-476c-824b-09d31eed40e0", "comment": "Malware payload", "value": "d1e775efd43d098272c0dc77bf2772adbc8c840aa026ae5ecd6a013c86cccbef", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187393, "uuid": "86178d40-695b-4d1e-ba66-d2407b1cdb0b", "comment": "Malware payload", "value": "4af7bee9042785e3895282a86ad0382cb7b8f3a3", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187393, "uuid": "0cea434a-97fa-42e9-9e05-6778f3998154", "comment": "Malware payload", "value": "a411615f47d85771a0684b36ef14327d083ab8c348c4cf2da1c86e0153d817bf059cb2fec3a3a1cb11e958f917772f04", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187393, "uuid": "b588fe3d-237b-43e7-8486-2362283821d0", "value": "T10C622918FFD48772C5ED1AB11873A70407B8E242AC2BDF2B5CC8995F6E93B9746107A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187393, "uuid": "2c8d7105-e506-4223-895c-1543806e3449", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187393, "uuid": "9292a24d-32a0-4b1f-aa3e-6fbbbd921189", "value": "192:QQKRjCgzSgiLDD6Ib4tAhNv1fbkiv9o/Atssumzwut+b48W7PSmM0W2+9+:U3ST6IbrhNdfbB9o/AtTwZ4x7te9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187393, "uuid": "cae55ced-30bb-4042-8991-3ba5e38a4b5f", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187393, "uuid": "245a73bf-6366-40c5-9d78-ba959fd8ceee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187393, "uuid": "28b8c828-bedb-4bbd-a0a8-83ba2376833d", "value": "d1e775efd43d098272c0dc77bf2772adbc8c840aa026ae5ecd6a013c86cccbef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82afe6e7-f61a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628187928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187928, "uuid": "1af70e17-354c-45a4-828f-ad4fa95ad9ca", "comment": "Malware payload (RedLineStealer)", "value": "a990e840b07bcd010af58cb603e27e57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187928, "uuid": "4f1461ee-c634-4ba9-96c6-1d30c32c2659", "comment": "Malware payload (RedLineStealer)", "value": "d2e52b65649226c2f12eab39be7e5259baf71388911c185d3a26ae4ecbb3829c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187928, "uuid": "6609972f-bc34-4c51-a269-4179c6ec8409", "comment": "Malware payload (RedLineStealer)", "value": "635e534ddc103ae23a82b1daa6e98848ea1a10e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187928, "uuid": "2b52f5f7-3ae9-4126-bbbc-5d186d7e23f1", "comment": "Malware payload (RedLineStealer)", "value": "ca50ac8f758f4c5453ca408a9bc84ce0935383a706ed5404416f93f60a7efe7562e2bc3a8a05d600424dbbba5ee209c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187928, "uuid": "18d30814-b727-4d24-8827-4c950327cf37", "value": "T14F84DF62B9A4182BCBAC00B0408F1125AB3958177507CEA1CDF6B2798EFE7C5FE1E557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187928, "uuid": "0c27e803-26c7-46e5-8d6b-9716ec1654b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187928, "uuid": "40d462d2-7777-4877-9cc0-bc415c318820", "value": "6144:iBVm3Vc4l/FnTbUm08jr8iLXLaURyPMHKa1dDgFnOYbq4Eu2W1lt/NU4:nnUmhr8iThHtOVJbq4Xft24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187928, "uuid": "b4cdea96-fd95-495f-9941-1ac3e74bdc3f", "value": 373120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187928, "uuid": "ac708e32-0142-4dbd-ad87-bdc7eb38f0f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187928, "uuid": "747aea36-186c-4f51-9f31-2894d01a02a1", "value": "a990e840b07bcd010af58cb603e27e57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599a9bc6-f5f5-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628171968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171968, "uuid": "abd23278-be93-489f-8a22-cf6f0af03d06", "comment": "Malware payload", "value": "a30a7664820bee515dd5b191440aba0e", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171968, "uuid": "7ae337b5-30ac-4550-ae26-a101091ea400", "comment": "Malware payload", "value": "d38103477985fdd6cb00dcf1246a19dc602f8710167290368a6edb71df640029", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171968, "uuid": "26980fb5-d6a3-41f4-9b8c-568de5713faf", "comment": "Malware payload", "value": "ee568b83ccfc0caea41bc6434420c7f1364752c1", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628171968, "uuid": "4ddb8521-7fb4-4802-8e4b-d273f3b52c56", "comment": "Malware payload", "value": "88b96cb116f60015c04dd3d03abc66d9ca0db68bb839e16baee0166b9c73495bf95c148b8d360c32bdb8270b200ccdcc", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171968, "uuid": "ac218095-68b1-4283-aa16-efeeefa78b99", "value": "T19EE1C97D8F395FFA1392B8C8054D334A02E98B175B989DACB9C419B7E03853D9F7A118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171968, "uuid": "97f52a00-4bba-420e-b6e9-b9b48bbacdfc", "value": "96:s0hOzTs+bv0RpCi1S/OAKRGJHE5XH6ToHzKkln6/yDVBIaY:9hOzTs8MvBYaz7B66Dnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628171968, "uuid": "947d6b2e-af20-46f1-b0db-eaab20944d4b", "value": 7139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628171968, "uuid": "a1383d6e-0d9c-4bb8-bd0b-056e7e184f28", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628171968, "uuid": "ae8fa30b-f43e-45ae-85fc-0b6eef97721b", "value": "pdf_document_sw211222.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595d847a-f600-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628176692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176692, "uuid": "631fb8a2-91cf-4ec4-a6f6-6121b32b9ae1", "comment": "Malware payload (RaccoonStealer)", "value": "5e69b2f1f92349fb972f3123b7b48bc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176692, "uuid": "eb1cda43-ca3b-4b06-a4ca-8517d1b76807", "comment": "Malware payload (RaccoonStealer)", "value": "d3c57b9aa6ed46d045e7259d0e2f3d230110a3b9a0576ec2b882502941de66ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176692, "uuid": "d772b708-92cd-4a76-bd38-c23058e70fa2", "comment": "Malware payload (RaccoonStealer)", "value": "4b0429306c65943ad3261ce9e88f6d0ae4956c4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176692, "uuid": "0568fdf6-563c-4ce9-ad90-beefd5feab86", "comment": "Malware payload (RaccoonStealer)", "value": "449c4052345d5ca711780c122e0226d1416d6a210e004e08bc4dd3840c93f7b94be526df136529737b773a6d52566590", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176692, "uuid": "4ce4ea6a-fc42-4b66-873b-1c325b7536ea", "value": "T133B402253571C677E03201715871C6A09AAA7CB19C39D69B3FB1E56E3E213D2EE2E307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176692, "uuid": "78d04330-78b0-484a-b087-867724a237c7", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176692, "uuid": "8e9283e2-d87f-41ac-85f6-b66698371e12", "value": "12288:PsVeoPo6mJwLhXwKlPSGQ8MAckkNEZ7eIuAAh:03JmJA1AlzGeTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176692, "uuid": "ff4e1016-4c10-452e-9cde-4f1f116ac026", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176692, "uuid": "cf6bcfd7-3a78-489f-9599-35fa2010ee6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176692, "uuid": "44abfb60-b1b0-4b04-a386-02d4dbabc577", "value": "5e69b2f1f92349fb972f3123b7b48bc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a6475a-f5bf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628148664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148664, "uuid": "4007cfc0-ee1d-4f90-965c-8bd84ffc0e4b", "comment": "Malware payload (RaccoonStealer)", "value": "2948de6f75d3f65b7a81c2fd0b4b31e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148664, "uuid": "3224f371-94aa-41e2-be54-a6898ce4014d", "comment": "Malware payload (RaccoonStealer)", "value": "d401d0de24cc5f72a8eaa740d4354ecb5835391107a99f775e8666d424a4c55b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148664, "uuid": "d80b1d72-ac6f-476a-aab4-761f0aad7f09", "comment": "Malware payload (RaccoonStealer)", "value": "903c6767d206291b1f1389b73753d5636eff88dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148664, "uuid": "455afc65-14b2-444a-8488-30f31813d135", "comment": "Malware payload (RaccoonStealer)", "value": "065d49acaebed2e915e83d72626a9e922edd648e375bea111e3eb26d3945f7bf884ab9342b83895e329d90d010c6ebea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148664, "uuid": "b2f19147-ffa3-4f57-a65a-36901b4ce9cf", "value": "T14BB402313562CA73E16202704871CAA59BAA78711C35D3CB37B6E29D7E762D3EF64342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148664, "uuid": "74759a3f-a8c4-4cb8-a6f1-0e0ba6ed7263", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148664, "uuid": "fd51694e-0ed8-4c14-a0b2-4bceccf18ae7", "value": "12288:5gCfwxT7+Kjn1Tc63bcRflcdVX1w6QqkqA:peTKin1BLSf6R1wf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628148664, "uuid": "ed9f8d4e-3faa-47d8-a013-e28d0e502165", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628148664, "uuid": "d96de675-bf5c-4af2-904e-b379a8628cd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148664, "uuid": "b8946a80-f0b1-4839-9976-448fdd6d988f", "value": "2948de6f75d3f65b7a81c2fd0b4b31e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649c00f1-f61b-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628188307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188307, "uuid": "e0406dc0-8d84-4d41-add8-2636eeff381f", "comment": "Malware payload (AgentTesla)", "value": "103d1cc218855c90217da5eab8cf7761", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188307, "uuid": "72e83218-fd3b-4155-98a9-6956009d5eff", "comment": "Malware payload (AgentTesla)", "value": "d4ac7a72eeea3ab4a778123b1ee1b804181a7d24b0e380f2874e68937de34cd6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188307, "uuid": "55934a0d-54a9-40ab-9adf-8f9b5916c166", "comment": "Malware payload (AgentTesla)", "value": "2ef02a66a694e86498710e84c81ab722b7b82e62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628188307, "uuid": "bc001436-880f-4dac-8c75-958c277c7f16", "comment": "Malware payload (AgentTesla)", "value": "651eee09b759f09b106bee0df7bb17481d32a746fa654b97cf2613519095b207d8db2c641733c676e901fe59ef0415d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188307, "uuid": "6ae9bcb1-e426-4079-bb00-73cc6dffe129", "value": "T15C550139888CDBEACC9903B60F8C12743EF19496B1B0E5B53E4A47B1F6C4D69E579702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188307, "uuid": "8146a4d2-7f66-4d75-a07a-2c754de8cf81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188307, "uuid": "e9b3a384-8675-4f11-afb5-6293228f118a", "value": "24576:BsLS/d3PYdkAZhYpW1Vsvj/M9zx6U5cuR9A+mwRGPoN7vdiTbnFM:wrZhX1VC/M9F6U5cc9jm/PoiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628188307, "uuid": "9973b810-6859-44fd-bd3d-6faa3e9a6740", "value": 1381376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628188307, "uuid": "3e1cdf9c-3c7b-4afb-9ffc-46ac25cb9110", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628188307, "uuid": "0e580b07-26c1-4fcb-92fd-1fe41d9798df", "value": "103d1cc218855c90217da5eab8cf7761.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c776fc6f-f5a3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628136933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628136933, "uuid": "f0d6502e-77a4-430b-b560-e91921285916", "comment": "Malware payload (AgentTesla)", "value": "476e8955b72e0d22793acb854ed729f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628136933, "uuid": "e2d88ad9-095c-43d2-90ab-0c6255717475", "comment": "Malware payload (AgentTesla)", "value": "d52671b7a0f462b2fef9c51a3cd22f319dd3fdae1fa28514a7709bccbf487579", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628136933, "uuid": "393224c2-845e-4194-aa88-21642decba5b", "comment": "Malware payload (AgentTesla)", "value": "7f2e39b58c7765fb78725471af04edf9c6ffd51d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628136933, "uuid": "7973824a-c07e-492e-9b7d-f362a13313fd", "comment": "Malware payload (AgentTesla)", "value": "8983cc85559f8b946273ed06b8a143a03bd555a275201f5d96788778a7d5602aaaad1ca17d193de07c3c59bff35669e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628136933, "uuid": "33d2eb6a-43e0-47f5-a465-5411948cb2d6", "value": "T16FF401B84144BF57D63C02751F52221697F9A6B66EE2E64B7D807CF830CA287E78314B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628136933, "uuid": "c6668a40-a321-4eb8-a3cd-6737865496c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628136933, "uuid": "bd332949-c555-4acd-a047-02c98599453d", "value": "12288:Xan+9l2Kn0NXh1mIprev9TRqAAhKK3ryk0ajvVhU9N/ax2zfbTvxZ:X/zWx6v9lqAAhKK3rfhvVhUGxKlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628136933, "uuid": "c1638e05-7dc1-4e18-8387-913bbe41a0fd", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628136933, "uuid": "2800289c-904c-49f8-9814-9ca10ab227b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628136933, "uuid": "f385db67-380c-4d97-b75a-9b179527bc91", "value": "70654 SSEBACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d23732-f5c1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628149519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149519, "uuid": "34442f3d-c58b-4df0-98f7-191dac3e70bf", "comment": "Malware payload (Loki)", "value": "0a3c9c8db267f60127cc80272e8d0b7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149519, "uuid": "95d15e78-4085-4fbd-a548-6d985da4a7e1", "comment": "Malware payload (Loki)", "value": "d586560a58ad44be9be80b819685a714d228d98596f1b44c4b08bdebc1c108db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149519, "uuid": "58f0eeb1-06cf-45e3-b99d-70ec58098fd6", "comment": "Malware payload (Loki)", "value": "67bdaab57d4854310a16c986b9b0620ba79c61a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628149519, "uuid": "023ce05e-0d7f-4bd5-9176-0e115cf60265", "comment": "Malware payload (Loki)", "value": "478ebf81df0be69e7b07b4ae8cbb4bd30563da293adbd1175528f5792ffb22238afc7972e2450d88166e9579d328f0ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149519, "uuid": "244a536b-ee2b-4d4b-a8ab-1ed22c42db0b", "value": "T17664F105B1C08573E55148315476C9B16A3CFA354BA49EEBBBC86A3E9F302C28536FE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149519, "uuid": "25475f77-0f2f-48b6-830f-a10bad61f8c2", "value": "7f3a4a0e96d9bcc5b3425ad3dca611da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149519, "uuid": "0657c765-9e04-4930-bc99-f6b4aacdbc98", "value": "6144:UZbfkNQfL5Pu7Z1FRaFpoUTmwK5qoDjdVrJYpeBQuWhqZOc/8tQmIklmvqPAgj6V:Sbfkuj5LqUTmw+q2LJCeBQXqZOw81R6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628149519, "uuid": "c2a39f52-a449-400c-a643-040ecfc4d3ce", "value": 334628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628149519, "uuid": "e0ef7697-b573-4c9e-a5fb-888a343a6058", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628149519, "uuid": "5b125a3d-0ce9-4e97-9271-40a33f9007e8", "value": "0a3c9c8db267f60127cc80272e8d0b7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c558c59f-f5b8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (ServHelper)", "timestamp": 1628145949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145949, "uuid": "ee235f99-15a3-4952-b731-904f6d998802", "comment": "Malware payload (ServHelper)", "value": "2dbb763c2ea2beca29999c2892ad376a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145949, "uuid": "8a0ad5ba-2d02-4633-9a4c-87280a8fd4ce", "comment": "Malware payload (ServHelper)", "value": "d5ad88c8b3d764367137ebd2293a3211bdf6dd140caf6bdf6a1c604a08cb05d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145949, "uuid": "90558d1d-c567-406d-a3a3-55c238e4506c", "comment": "Malware payload (ServHelper)", "value": "2eac6f687a8b551b2f69dd4e72798ded18c211eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145949, "uuid": "9b209174-d38b-42b1-81a7-f9a22d6d8456", "comment": "Malware payload (ServHelper)", "value": "9740037deb37736dccd719c33a9801d2b5f91cfd432426491feb58e459ccb9e60c9f79dcb3c593fdbb6c0e1725bfb66d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145949, "uuid": "849b29d8-fc65-42e2-a4cb-8da2b9ad193c", "value": "T18AA4122EF8A6C473E5412AB54C18C5A46A6B3C741975668F3F8C736E6F322D2DF16302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145949, "uuid": "8f05c247-e804-4a3e-a8e0-0e34c1a154bf", "value": "2a9c1ca66125aeff7a1c36242be63d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145949, "uuid": "1d694956-f773-4731-a32e-a1a40e026485", "value": "6144:7qU2LuD66HLIMI8J2D3KenR+FMkq+KwwwA/QVphDql/MLrUF+KZV3En:7p2f6HLC8renwCkq+Kd/QXh+XFLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628145949, "uuid": "b115dee9-2266-44a1-b941-f137653996b5", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628145949, "uuid": "0dcc299d-7385-4c83-80cc-b11ce0072c27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145949, "uuid": "37e0e193-9537-487f-8034-873c7f322596", "value": "2dbb763c2ea2beca29999c2892ad376a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc21a2de-f62c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628195809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195809, "uuid": "9ad182a4-ecad-477b-aea4-56b1c90c4484", "comment": "Malware payload (Mirai)", "value": "6b5a4173c776a9b44f103cf410fe008f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195809, "uuid": "2346a284-9004-4a48-859a-5723b8b546d2", "comment": "Malware payload (Mirai)", "value": "d71845b32b1e5faddf909084f09371243de4f8e9d48d4cfe5795b722db90e03b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195809, "uuid": "5d64735d-70be-4437-849b-a0b4ed4a3c86", "comment": "Malware payload (Mirai)", "value": "bf5003efb1c9ce75fe426c5bcd2daca51100f622", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195809, "uuid": "28f8a583-2021-4882-80a2-d751690261fc", "comment": "Malware payload (Mirai)", "value": "5a29d830bf77b2e9f0f292607d0be9cbbabedc1a7b5b819b5820781bab003e09834b7ba26c515681644511ff85602d6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628195809, "uuid": "8774bf31-18e3-46f7-8b00-9015d94cd825", "value": "T1BD43BE73C5276D88C0994179B8654F765723F44C82A32FBA8A92CE6A9017FEDF5083F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628195809, "uuid": "7dbf5274-c828-403b-8e35-df49c773aefa", "value": "1536:0aGAUvdVQWRyR8m/b4FFn9KDgMDo0M04eCiMRkO0D:0nKWy6F9kDvM04eakO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628195809, "uuid": "dac12602-7c6c-4e4f-891e-f9c9039521d1", "value": 58908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628195809, "uuid": "d12f54a0-d40f-4df9-890c-5da5877b6890", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628195809, "uuid": "d1c0024b-7cab-44dd-990a-3ec8de0cb870", "value": "6b5a4173c776a9b44f103cf410fe008f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59834812-f5fa-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628174115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174115, "uuid": "21fe5f14-19ad-4bc8-883a-6fbb57c624c7", "comment": "Malware payload (Formbook)", "value": "896ab1d8a29867bab390372268689477", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174115, "uuid": "874f47ea-d8a6-478a-9fb8-a3a1fadbb4b9", "comment": "Malware payload (Formbook)", "value": "d80d29653891c1d84ba6b72e1eaafefd78700646859bcaa7ded2fc1e2fbafce4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174115, "uuid": "7b39f432-5a9f-4ae8-aa54-6e27938adf42", "comment": "Malware payload (Formbook)", "value": "4b9c8fe4c07c5bebb8620cd3d01164ac0f54c2ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628174115, "uuid": "b3629f8a-170e-4b4c-886f-2c99785cf6f8", "comment": "Malware payload (Formbook)", "value": "e40ec0b4100c4fbb9454a4b448b2bb0fe2f524d680e05dbe3082dd9d921692144c7ef0eb7f8ac86008f0bd606169cb8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174115, "uuid": "4e398c88-6fe1-4fd1-9a86-98d4de2822a2", "value": "T1A5C412351A6CA377EA7DB3F610D1B14397B5611BB023CA492CC2D7EA96E6B100B01F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174115, "uuid": "f0618b54-c99b-4f95-9c05-8b88cfb7096d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174115, "uuid": "73031718-e981-4dd8-864a-c6cff218c2cf", "value": "6144:juDb6RsoaiI2OrS3CuKSdh2TjeBSv0ST/zjFQqX8TT:jBRdAdSmfe4T/zzM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628174115, "uuid": "8f72c080-6466-4c31-9127-829778cb6afa", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628174115, "uuid": "e2698591-0555-450b-8601-9b5a57a37377", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628174115, "uuid": "4ebfe19f-40f1-4845-95aa-6a6874b0f047", "value": "896ab1d8a29867bab390372268689477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d201689-f600-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628176698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176698, "uuid": "c0f98e5c-b6b8-48cf-bf20-d2b1d56fc478", "comment": "Malware payload (RedLineStealer)", "value": "174aec5e50b8a66cb3ccc4b342e3f863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176698, "uuid": "b42264c7-b7c0-4c6f-b2c7-151235428ba6", "comment": "Malware payload (RedLineStealer)", "value": "d87caaaf87e2d97b1b336a0c1bb01369da3d27bca6495efa4c20966880bf12c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176698, "uuid": "705c3af7-f058-42a1-b06f-b962746413fd", "comment": "Malware payload (RedLineStealer)", "value": "efafec955927c1df0f932875151349951a303942", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176698, "uuid": "7c2718eb-133d-44d5-981e-dc70ffaa43a7", "comment": "Malware payload (RedLineStealer)", "value": "89072250b8ab5fa467bfea09c7952dc940e14047b52a59d2dda03f6f7fde28729f59307f3a7d8ab4a99cccc2cd297e57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176698, "uuid": "4bdf14de-ea72-4df9-a3ba-c5c427d24f66", "value": "T131D402263541CC32FB5536B1489BC261AA7BF874CC23868B7B8E176E5F251E2EB31345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176698, "uuid": "ac0f15f3-5a69-4550-9211-54f8286a5370", "value": "e905b204d022a4a3f9803ba3895bcbd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176698, "uuid": "0a68da99-7d04-4ea6-89f4-d5b7b631757d", "value": "12288:Ib1AoMctRrQvq1IiScqNEq1xlphB4UiCCM2YmS7jXyp8z0piP5K:2WOR8vuEcbAxlzJFCZYmojXypw0pCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176698, "uuid": "597292c3-4991-43c4-9512-892bfbfc190a", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176698, "uuid": "75b0a9bf-ba64-4f36-b501-ed94044427ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176698, "uuid": "b3c3e263-2e28-4667-b371-8bee3ace636b", "value": "174aec5e50b8a66cb3ccc4b342e3f863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c4f91b-f5b5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1628144641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144641, "uuid": "49736f30-59f3-4de1-b1d9-934194518a7a", "comment": "Malware payload (GuLoader)", "value": "71b0545cfd5a7b63459d13e350a9438c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144641, "uuid": "a27b0d9d-33ba-4687-b1b9-73884b502ff8", "comment": "Malware payload (GuLoader)", "value": "d89afcb5a9cd0b710f6790931566822009c12fa344857e1c35791181035f21ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144641, "uuid": "d144b3c0-221f-4bba-bced-27d54c6d53b5", "comment": "Malware payload (GuLoader)", "value": "68bb59a46e052682bac47255f221ddb61c4ca188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144641, "uuid": "dbd8e58b-ff22-4459-aa3c-fb0e26805ffb", "comment": "Malware payload (GuLoader)", "value": "fc196d8547204ed41074b43f7765377d60785f8d770bcbea83546d141762e7cd2bddfab93a99615ab6b95e7995f41afa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144641, "uuid": "315fc481-ead6-49af-88d0-448117ccea1d", "value": "T1DBB31AB0B6E3545AF365C33D0737855BC5E33833550E992EA008AB390135B8EBB9967B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144641, "uuid": "86dbd139-0cad-4a0c-86a3-ef9eea9eab1e", "value": "b947ef57db12504396f2fb768b954d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144641, "uuid": "5e650bb4-fa0c-4720-a2d8-90e0d40b03dd", "value": "1536:KXJ+JzBQTy3SNUWHH4/cJ0psUpJY/gg74aS:EMJ9QTDeiHggoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628144641, "uuid": "304cf5a0-47ad-4c1e-9e3c-3061da0c5ced", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628144641, "uuid": "0bbdbdbf-67d7-413a-9d53-a63c6746aea8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144641, "uuid": "fb838dc7-0625-49bb-b14e-b67076439f9d", "value": "Demande de devis (GUICHON 080421).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4be6d3-f5bf-11eb-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1628148994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148994, "uuid": "f75eeb6f-87ca-403b-80b7-e93c691d07a2", "comment": "Malware payload (CoinMiner)", "value": "2ef1f2fd600af1cea8690b76de3fafe9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148994, "uuid": "1c426b7b-20d8-40df-8079-cd2f226ff451", "comment": "Malware payload (CoinMiner)", "value": "d94fd5cde3574048397162ee252ed9fd3b6ad79ad02b63eb513c78911c2191ab", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148994, "uuid": "bfbf596b-a7ba-4674-a4bc-f114e71b8a54", "comment": "Malware payload (CoinMiner)", "value": "3662292b56608857430f080d01dadbdffafdb18c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628148994, "uuid": "28059976-cfe2-45fe-9888-89c0e3ac9320", "comment": "Malware payload (CoinMiner)", "value": "f245a1c5e9073ca612bb50a1268fd2d934f125e00efadede94fbef85da77e5c8b9554cf429fccd07f3adb734267c438e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148994, "uuid": "a66dc35b-bf45-4db4-8bfd-c47ccf95bb07", "value": "T17F23F11127D119DFF5300731542E6E897978BA36A9E3F7CC3F8010254F2B8A1C261EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148994, "uuid": "41dd2bc0-af72-4e93-a420-50fb7a294008", "value": "768:qlBzqslx3mEg505zOgpkHFf60OoActSfuiP4ZtE:Sh50IKeEk0OoAcMPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628148994, "uuid": "a8522c34-7a47-4f2c-ba73-e02ee727d293", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628148994, "uuid": "fda32469-3609-41c8-8539-62e70016e482", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628148994, "uuid": "14f6a92a-e8df-468a-8ea8-3afe32463678", "value": "2ef1f2fd600af1cea8690b76de3fafe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e495e7d2-f5af-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628142136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142136, "uuid": "f093471c-7a34-4f9a-88a0-e38e0f998f38", "comment": "Malware payload (Formbook)", "value": "051e986de390fe146b27a297ffae86a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142136, "uuid": "7e262c74-adbd-4fef-87a6-7ec488afe36c", "comment": "Malware payload (Formbook)", "value": "d95754d5ca3e8ef0462c99b4f10388a39cfb92b4885a2f0fc0839dc75c869c61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142136, "uuid": "0e870c2f-01aa-4ae5-a5bb-0dc98ee960e5", "comment": "Malware payload (Formbook)", "value": "92ac3e2c2e908db1a0800080ff575ab524c703d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628142136, "uuid": "aef2b063-57a8-47e9-8098-6e41b8b9fe43", "comment": "Malware payload (Formbook)", "value": "30dddfc7b828d10d2b42fbed22a118b440a5d54dce682a10d19a9d32345967167230125544bcf3b545ca61435457ccb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142136, "uuid": "3d3467c2-9071-4c72-bf0e-9946ef1e1ca2", "value": "T128056B2229EF114DF3B79BB60FC4F8BF46AAE673560AB0F638511B964322940CD51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142136, "uuid": "08af15a5-3962-4062-b82d-116e4a78fe4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142136, "uuid": "58607a53-5225-4d40-bbf1-fb67a87e2ec1", "value": "12288:sRjfqAqZzoR65AXwgFvuSSHI8+YPPDrdGh3vSFFkpF2it00W5yEv3wCd:7oR6qgT33636F8v0Rfvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628142136, "uuid": "bfe5b0be-9c9d-4bd7-8ca6-479699995413", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628142136, "uuid": "d6c08429-eb28-4ac9-a0bc-5fce32f73dbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628142136, "uuid": "8b6f8890-5182-41a5-85d1-ff52a477c406", "value": "PURCHASE ORDER 2070121 SN-WS.PDF.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb29453-f5b2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1628143116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143116, "uuid": "37324a0a-425b-4df1-a90e-5f3790b6aa4e", "comment": "Malware payload (Stop)", "value": "d8ecefa640196c5056bf640c36816836", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143116, "uuid": "dd63352a-546e-4518-bdfb-e774e3184d4e", "comment": "Malware payload (Stop)", "value": "d9e93860c1b468911168c4c30564817dc0b788cceab0e073d0be8850c95590d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143116, "uuid": "6f4e9eeb-99b2-449e-8805-f19dbd8721e7", "comment": "Malware payload (Stop)", "value": "9c7a774c90a61935f36e7201f34939df9f05ff80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143116, "uuid": "5037788b-fdd0-4991-8758-ca805fdd4b0c", "comment": "Malware payload (Stop)", "value": "2f9e6ac1f52661efa5dbc8ae144794cb98760064ff57eb1778d9d642af413db69a18d1a2da476ea042fd3357cd6c3eaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143116, "uuid": "8768d8ed-00fe-4a89-ab19-62adf2633dd6", "value": "T180F412527A9DC8F7E76409B2D854C2A62F2ABC301D216D6F3BC1A36E4F723D19E46305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143116, "uuid": "0c66ca12-6d63-4ed2-9f7c-28b7cad44476", "value": "e2ba8e1f75a8e02687cc194905c50074", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143116, "uuid": "88e2014c-0b1a-4959-8e99-f9b964cc5d6b", "value": "12288:khDBGmF04lc9KoZKO6/U6TorpMKLvRgng1CEfg6:k7gudToVMKLang4Efr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628143116, "uuid": "0350cccd-3a68-483a-a862-f405e0dd5978", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628143116, "uuid": "4220b750-c8c7-46af-99d6-073f037b4c6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143116, "uuid": "0d5652a5-97d7-4ae1-9213-f9adff73cc2a", "value": "d8ecefa640196c5056bf640c36816836.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d82ab4-f600-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628176733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176733, "uuid": "1cb0741b-4884-4ae7-8da6-81c400f9329c", "comment": "Malware payload", "value": "5fa9ff8d72d84f095200ee02d8ac1119", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176733, "uuid": "f565fde4-b7bb-4c2c-8f12-3cf64e385828", "comment": "Malware payload", "value": "daadae370efb2bd779a8947efbe1a6ec8852d0e923fd248b552c11158c2d5ecd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176733, "uuid": "b13e3480-9d36-40b1-8c95-30773df3f9db", "comment": "Malware payload", "value": "abc717060cc33c5a3214c1c24d83cee736b93abf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176733, "uuid": "9ec05a88-39b2-4157-9d9d-ac2ddac30a09", "comment": "Malware payload", "value": "58ff6c30e015ad95c0a8385791f087cf4239bbad839e885b880468c8d466e28fd835f258048661499b773994fa3e826a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176733, "uuid": "cc2934ae-2957-4bef-ad81-0763af4e92d5", "value": "T12936336AEC83C5F1FC5E483823969BF789D74C20A941AD42E39537EFFA710665280637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176733, "uuid": "2be15fb8-1536-4d66-b17d-3f1b48a0c60a", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176733, "uuid": "7838f677-758c-4a06-a48e-10ca8e83ddd5", "value": "98304:Hnf+bz05aqHLfYbq+DDYMkx6VEbkOaLftxv3KWclbxMRXKUXrDfVFaTdBt8h7Usm:Hf+0aqLQbq+Wx6VEbxabzv6WUdoXKmHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176733, "uuid": "dd1f5118-c019-4ae4-911f-b12af6a5caba", "value": 5242309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176733, "uuid": "ff1a8de2-6236-47ad-825a-b0d9ea5850ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176733, "uuid": "328a32d8-61ea-48bd-91b1-9d0947bd36e3", "value": "5fa9ff8d72d84f095200ee02d8ac1119.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e83c38-f622-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628191289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628191289, "uuid": "7de2f807-414e-4fd3-a52d-1aa02419fea0", "comment": "Malware payload (RedLineStealer)", "value": "ab70ed7913f843b8ec7fdb0627a3dcbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628191289, "uuid": "31d23819-06c0-41ed-b953-eb572fb071ca", "comment": "Malware payload (RedLineStealer)", "value": "db131ff273e35e9e229e324f03c9fb2a868e557b17d4d7e11059f66241138e1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628191289, "uuid": "a7fd6caa-8860-429b-866a-9a22e78f5991", "comment": "Malware payload (RedLineStealer)", "value": "2b5ffb95b3093be7010a9e434b00f01751619c95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628191289, "uuid": "d862d27d-a0d8-44d8-8948-3bfc4f34ee04", "comment": "Malware payload (RedLineStealer)", "value": "c9e427d5affd122937bbc4e1f34440d4872a997f3c5578a9c28377a10c2889e117e051943e96ad82fa26eec8160e2b6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628191289, "uuid": "131ac139-51f9-4d8c-8d12-8418d0eddae6", "value": "T13154E0213980DF72C5A25533B5B1C7A46A3A7D325E248E4B37743F5E5E302D12ABA34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628191289, "uuid": "357b9467-5de6-4944-b12d-c0381f4ba948", "value": "55ad605eca715f8b898cdab75b98ba54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628191289, "uuid": "bf774798-9971-4a6d-a424-32163e049015", "value": "6144:BLBsS1TxtT4RRUGUtuQt4sKhfu9zd80QLmHlerHSvGZ9RwoOL:Z9xtsbUGUJ4sKhf+p8tCHlLGZjwoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628191289, "uuid": "a20c36b5-a6e0-488e-87a1-6759c1bdbd8b", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628191289, "uuid": "abd7cffd-2ce4-46cb-b245-8c65f1b99b7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628191289, "uuid": "27ec62fa-1363-4b88-9417-f6ba88bc1dc4", "value": "ab70ed7913f843b8ec7fdb0627a3dcbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62eab7c5-f5c9-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628153086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628153086, "uuid": "f547d1bb-da1d-48a0-8363-e4049b149f7e", "comment": "Malware payload (RedLineStealer)", "value": "1e314a2b2315a0b42aa6ed8be8dedcb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628153086, "uuid": "77ee58a6-61e5-47e2-bcee-f75c70a8f560", "comment": "Malware payload (RedLineStealer)", "value": "db80af4e3d8c906facdda32cf164125c71887fa990276bd2490b8228d9f71b18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628153086, "uuid": "875299e7-288c-4c91-a0de-4243649184cf", "comment": "Malware payload (RedLineStealer)", "value": "e70a470ffe665babf997fcf20a7cc106c2b8dacc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628153086, "uuid": "4ff6c4eb-9fc3-4344-81ed-6d2f6a11f0eb", "comment": "Malware payload (RedLineStealer)", "value": "4b527da0ae7e3bfa99ff2c1aa47ba16d4be9d351a3271cd41053740f7cdfa7c0c236fe514c1e7f1bd5c083831e94006b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628153086, "uuid": "de6f2745-eb49-437e-b050-130ffaaca438", "value": "T115A34B2563ECC61DF7BE0B366470092A07F1E08F6402E75B4DC1B4EA1E767826658AF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628153086, "uuid": "bf3b43c5-624c-44ba-8204-8e0148797844", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628153086, "uuid": "b4dd0a9f-6554-449f-a419-bbc05898a721", "value": "1536:qm386AEAVTFBJUcGqh1TEhwQUQzn79gbue7vduzNyAsd5Mi1xQeTEyG6WAaoigEw:qi86Ad91MAfQznO3duhyddPsvAURy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628153086, "uuid": "e39d9ce4-de85-49a0-9fcd-b008e60e29eb", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628153086, "uuid": "abeb4b90-01ee-4cb1-89dd-85b9cddf2841", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628153086, "uuid": "95e0c06b-7551-4112-b2ad-aafccd67fe9f", "value": "1e314a2b2315a0b42aa6ed8be8dedcb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40833f4e-f5b3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628143579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143579, "uuid": "dcc9ae79-88b9-415e-8083-90b81310a2c8", "comment": "Malware payload (NanoCore)", "value": "586396e62af68d9f18fea42f8a69f027", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143579, "uuid": "6b94e544-c98b-4360-9c71-94775d9db7a6", "comment": "Malware payload (NanoCore)", "value": "dbc6950b090d71c1a274f1fd99fa2d84e720779513f8809a3dc590dde012cc80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143579, "uuid": "806b0d94-493b-4e01-a533-f3f76b7b49e3", "comment": "Malware payload (NanoCore)", "value": "5cc4ab19cf7077f53d61fbd666432cb9902aa951", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143579, "uuid": "1acddf09-4517-44f4-b81a-a6240ed84df4", "comment": "Malware payload (NanoCore)", "value": "a462b1349467a6c49a7bc87e11458b07c7d953ab61f2075a1a3f76c7070670d68e9466e0ecf1c74085dde2c38b486a11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143579, "uuid": "5e73c7ea-4475-4f5a-8f97-aa5e375e19e8", "value": "T1AA257C2125EB250DF0769BB90FC4F4B646BAED6552CEF1BA38810B47833EA91CD51B31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143579, "uuid": "90ac3063-3803-4dd8-bfa6-8e1e0216d713", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143579, "uuid": "d6e65a42-7537-43c0-a1b8-d7ad57541784", "value": "12288:bstYdODLqJmNuoLdnpHOQrg1Ba+3jSEdD5PzyZ/F9NKEF6hmU01NOc3Cu:bstY4PTdnJ8zSE7Od9NKo6hX4NOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628143579, "uuid": "69367736-73a2-42ee-875e-509f9e6f062b", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628143579, "uuid": "c132f8dc-c67c-4684-bbf8-50b29157ad6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143579, "uuid": "a47779e8-3d8a-4b40-9940-6f2ea2b928be", "value": "Commercial InvoicePLBL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aadee50d-f5f1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628170386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170386, "uuid": "c46dd36d-542c-48a9-b8f5-aad1a28967c2", "comment": "Malware payload (AgentTesla)", "value": "6052fc6db72cea9c871f421ab2b6b529", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170386, "uuid": "c92e6a0f-3913-408f-be34-8fea390b2347", "comment": "Malware payload (AgentTesla)", "value": "dbd2b66797260a826db05cf6f7025687a86c5dcdc2447bacbae058b1244d532b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170386, "uuid": "6f5a074b-b7cd-4a76-8edf-bd9dc184001c", "comment": "Malware payload (AgentTesla)", "value": "4543afa284e286f4fe5fc3952feeddb42de92e6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170386, "uuid": "9c42eb4d-e02c-479f-aa05-bf90ef146047", "comment": "Malware payload (AgentTesla)", "value": "e62daf80394e179caf5863702449d8f9071c20111f1be20f7943a5c32781cb3b11cfddc0a90c74acfbd9146171be3061", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170386, "uuid": "547b1a27-4c71-4129-82a1-65391d6332ca", "value": "T12455231EA7511E0EE7CFA8B07801824D06B5AF13776DE093FB09B588AF3C95066957CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170386, "uuid": "40ec2c14-abf2-4cb0-bcee-dcecff5ffcf0", "value": "24576:dAIZlGaRrngxTCzlWnJ99I4xqMiFb6WQp5r81oe8i22tMUcKsyr0MGmS56BVNhp9:+IZlGaRrgQ499Ieq7HQp5Qow22pcKscR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628170386, "uuid": "8429d1e2-4a3e-4a4f-a60a-6f503ca40e18", "value": 1395576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628170386, "uuid": "e72a98db-9993-4b4b-8083-f07632a70e04", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170386, "uuid": "1c9a4533-3ad6-429c-80cc-8d6ede15ca13", "value": "Overdue Invoices.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fe91b3-f619-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628187315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187315, "uuid": "074e1468-63a7-4a57-9b9c-e00e87a8e979", "comment": "Malware payload", "value": "8e07953b96ffa7ee7f5d0fa6fea71a6a", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187315, "uuid": "6a8bdcf3-ca6e-481f-abd5-f7c7814954d7", "comment": "Malware payload", "value": "dc9002bc8fec5e678ae60285dd9fc303e87a9ea15b037be76285e41b50f62f8b", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187315, "uuid": "8ed246b9-4d27-4d8b-acc1-b442d28405d6", "comment": "Malware payload", "value": "4e93fdb33e6c3bb62b41418ba91e1fadd14903d0", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187315, "uuid": "241f7565-f3bf-42b7-aef8-197b87e0b648", "comment": "Malware payload", "value": "717bc664e1f1012015e732c0a3c0ceaa3a18c622e52a9f52a56350cfe504b647d69f9fc8c98b822529dd99f219f25ca4", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187315, "uuid": "afec11c4-887f-46a0-b17f-fcbfb17b53c4", "value": "T1CBE1A306BBE84A73EEBF0B30DDA38250B775A306D867CB6E3495601A2D21A444D69B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187315, "uuid": "394dda98-4399-4b35-a35e-4102126fbb92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187315, "uuid": "b10c9d39-967a-4c80-ba62-0b2f5d880e34", "value": "96:PkNkySdoIwGY4pBb0G4FlEbsSzZEOXRXjgjSb4w6Zie1/BDno2zjBzNt:8ybGFlEbsSFEOXNASbDwiQJbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187315, "uuid": "bface0ed-4399-4c0a-bb2e-b0dbe46418a0", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187315, "uuid": "d990cb1a-3133-41a3-ac8c-a0c35a94b974", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187315, "uuid": "ad77c8a0-eb57-428c-887c-c658fbbc1794", "value": "dc9002bc8fec5e678ae60285dd9fc303e87a9ea15b037be76285e41b50f62f8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a3527c-f5d0-11eb-8fa1-42010a9c0011", "comment": "Malware payload (FluBot)", "timestamp": 1628155962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155962, "uuid": "9afd2285-348d-4e30-a52f-22fc454fa2ae", "comment": "Malware payload (FluBot)", "value": "305c6ef783ba3db66c8b3262d0ad26d6", "object_relation": "md5", "Tag": [ { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "v4.7", "colour": "#3CF96F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155962, "uuid": "70f0dee4-7b73-4b5c-936a-c20408314ebe", "comment": "Malware payload (FluBot)", "value": "dcfe4d8c0265186f24f56cb774f0087cfde3d46fc0d31a7edf7e036a2006513d", "object_relation": "sha256", "Tag": [ { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "v4.7", "colour": "#3CF96F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155962, "uuid": "c138b806-e88b-414a-be8c-ca1584a80e83", "comment": "Malware payload (FluBot)", "value": "efd066effa3bfea6c04521a1b32c417f9d19ed34", "object_relation": "sha1", "Tag": [ { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "v4.7", "colour": "#3CF96F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155962, "uuid": "079436c8-0d6b-4fd6-b87c-25b0411f47ce", "comment": "Malware payload (FluBot)", "value": "aec5078554d39a213bd1bb4e9de470e7c0f32de0a384fc392aa055a2ed8d48a3cc259d3766266c8c577633edd01a4dfa", "object_relation": "sha3-384", "Tag": [ { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "v4.7", "colour": "#3CF96F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155962, "uuid": "870ce413-00f7-49b4-9b69-f5a7bb5e65dc", "value": "T170F52305BEAEEB27D307E134896CE486640864584548FE0B2AA5D34C5FFAC50A7C7FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155962, "uuid": "6f6f7996-dc7e-4043-90f3-710cc4f15224", "value": "49152:q77+QbVwYD57Qyr5nsqNz+yBcvPDCkUHXCKgNwVQX3pUyN7AYpDMaSwXZ4coH:qX+AD57QyrKZOcDrjGVzyZAWRS+Zm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628155962, "uuid": "764ecb14-e1b9-4de2-a4fb-dea5c557012a", "value": 3498944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628155962, "uuid": "6d1a71cf-9783-492a-9294-6c01a00b29f9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155962, "uuid": "7a7dc2fe-774a-467c-93b3-e7938f3c2363", "value": "dcfe4d8c0265186f24f56cb774f0087cfde3d46fc0d31a7edf7e036a2006513d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd2919d-f5e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628164080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628164080, "uuid": "742bbe92-6c6d-4dd3-bfcd-9fbd55f36947", "comment": "Malware payload (Loki)", "value": "4a21a7f7fa4c1ce05c8c1a7e10eb73dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628164080, "uuid": "392b221f-ccf4-464a-8109-a4739254e69b", "comment": "Malware payload (Loki)", "value": "dd025916c022873b3269e3280d3143ec0422f1fb3e15eed452fff5ae9bedd055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628164080, "uuid": "f05fcab3-79d9-4921-819d-1df9a540b694", "comment": "Malware payload (Loki)", "value": "90edde836d74b4f8b5a3d8aabdbd45ba3b08160e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628164080, "uuid": "0694238c-b508-4453-b33a-c09c80859851", "comment": "Malware payload (Loki)", "value": "7f09682f953a2fb106056571ca4730a4d08cb907c1d4e3b3566c6739a2c2629f78ee417d42d79fd96404ca74a96c9b42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628164080, "uuid": "c26541b7-29f2-4beb-8cee-4e7e3c00b9c7", "value": "T134F45A2229EB214DF3B79BB50FC4F8BF46AAE673160EB0F639511B964322940CD51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628164080, "uuid": "be838ab0-afbf-4559-898b-3b0d723b10ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628164080, "uuid": "f83b2f6c-f78c-4f4a-ae88-9c7e1092acf5", "value": "12288:1+IWjTrAMZZoR65AXwgFvuSSsI9JPDFAhTpTShEJcXNPMgMmTx9Xog+BwjuP2Jy4:1+9oR6qgnEFTJcXtHTvXL+BwjYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628164080, "uuid": "02f69432-a992-4828-a6fe-65851bc759c8", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628164080, "uuid": "d1de49b6-cfb9-4223-9b69-cc6365e80b15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628164080, "uuid": "9a0185fe-2d0f-4f89-8a30-dd0e2a2c99f5", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cdbcb41-f5b5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1628144593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144593, "uuid": "4f27680c-1fc6-4b8a-b5cf-d4a2b1b7666a", "comment": "Malware payload (GuLoader)", "value": "8df94f24931debf211a2d2a27e77d2f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144593, "uuid": "5b6e2725-2745-45c8-8fe5-4097d040541a", "comment": "Malware payload (GuLoader)", "value": "dd1c6d47aacdb7b4eb9d0d77d669ed9e73bf8b59a03963b5b8681df64bfb2736", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144593, "uuid": "57a72d11-db48-47d2-a15c-78bc57a46584", "comment": "Malware payload (GuLoader)", "value": "d3416101cb6644336162852ddebbf8f0ed22bce6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144593, "uuid": "61d6e5af-fab8-40ef-9bfc-61e62d2d652d", "comment": "Malware payload (GuLoader)", "value": "b67cdb047ee6ee902ff75c6bc59e2634dfc75389b5059f7a10a9425afa3d0b48c9d584c34c9d83d6e40ce6465b7831ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144593, "uuid": "37c22008-6762-4257-b52d-74460a8afe51", "value": "T10CB390C5A270F55BD14FC47AE5CD9DFA81407D7280449A33BA4CBF39B5B92D232A3A42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144593, "uuid": "d040984b-1731-4c65-953e-56db804fc674", "value": "b28b105866cd7f6746798ef93a2371be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144593, "uuid": "421f0fe0-38b0-4ae7-b85a-7374bf504017", "value": "1536:GF9zlChxIlWDQke2ZbLY/OxlXnbbeoB5GrTt:GFkGN/45bblY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628144593, "uuid": "e1f9b213-3d27-47c8-84d7-922d3c7cf531", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628144593, "uuid": "0dd3cbcc-4530-45da-8c34-3b83dc2db671", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144593, "uuid": "9eb7f178-b294-4275-ba59-b30fcfe4144d", "value": "items.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af125a74-f5e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628163951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163951, "uuid": "35dd7603-cef1-4e76-af1b-979dee8736ae", "comment": "Malware payload (RaccoonStealer)", "value": "99b72996f72df0a87123d4150223f35a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163951, "uuid": "7f8a5648-fe0d-4d39-9483-fe32a761b2ec", "comment": "Malware payload (RaccoonStealer)", "value": "ddbbe8bc8c80c1dff8bcbef62de67eea791cb00ffd9839b0b12319218fc2359a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163951, "uuid": "3952cd04-7339-45d2-a8ad-a890ce0e76f8", "comment": "Malware payload (RaccoonStealer)", "value": "3cafe8c7f866bb19eb15dd55311c2539f00f4d9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163951, "uuid": "a4028d81-0fc5-4ea7-a48a-c700f4fa78b5", "comment": "Malware payload (RaccoonStealer)", "value": "8a407be274ae779b49adb14e737f49891054b275d669f1badab4038de48792498e4837726459962db6ee1d13c53258ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163951, "uuid": "ebe2a7d6-8ef8-4af9-99d8-3b81c0a881fc", "value": "T108B4F1323281D633D29946744C7EC6A19BA97C710D31DA873BF5AE5D7EB22D19F28302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163951, "uuid": "266ecda1-9098-456f-beda-eda6bfed3b8f", "value": "e905b204d022a4a3f9803ba3895bcbd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163951, "uuid": "377af15a-f5d8-4a0a-9eac-6c68d959ca4e", "value": "6144:YkWsJPzWJnQpUnAKYUm8cAsDwnk2+LeYF2pE7p9vrEMZ7QkVA5olP:/PzUjnmUPcAk6k2L67p9vrQKA5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163951, "uuid": "691527e9-7f02-4d01-9bd1-5a3482ed85e2", "value": 495104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163951, "uuid": "49dd351f-81b2-4afb-8e1e-6392b3a6925b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163951, "uuid": "29503468-3828-4b70-a2c0-1f6279e5603f", "value": "99b72996f72df0a87123d4150223f35a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3a1da7-f5b3-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628143574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143574, "uuid": "a6fa3f8b-1546-46b9-b4d8-8e684f95039c", "comment": "Malware payload (RemcosRAT)", "value": "6a1e010d4b1a7f82ebf0dd330155fe77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143574, "uuid": "4c992960-cf27-476f-b16c-a4a13fe32f62", "comment": "Malware payload (RemcosRAT)", "value": "ded1412f9509d9fbc0c48687c3611d6cd8356ff0f00a9a2c5836890a5df03925", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143574, "uuid": "b0cbe9f9-29ab-45c9-9017-109dffea41e7", "comment": "Malware payload (RemcosRAT)", "value": "ba08ac0d87b829b49277efcd3cbd2a345338ad00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628143574, "uuid": "fc097ccf-ea2a-4068-95a5-7daa20b37422", "comment": "Malware payload (RemcosRAT)", "value": "d313c9778cd5150c6e2117f2a808073aee4d18469d9210749d1400cdac1d6cc59bdb4173736484b5190fa9526aad8a1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143574, "uuid": "0adfad59-b3e4-44b0-80c5-30ab75724305", "value": "T1B5D423A0E6D5FDA3FB1A0478213AC6F97A332F1D2848DB0D8440BE277A17B534B52D95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143574, "uuid": "205498ef-0841-4fb9-bfed-84a6cb42ab22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143574, "uuid": "1e596e83-2da1-4c95-9d2d-48805002aa37", "value": "12288:byTwAFw8YWw+oIPFJnUUvNu9wGl87Dl3hUCwHpyZcmfvdEi/oGjYF7XyQLV8:ewAi6foIdJnUUvkwwkl3AHYZ3ndEco/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628143574, "uuid": "1e019e58-442c-4697-ad3d-db3cef3fa01a", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628143574, "uuid": "2ec1ded4-b379-4fe0-9d9a-9db1b9b23b0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628143574, "uuid": "1753551c-1dc2-4334-9b22-7a3702882851", "value": "6a1e010d4b1a7f82ebf0dd330155fe77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2813a922-f619-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628187347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187347, "uuid": "e3f8d286-d2e5-452c-b1d4-6e13a653063f", "comment": "Malware payload", "value": "4b792b700f7c833d22f6a819175eb3bb", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187347, "uuid": "e6db8b0d-ab3b-4f05-a868-bcd8aee217d9", "comment": "Malware payload", "value": "df47ca45bdf2f910a0ebae49d29549240066f77d0abb735cf1afe41368cb0d85", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187347, "uuid": "994c442f-3406-4640-989f-58d4429d10eb", "comment": "Malware payload", "value": "b6b4c32fbd66e53dbd048af41f1cb1a7538fa1bb", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187347, "uuid": "83516e37-262a-4136-9c0a-7a34c61d3fa4", "comment": "Malware payload", "value": "8c3da1a43aa0f83d3754aaa022fb742f546295b27a2526ebc94a2530acb32d1ceed88e6bd001c2681e37d45458c210c7", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187347, "uuid": "3a065801-0117-4076-8d7f-2d81fa6976c8", "value": "T1752104191BE64B7AD1F38E3E48D7B31346B0BA0268818FF501B011559964842FD68E7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187347, "uuid": "3a6f7f72-038f-487a-a7db-99b236fa8307", "value": "24:8j2Zxw0I6h/8AncP4+/oxdm+Do0tCfqfHOqbm:86fdVncQXiUoLCDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187347, "uuid": "049cf899-c45c-4258-bf47-7f3c2e77850a", "value": 1141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187347, "uuid": "8e388d4a-f1f3-4f0a-9062-891a16d039d6", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187347, "uuid": "df7c178b-91dc-41d4-bcb8-2cbd2e70d67e", "value": "df47ca45bdf2f910a0ebae49d29549240066f77d0abb735cf1afe41368cb0d85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88827d07-f600-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628176771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176771, "uuid": "7cb54c20-0d2a-4710-9353-cd2a8ab47f64", "comment": "Malware payload (Formbook)", "value": "e0c4de5dd6fc348f8d6d475c20da8e7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176771, "uuid": "75f4b407-e3c0-4e56-ae44-4c1057062a1f", "comment": "Malware payload (Formbook)", "value": "e07fbf3b9adba7e4aceb5cc6804c0002ee01c000d4e67ff3227f59eb9949c80e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176771, "uuid": "13a27d6d-3f90-4f80-92fa-a027d3dd2a4e", "comment": "Malware payload (Formbook)", "value": "a49a0cf25cbc520a0d43791aeca50390ba86b86f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176771, "uuid": "09936453-4d1f-49ff-969c-9ee46e094041", "comment": "Malware payload (Formbook)", "value": "4b26d8bee274424025a06acca949a729e67f59eb1cc9b30f67245c36be27fac12d29a90bde4c2d3edd2d8f028aeff722", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176771, "uuid": "b76fbbe0-7f67-4fe3-b307-8532bce98542", "value": "T128057B2229EF154DF3B3AB760FC4F8BE5AEAE573571AB0B638910B464322940CD51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176771, "uuid": "3bc1116d-0335-440a-a5e3-aa63410e8428", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176771, "uuid": "14b8b292-276b-4e52-861a-a58c4f614717", "value": "12288:eDoR65AXwgFvuSSXszJCo0LLJQmf/dDhZxrAPnx/eE77w31nctqRyNnTJk/dWl2m:0oR6qgtrLLyYvxktN43qCyB1k/dWl2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176771, "uuid": "ed71c8ea-f45e-4e56-b92a-9810a1d1351a", "value": 855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176771, "uuid": "377051ea-150d-400f-81f9-1d4b1e7e012d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176771, "uuid": "26d4bb14-c4e8-498c-a3a1-95721e951be0", "value": "e0c4de5dd6fc348f8d6d475c20da8e7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5882f9-f5e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628163654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163654, "uuid": "ed593c6b-13b4-4c8c-a75e-c2fd6d31201d", "comment": "Malware payload (AgentTesla)", "value": "6dbde85f373f57120e1ac780c847ec0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163654, "uuid": "1380822b-d23c-4750-9a08-f4be54c026ec", "comment": "Malware payload (AgentTesla)", "value": "e0fba3d44ffa244d8e910ce971fe3d384b4cfa3aa40b7f27d6021cda4815ec63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163654, "uuid": "a6b61503-113a-4d19-be47-a420c7efc353", "comment": "Malware payload (AgentTesla)", "value": "0cc34caf7e030e5df57c6ce337a5f1c176ca636d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163654, "uuid": "9c45eaa3-d45c-402f-bb64-319881483d4d", "comment": "Malware payload (AgentTesla)", "value": "828980fabac88f2c3aabf52a89b991692fd4767b8f703b55902516b9a4a72465b1e457ac53af1ecb7b2361bc67627258", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163654, "uuid": "9a602bf5-49f5-43bf-8c2f-d8c4c6366cb1", "value": "T13F157C2229EF054DF3B39BB60FC4F8BE56EAE577571AB0B638A10B454322940CD61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163654, "uuid": "79ab3524-40ce-4876-8a71-397f5351829d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163654, "uuid": "75c6c04b-e17f-47be-b70c-b66b7b705097", "value": "12288:gloR65AXwgFvuSSksL5Y7iu5LSOKwMvKaRkkTZDJd9l+fDPdN/9:QoR6qgdYW6SOKwm6QlJd9l+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163654, "uuid": "e8996ff0-b3ad-4632-8f82-6df2e5f92b63", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163654, "uuid": "7f0faf46-f124-47ff-895f-d926765240e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163654, "uuid": "e2a5d537-9d99-4a5a-8bee-1e3c475a0b91", "value": "Hesap Hareketleri 05-08-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986da4f0-f5fe-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628175939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175939, "uuid": "9070fd4f-0364-4021-977a-3cf7a239e290", "comment": "Malware payload (RedLineStealer)", "value": "ad5d8f16890b07fa62012c90c214272c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175939, "uuid": "c612de8d-1fc8-486f-94e2-e8904005e626", "comment": "Malware payload (RedLineStealer)", "value": "e140db0ac7627056777e6ba7c7d2a328d046a0efd5bf740c53c7e482bfc89c2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175939, "uuid": "07282ba6-6186-4aa1-9aab-45d7ecef3d14", "comment": "Malware payload (RedLineStealer)", "value": "77db0476f49e5616739747b467d010c268fa8ed4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628175939, "uuid": "8994a382-199c-46a9-89ce-e3318bfeaeb2", "comment": "Malware payload (RedLineStealer)", "value": "cbcbb5d6050fac0d3cf17b27a353eb09afb44045d8270c8645438a2fb018fbc9cb99f09e1ee402c07a5184eba320fcb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175939, "uuid": "16a223ea-a84d-480b-ac98-be1f456f4ff4", "value": "T1B354D0313683CC72F255F6318869C6B52A2BF879C9649B873B8417AD5F313E3AA35341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175939, "uuid": "dd7da1de-ee93-4a8c-84c6-005811a79a04", "value": "5db1361d34b46103924e72350663b6e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175939, "uuid": "ef1d63c7-a117-437f-9ad9-729d144465fb", "value": "6144:TVrqoKK/8kyQ3rctNMp59WvdWJ2xmeP/i:YC/GCrGNMDYWJOP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628175939, "uuid": "939918ef-f13d-4bde-af8b-b6715cf4549c", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628175939, "uuid": "8743ee28-874f-4c3f-a628-fe558f8e3658", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628175939, "uuid": "40987f65-b849-4832-97c8-f7d1fc4bf41d", "value": "ad5d8f16890b07fa62012c90c214272c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c2774a-f60a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628181065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181065, "uuid": "ab86262f-d7e3-4346-b3ec-78ebeff1ec04", "comment": "Malware payload (Dridex)", "value": "b3b8e948af688a6d2eff0f57ab8719cb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181065, "uuid": "04382dfd-0c42-4a13-a0fe-2943f8bca59b", "comment": "Malware payload (Dridex)", "value": "e3e0ac6181a0905d2f3af548f9b4f38089da2ff26e4bc5fdc34990df70f06801", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181065, "uuid": "007f4caa-631e-44d7-bb57-d35d842e23dc", "comment": "Malware payload (Dridex)", "value": "6e1bb6c442268841c7f0372fc0fdf5fa2563b0f9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181065, "uuid": "986575d6-a3c1-4302-82f1-115694cfb9a1", "comment": "Malware payload (Dridex)", "value": "bee42cdaf2feb48c5a5e3cc2239874911b31ba310d61d29cfa86b9883d4698a8b631ba586a211fbedd723ae546407d4d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181065, "uuid": "35123d3e-43b3-417b-9332-cc978fbc454c", "value": "T1B504D042E3CE23D1DC97B43248FC262924F05444D85ADCFEC995EBACD7E1F574A64A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181065, "uuid": "deda11a9-798c-4ed4-9dc2-a271195768ac", "value": "6eb7ecc6c2e948f718b1179f888ea193", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181065, "uuid": "96725278-816a-4c75-b3bc-6aa1a95b5f67", "value": "3072:DcYhzpn9z75jWpmrL3gA99hXkKsorn+AOr4RfjvaT:DcIntom33RDvn+RrQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628181065, "uuid": "31b6e204-0bf9-4e36-ba7a-47d541e31da7", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628181065, "uuid": "916bde31-c4c6-4f85-b1d2-212fe27fb34f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181065, "uuid": "763b5f0e-0f7a-46fd-bdcc-b62653904509", "value": "9hZRZnRtm.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5578e42-f5ec-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628168364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168364, "uuid": "30bab38b-d6e8-4f2d-9762-4973b4c61693", "comment": "Malware payload (AgentTesla)", "value": "6468a151622f24089ebf3baa10a8287c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168364, "uuid": "8c2a7fec-53b9-48a3-acd9-65f7814b97a7", "comment": "Malware payload (AgentTesla)", "value": "e433b3cc952fec02984b9d3678ab71f9e168a5616550f44e7ab3b0548d01ed2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168364, "uuid": "b8f2f6d4-a9a9-42d7-996f-fb698617129b", "comment": "Malware payload (AgentTesla)", "value": "ba5feb4167362ef7653ee2b37e0bade427ed8786", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168364, "uuid": "306b7ab1-7cfd-440b-8007-bc9bbfc35e00", "comment": "Malware payload (AgentTesla)", "value": "ac6f468bafd4426aa53670da518d20553c4300a7b158b9cf23e8f6aec07861bcfbd0b2228bf90b436dc32f6a7be1df83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168364, "uuid": "397c89ed-d4f8-45d3-a0a4-af39d424f6f2", "value": "T1D3C4AD6176DA0A4BE47DC3799044903D92E3BF65AB50C20E7B8136C9E9BDB053AE53C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168364, "uuid": "aae28d66-a689-44ff-a1ec-72f585d9af74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168364, "uuid": "557b5db2-12e6-4be8-bf5d-957671c1a776", "value": "6144:L41ijDCGvBowm8sokmuSmxH4mp4U4x56MA6JrFerea+ezRmFij+mYGAoatGcbtbW:LvCsB/m19WjA+0ea7zDSqAo6GmtbwrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628168364, "uuid": "43c57b08-f797-4cbb-b8c8-4863a9e1cae7", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628168364, "uuid": "9e05d347-1f9f-4114-ba62-d56622096026", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168364, "uuid": "d79f654a-b03c-44c2-b15f-dcadc323d067", "value": "PickUp Notice_HKGB88932410.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b84608-f5aa-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1628139608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139608, "uuid": "04301416-d7e6-490a-af34-28c6070e8848", "comment": "Malware payload (RemcosRAT)", "value": "2fd86e21e01b50ccf36d9311525becc4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139608, "uuid": "177436e9-e4db-4bf9-9919-734b7000723c", "comment": "Malware payload (RemcosRAT)", "value": "e4471b5031c5b2757e037a8c9e2a3936861c2bce13e6f750d590efcead30bc33", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139608, "uuid": "e67f2f14-202e-4ed5-8833-b27e44e27a31", "comment": "Malware payload (RemcosRAT)", "value": "d15750d5c0bfc2fcb0929db9ae98a08e5e76f766", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139608, "uuid": "63868db5-b642-4ea7-af94-f6a6d7b0ceca", "comment": "Malware payload (RemcosRAT)", "value": "876444a7cfd9296dcbea878d5da807cd954e428d38ff6fc0d2d04ae207f887efa7cfb49d1e3b2db3f19c6112fbf819e4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139608, "uuid": "533b31cd-873f-49c7-a6cd-77a50627cdb6", "value": "T1DA340CE4688F48B2D2499C5E6494B145AE74FEE334C5887223AFD434DF5ABF29EC4483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139608, "uuid": "9f2428d9-17c5-4234-aef2-ef6b6a2f4344", "value": "1536:bW7qA4b64r3LGjSidUvMYoOZZoBcI+5obQyyndzFz76mAg5eeVhMDw5wfLW:bW7qA4b64mTMndzFtr5RDAw5wfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628139608, "uuid": "5271ac38-fdcd-40f6-a3fa-07bd15f56ed7", "value": 236210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628139608, "uuid": "deb4a6c9-56af-4e68-97d1-8d1200b9d992", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139608, "uuid": "7d243d64-b45b-4ebc-b1e3-97672c2146c5", "value": "Qoutation MULCINIA.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ac3629-f5e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628163801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163801, "uuid": "01b058d6-d20e-4d29-81f1-eb410db42210", "comment": "Malware payload (AgentTesla)", "value": "d220cd77b4cc67f8e34219d67a5bc4e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163801, "uuid": "b34d341f-3fab-4daf-9551-4d196e123a4f", "comment": "Malware payload (AgentTesla)", "value": "e46d86a915c02056f48c750b7bdce92ae401120c50b2d47937ad009e2928dfa2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163801, "uuid": "c64fc2c5-5655-4ec2-ae7c-6da1075c8d72", "comment": "Malware payload (AgentTesla)", "value": "f21a93f5423dcee2b893ae9577085defc9819db6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163801, "uuid": "1cbc940a-9a12-494a-be73-f5ff06807136", "comment": "Malware payload (AgentTesla)", "value": "1203e1037d8778003773e228bfc5b9053e0f615f68f56af010883a67ffe9c05749ee3b25bd54a0c501b28a4543ef6cc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163801, "uuid": "4781fb67-d9d7-4fbd-ae66-72f9930a9223", "value": "T127F4392A211C7E0FE7B7C43D69643896E714DE92F3FEC042ACC36149A5BCE6355701AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163801, "uuid": "5facfe5e-dc0d-48ad-b83b-47543e2b4691", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163801, "uuid": "9a79163f-7087-40d0-8595-e0ba8622f7ae", "value": "12288:iQ+tKb2cq53CBsQYm6XMWBzEDPWZvN89EWeT7X+RR5FbApoW3I:2c+3CBsQY7mDPWZvNvWS7X+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163801, "uuid": "cd227e5e-3f6b-41e2-8aac-dfe9422a78f3", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163801, "uuid": "6913f82a-c944-4df9-a567-6be6b89e11b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163801, "uuid": "548ad269-cb8d-49de-8e9d-7349caf0bb0b", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43acccf0-f5aa-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628139719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139719, "uuid": "dfd530ce-c15a-464d-a05b-18fe84a7717c", "comment": "Malware payload (Formbook)", "value": "1c0c739a4929470941eab3e7cf3a8bf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139719, "uuid": "2124deee-c675-4684-8b3b-b63e827e3c16", "comment": "Malware payload (Formbook)", "value": "e4f6934778af90c9743606ba732f32121601a3b227f5e881eba31595e67a8a05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139719, "uuid": "230a3e48-4009-46e0-b7a3-124fa045b843", "comment": "Malware payload (Formbook)", "value": "a32beb88b7097b12cbac1fce6ee3ce14203eddda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139719, "uuid": "150c617e-ee36-4d16-a0ec-0516b3518fa6", "comment": "Malware payload (Formbook)", "value": "7edd71f43439d553c53a8c96dedeb8a0e186209a0ddffe251c3badcd92d1ff79a05eae97ddbeadcb3114c42f6f517077", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139719, "uuid": "ee6a4a1a-00c6-412f-b546-de6175348822", "value": "T14F64F1107AC1C573D672183154A0DEB51E3EF9341FB02AEBB7981A795F342C28A25E7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139719, "uuid": "4beb2a37-02b8-4e41-a0c5-9ef6ba1ae523", "value": "7f3a4a0e96d9bcc5b3425ad3dca611da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139719, "uuid": "5f06e80f-1229-4eca-93eb-7e315cf11a3e", "value": "6144:2Arf0xh3Hfr5YwuLpVQHHj7XrEqjNbaiywYqzPKlrRRDtJ9DWWiOpUsDnB7ij75:xrf0P3HD5YeHj7X4s+2D+RRDRiWDp1nU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628139719, "uuid": "965abb9e-8746-4b16-8025-50e1510b567d", "value": 334143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628139719, "uuid": "18beb877-cc1b-41ae-99ba-2671665c93bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139719, "uuid": "3432dd3c-a2d6-4754-b567-2020c48c05c5", "value": "AWB DHL 7214306201 Shipment Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b585fe2b-f600-11eb-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1628176847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176847, "uuid": "f4990497-b424-4848-a05f-77654561c6a5", "comment": "Malware payload (QuasarRAT)", "value": "f7c54a5c6882bea791bad5bbbbac3274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176847, "uuid": "25000fcb-c424-4e7a-b88d-62f27ffd4676", "comment": "Malware payload (QuasarRAT)", "value": "e5daabcee417a3138938c563a3bb420cf9817cac24ec380b7fbe00614aaa8e9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176847, "uuid": "b8041428-008f-418c-ad43-4833b2ee0649", "comment": "Malware payload (QuasarRAT)", "value": "7959dff5afdae4382a301dfa7ed10ac891369b0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176847, "uuid": "330f75c1-6c0e-49cf-8071-c7be97ef3b5c", "comment": "Malware payload (QuasarRAT)", "value": "bf44fe3860129ac921877311ece6e38d309554d3e017445e5b6eb859bfd255a70b59ebbf0a7b916665227ea32d211e94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176847, "uuid": "93b8f7a8-3537-4683-b18a-fb0ee9d35eda", "value": "T1D6E459908EEFCEDEC2AF623FA41A0C8354DEC306075792D18B565E75B3912639C661E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176847, "uuid": "c71d95f3-d54b-43c3-81b3-4c42d7c29dcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176847, "uuid": "113ab39e-f03c-4efe-ab12-6ad5573ba8ce", "value": "12288:+pkB3o30fIc8/COiCw0UNtZHX8SVL0j2U:bo8IPriYUB3lVwj2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176847, "uuid": "ddcd77e9-6d42-4c7f-93f6-cc9552b2bf00", "value": 673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176847, "uuid": "5b2a59d1-f73e-428a-9c5a-977afa4ed809", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176847, "uuid": "f98642d9-5947-4e17-8baa-2879b9d441da", "value": "f7c54a5c6882bea791bad5bbbbac3274.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e9e5a7-f5aa-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628139662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139662, "uuid": "21f79b76-6415-42f0-adf1-4bd39889a1bb", "comment": "Malware payload (Formbook)", "value": "a6bb260353b28529332e0117a180b4bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139662, "uuid": "17e31c33-a9cf-459c-9a92-bb6b3977e686", "comment": "Malware payload (Formbook)", "value": "e7e775fb123a80ae7c57fa23883b060b3b333c4831d5272015c4751736bf2626", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139662, "uuid": "3f2244e0-aa09-4875-a0e2-07415223b245", "comment": "Malware payload (Formbook)", "value": "3a3815dde2eade0a547ce882a370b16ef85f087c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628139662, "uuid": "c262a0ec-a82e-4737-b431-04c86a7790f5", "comment": "Malware payload (Formbook)", "value": "d2a23e7481216f8354b523753b1afc33d3a1f86356eb63485725c85d96cc79eb2a8e31e95404031f119655667770a12e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139662, "uuid": "ca9a4b1c-06bc-46a3-9bfd-e9a4a5c2dae8", "value": "T18664F110B5C28933E661483568B0D9B25A3DFC711F709BEBA78D25799F302C28925E7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139662, "uuid": "13edf47b-dd14-4325-a773-60d1d8a51601", "value": "7f3a4a0e96d9bcc5b3425ad3dca611da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139662, "uuid": "754a9a79-701b-4f62-a1d3-e0c696df3669", "value": "6144:8GbfkNQfL5Pu7Z1XMZsAMpIsaH2atYjtpcVa5toTqALXlce6YxLC3:tbfkuj5bZWCsqLKoFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628139662, "uuid": "bf2f9749-7b70-4419-a1c2-cfeae02e9c72", "value": 335403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628139662, "uuid": "86c04fbe-9c54-4f6d-9130-48aed08bd73a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628139662, "uuid": "a841d1a1-282d-43a7-a3cd-13f9aa9b3444", "value": "Appendix No. 2 dated 04082021..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a758dde-f5ff-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1628176264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176264, "uuid": "e37c36c5-52d7-4038-b035-83413fd90232", "comment": "Malware payload (Smoke Loader)", "value": "94dfa0143d2c60b06533e35170aa64a1", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176264, "uuid": "871aeb87-f4cc-4128-8185-b3f0774e75bf", "comment": "Malware payload (Smoke Loader)", "value": "e816613a7090688c566359653d7f55fdd6a9b05e147083ab0b1bda1c567f591c", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176264, "uuid": "c40ddd07-93f2-4544-924f-1720deb6bd55", "comment": "Malware payload (Smoke Loader)", "value": "a1f70bf18eaa5548a8a88d3c2291a32c91bf699a", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176264, "uuid": "a92b4f38-9a93-4658-a35e-1e5316d5c8a7", "comment": "Malware payload (Smoke Loader)", "value": "5970f05103320bea4ba67cae57f04ea6afa96534b9cb721e78a37811b94a5a402a60cbcfd87bdcdaafa8d47ae4048c31", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176264, "uuid": "4940a557-4797-4c8f-a344-1978205a3b29", "value": "T15F14BE013580CC73F4513AB18896CAB56A2AFCF4CB219A4B7F85D6DE1F352D29E3534A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176264, "uuid": "4fe7b998-e39e-4e2f-a519-fd714211f11c", "value": "e905b204d022a4a3f9803ba3895bcbd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176264, "uuid": "1a441a38-61ce-415d-b106-e9c637fac254", "value": "3072:0OAEYXEh3z7gu2NJ1wY8IQtU1j553DkGD0lcMuFPybz7byVUI:FB7gu2NJ+Y8Rts3PZMx/bBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176264, "uuid": "974fa218-03c7-4e80-b5bf-1d3b3e5ac93c", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176264, "uuid": "9e7c38c4-50cf-4767-8aa9-99c29f88df3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176264, "uuid": "06f7697f-9e41-4477-a3fe-e5716576dcd9", "value": "94dfa0143d2c60b06533e35170aa64a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14eabcfc-f5c7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Lucifer)", "timestamp": 1628152096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628152096, "uuid": "e8fc3d9e-f166-4428-8f80-635f61a4d696", "comment": "Malware payload (Lucifer)", "value": "a550ab2eb388cda83468522da73c42d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628152096, "uuid": "b3ef2c7e-8926-4d46-a8bd-150389375669", "comment": "Malware payload (Lucifer)", "value": "e82e20cca7c1b1412dc50282699389562189c2e7babf3ecd20e660c512fad15f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628152096, "uuid": "9f0c24ec-a1c0-4e17-83a0-621888cd59fd", "comment": "Malware payload (Lucifer)", "value": "0ad75bc0d0f8ee8d3be68c78a7a4a2da77e25060", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628152096, "uuid": "c8ceb424-af89-4d59-b0c2-a3e6c00e9104", "comment": "Malware payload (Lucifer)", "value": "62819aa274307921c23e50c33b24c87da2db63b3216581989964c23f2af60a811c3e9fd00df86229b245668e12ede204", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628152096, "uuid": "dcd3dbd1-a1a3-4f02-ac57-f58255249b47", "value": "T112B328E637E48963CB4E573484D327487B36C01BB702A74786A9197E0D473FA6D4E887", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628152096, "uuid": "1900c304-cb91-4771-b857-3d5689e3d91e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628152096, "uuid": "c942cd7c-5dd8-4302-b20f-78c6bbc0cc29", "value": "3072:I6Uffp/dnX+0K3vLMCFAYg9qSRH4pIcqbyB9PCfsJx1:cA3vLfmqZpLqbyraU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628152096, "uuid": "d113b925-0855-49e1-ab8e-6bc0183ba16a", "value": 117760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628152096, "uuid": "184a31aa-def4-4a8b-8f17-ccbf0ea0f104", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628152096, "uuid": "14f94131-5b26-499f-b592-e3e3c614e28a", "value": "a550ab2eb388cda83468522da73c42d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c85deb-f60a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628181202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181202, "uuid": "03986d02-6ba8-47ba-8996-1554e89eff6c", "comment": "Malware payload (Dridex)", "value": "3ca23af839749178ff609c3d18333c90", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181202, "uuid": "86d42c32-b572-4a8e-b648-5c6982be3ef2", "comment": "Malware payload (Dridex)", "value": "e85ef796f7e1f29f9f7e48eeb79c6334e2d35fb67cffbbdd25e0b9fe3653786f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181202, "uuid": "21dda9e3-a896-47df-971c-ea9228e400ae", "comment": "Malware payload (Dridex)", "value": "525e3e272ec226538bf3f2207b4f5986ba945ae9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181202, "uuid": "e32c9b71-2b59-4459-b54b-289e3c4caf4e", "comment": "Malware payload (Dridex)", "value": "a62a46da1432c8ccd3bebb20ff89a44b2b68e49740f2b71b365570394a958df41b014bd5ece0e9a65e33ee6634a538fd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181202, "uuid": "40a1dae7-8f3a-4a6a-9282-3044b8ed7997", "value": "T1D804D042E3CE23D1DC97B43248FC262924F05444D85ADCFEC995EBACD7E1F574A64A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181202, "uuid": "503c09d1-7480-4924-b234-af5c27b29ac3", "value": "6eb7ecc6c2e948f718b1179f888ea193", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181202, "uuid": "1c161b6d-93b3-436f-af99-2f38829fd12d", "value": "3072:scYhzpn9z75jWpmrL3gA99hXkKsorn+AOr4RbjvaT:scIntom33RDvn+Rrkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628181202, "uuid": "e0e11e6e-08ed-4f64-bb42-97d12e65d453", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628181202, "uuid": "26579da9-9bf3-433b-ae6a-4a85969aaa9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181202, "uuid": "4ddc1692-a047-4f82-89ec-97394e7192cc", "value": "EqjZ2h4xhwnCp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4548ad-f5b8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628145644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145644, "uuid": "c0146cd5-b3f8-4d64-bd9e-3184518cf8d0", "comment": "Malware payload (RaccoonStealer)", "value": "64020c492253c5645c4b56524fb69d84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145644, "uuid": "2e7dd20f-299c-4dea-8067-49293a4fde2d", "comment": "Malware payload (RaccoonStealer)", "value": "ea02aff17e909206cf8b79fa445c5fe3deba9d0ee771f62a158cac4ac02f68e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145644, "uuid": "8050886d-03ce-4658-8bc9-07cc76d86f31", "comment": "Malware payload (RaccoonStealer)", "value": "1268babd418bf6dea9dde9d48621674d59ece590", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145644, "uuid": "366d61c1-9ec4-4ceb-b5a0-8fc6b98586e1", "comment": "Malware payload (RaccoonStealer)", "value": "b202dec03233ae74f16af468cb60b0a68c27f2cd50e342c6ce01ecb3a8daf10a3d18a5dac60eb62e7ad416ddc9c9154e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145644, "uuid": "7a4b4fae-dc9d-4b6b-a486-01c47b7a9f52", "value": "T176A4012136D7C077E12146744831C7A56AE7BC711C71A6CB2B8462BD3F72A92CF6B306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145644, "uuid": "f147b175-bddc-4380-a9ee-9f43606ce7f3", "value": "e2ba8e1f75a8e02687cc194905c50074", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145644, "uuid": "dc6c7161-ce8c-4e74-9715-055709b48d48", "value": "12288:SPD1S/EeR/jbC/0r7dkDNNNa4gHZsvv3quPw:So/5/3C/dBNNde63quP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628145644, "uuid": "5abaaeeb-0dc7-49cb-9f11-a93169bc0c45", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628145644, "uuid": "03199224-30d0-4787-ad08-88e16da273c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145644, "uuid": "9045d8f6-9f29-45de-af8b-4ce74afd96af", "value": "64020c492253c5645c4b56524fb69d84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e024fc79-f5ed-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628168758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168758, "uuid": "d47f8f1a-821b-4b8e-9a91-59d1e8e2182b", "comment": "Malware payload (Formbook)", "value": "b23671714a2acee8b2056b92844b2226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168758, "uuid": "cb825f3e-026c-490c-b947-b2f7c9c8d6f2", "comment": "Malware payload (Formbook)", "value": "ea38a026b9c1764cc7e1028c9674c2cb6fef4c4861ba643976c686ea79d040f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168758, "uuid": "56de372a-2a19-44de-aff5-1e2b6f5bc97a", "comment": "Malware payload (Formbook)", "value": "a48ae5691fa6c0ea89ea77f228325c62dfe6725f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168758, "uuid": "96b72742-3509-4222-99bf-079ac734536a", "comment": "Malware payload (Formbook)", "value": "ba03d0e2e1a411fd15c079ccc9f080ffc4769447235bec7bd54cc264eb21eb20de5b66b5a8236948975db5a456036746", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168758, "uuid": "964fd673-7d6c-441c-9a5b-75b29cf85f5c", "value": "T142B4F191B4C1C4F8D4784934CCA4D6A41626FCBA89614EEF37EC37AE9A311C2793716B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168758, "uuid": "68fd55dd-721b-4434-9208-eb5b5982c232", "value": "ea8de473df0698dc330fdb95b5eda1f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168758, "uuid": "4a825812-2ee8-4709-9bba-830660f38ddf", "value": "12288:sp+Mbi7sTn/NyYhj3lPUKqEVBgzdzVQAlZ9QwEN7Gq:sApsDVyYB3lPUK3BgDQA5jeKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628168758, "uuid": "df19167e-1ac4-4333-bfc6-b883b1ec5d77", "value": 523677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628168758, "uuid": "e01ff08b-af1a-40a3-a91c-f2137631e2b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168758, "uuid": "2b42820b-727e-4ec0-9aa2-b6fcf634347b", "value": "FedEx AWB# 774174658339,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12ee5ec-f604-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628178665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178665, "uuid": "da80345f-cabe-4e27-90c6-ddc1a5e09d14", "comment": "Malware payload", "value": "9454f13a4b45914f3fe2360cafab5c6f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178665, "uuid": "035d970d-3b1d-4dd1-b911-c6b326aca2c3", "comment": "Malware payload", "value": "ea9f05c0901d0d49db164b1f297db1e65fa167b4cd7724d4a79a20ab118da1b2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178665, "uuid": "3ac921d9-48d7-4202-a828-204b0094ba3a", "comment": "Malware payload", "value": "c54301ba41e01da9527f4be0ebf6219d2f6001d7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628178665, "uuid": "6426fd08-3235-4700-be5d-c46f03d707c0", "comment": "Malware payload", "value": "3f39356fafffa4787ca9f394d528205f18ee40d61d299e096b5b956e61c1e54cd61dcbd1f0d99d8a98fd720bd1c5b165", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178665, "uuid": "7d842a5c-0e10-4443-877e-727af7b152d8", "value": "T15BA340ACD46B01888F85ABBD1B2B6E41109C3A7DF744A931767C677827D2E7E610393C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178665, "uuid": "b3ec5116-d17e-4897-b824-c8238da84711", "value": "384:uU1rXiykYxH8bk23w5t4K1OOeH6GiazAGPoUFYV1+91N8e3avX/1Xwa:f1LioxH+w5t4QOOFGiH1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628178665, "uuid": "94452238-7446-4156-a63a-af9c306b074d", "value": 98532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628178665, "uuid": "25af1b67-156d-43c5-9565-13409a2172e6", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628178665, "uuid": "2a43338e-5ceb-4085-b96e-3c94e94ab640", "value": "RFQ-503196_20210805.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccaf9f4c-f618-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1628187193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187193, "uuid": "4bea05b9-eba8-416a-8d16-eb78a38aebc1", "comment": "Malware payload (njrat)", "value": "d66fac100b4268ce1451c8b5dc2a8817", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187193, "uuid": "abefe57a-f81b-4761-8a2c-c8e8c31acb26", "comment": "Malware payload (njrat)", "value": "eb688e9d721c561fe334147c66679bbd988da10c06704a15f048b97a9f6b0f7f", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187193, "uuid": "62a10ce3-efb5-4e92-87bb-d16ec220f7ef", "comment": "Malware payload (njrat)", "value": "2e567a9fbac1955a485ba2d6a86700b09362eecc", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187193, "uuid": "a97b6aee-d12e-421e-afa0-8daeabc4f451", "comment": "Malware payload (njrat)", "value": "2098380d9d6a52dbe25f4ba7e0583945f645898cfd33d69d63786e60f0aaa304d3f0433be30e7b45378ab45ad87391ad", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187193, "uuid": "80ed5d48-9adb-4bbf-856e-66476de13df7", "value": "T13FA2298E3BE4C618D3AC1AB64CB3A32493B6D2878551DB4E1DDE909B3F733904944EE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187193, "uuid": "69dac814-9eb4-44ef-b2a7-c576d40c0716", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187193, "uuid": "b4c70bc8-3258-48cb-9db6-94910c9eb488", "value": "384:427FIQ2xhDW7uqZMelh7kdcF//34ZocSTTnw:4dK7uqZlh79H0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187193, "uuid": "3042d66c-cfe9-4648-b655-eed85e5a296b", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187193, "uuid": "c9051cda-fe1c-494f-b2b9-b5bebc719d29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187193, "uuid": "915ac133-7d68-43c7-a608-192f0543f5d3", "value": "eb688e9d721c561fe334147c66679bbd988da10c06704a15f048b97a9f6b0f7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ab61f4-f5ce-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1628155296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155296, "uuid": "9bc7f969-f1ee-42dc-bffe-8e39eff56673", "comment": "Malware payload (Loki)", "value": "403b7f264b2b40d78edf80d4e12249a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155296, "uuid": "467d88df-0181-4939-ad6b-1bf22a50058e", "comment": "Malware payload (Loki)", "value": "eb9a651582acf7f2d5ed2b406d0aabafbbd705c668e23f5a2085ae39a1479404", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155296, "uuid": "990deffc-8132-42a9-8acc-471f9f85ff6e", "comment": "Malware payload (Loki)", "value": "fbed86ac5df153e41a5343783766d04a949e88ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628155296, "uuid": "e07e83b4-3bcb-49f4-9643-e8e5e3d66358", "comment": "Malware payload (Loki)", "value": "6f5bf5f3550c5e89d51f1f3820775bede7b42a5f6b89cd07b08a23e5dfd7703bfc7cd033fed22455e0c0637b51b397cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155296, "uuid": "bb4a6e3c-7f62-416a-b5a6-02f6816f8409", "value": "T168F46B2229EB114DF3B39BB50FD4F4BE46AEE673560EB0F639421B964322940CD52736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155296, "uuid": "2457a310-d607-4dd3-b473-9ac84c98365f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155296, "uuid": "d0c08df7-5cb6-4c5d-a1d5-b4e5af0a07c7", "value": "12288:UXjwEAsZ5oR65AXwgFvuSSeIRDu1buN0aumiG+0+enFCSlz6W6tp5WeSIsMgHO5R:AoR6qg7uRrDDeFF56WOp4nXFHO5uqUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628155296, "uuid": "15be030c-385e-4bd7-bec7-10680c093da9", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628155296, "uuid": "73c0c001-b37d-4751-8e6f-bf2cfada1346", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628155296, "uuid": "d87181f1-c5e6-4cef-91fc-2f81587eb171", "value": "Pending SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3b5052-f5e1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1628163569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163569, "uuid": "e953eb78-5dee-41a7-a09a-be41a6b4522a", "comment": "Malware payload (AveMariaRAT)", "value": "debabf3b961bfadbf6c44884464a521e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163569, "uuid": "f6605232-283b-4b51-8959-e4b61dd99f4f", "comment": "Malware payload (AveMariaRAT)", "value": "ed0e89048233a80fdebcbae8982ff3120c323e78172eccbd893383f289c6ed3d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163569, "uuid": "06b79658-0531-4c8a-8674-ff50f7b61fb6", "comment": "Malware payload (AveMariaRAT)", "value": "9525a5037dda07683a6a8bb04b95051573623fcd", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163569, "uuid": "890a7821-4f9e-4e7c-9fde-c99a285a4b53", "comment": "Malware payload (AveMariaRAT)", "value": "acbac6a7e6204204a5a503025278094cdf84addc39bd743e84525b8d3da7c5514c5b0c5c417ebf71053cd436876bd2cd", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163569, "uuid": "60a02cc2-7691-4f62-81c1-27d153b78838", "value": "T1FE64F124B5C4D472E5B314B05CA4DAB20B3DFDB05FA02EEF678D29694F202C04A66DB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163569, "uuid": "fbae55e2-ccee-4f8b-a043-2d280de1d8c7", "value": "7f3a4a0e96d9bcc5b3425ad3dca611da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163569, "uuid": "83b79a55-7568-4d26-9d9e-32163527fefa", "value": "6144:AWrf0xh3Hfr5YwuLpVx/yS/LjPw+Hc61PPZNZix5G1k4Wx1P+ivrUY8ix:xrf0P3HD5YTPF8mH8GeT2iv4Y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163569, "uuid": "f1409577-8479-43f4-9356-c3488369d9b6", "value": 333650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163569, "uuid": "53eeda5e-6cfa-4d8f-bfcc-a07935787ad9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163569, "uuid": "4ea04e42-251e-4b4b-8147-9dd72924d90d", "value": "DHL_consignment_number#6225954704.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52724167-f5af-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628141891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141891, "uuid": "d310c734-7871-4677-91ba-4c10d77d44c7", "comment": "Malware payload", "value": "8dfe116e4f82d6a6a69a25327091470f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141891, "uuid": "9cca7ee9-92e3-417a-9528-c50426e735b1", "comment": "Malware payload", "value": "ed4544f9e5b144199882d21bf0fd0aeed19f3277b2f1a4c0e3be785cf4397d41", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141891, "uuid": "1ab847fa-8e27-419c-9dc2-aaab9dac33e7", "comment": "Malware payload", "value": "0bafcf344679e3113db922a92e4f70fee90350cd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628141891, "uuid": "8953ef1e-6f97-493f-9c5d-ce441f56fa59", "comment": "Malware payload", "value": "6c1eaaf54c12e2ebf4a046d38353f082b6ab9f78ddcf49947b594611ffaebec1367626e0831bb8e7cbb351f83f9f53cf", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141891, "uuid": "748af2cc-e7e3-4165-98ce-85a47055723d", "value": "T11695F03132E8D039E2B61A39DC3A86F05979BD24DA23C15F53647D1E3971E809AB3376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141891, "uuid": "7d85654d-6608-4ff9-bc8f-ed39b0d65fae", "value": "24576:l8FLV/fR7LTqlDb6RfqlUIut6gPMqLFXXWQl0I4S6tCi+VKuwMUUGGujD3XIjt03:lMLI3pXCLLZldj6tCi+KXXGujLYV1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628141891, "uuid": "2eaef65b-7c5b-4633-8eed-8a821e97a134", "value": 1896448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628141891, "uuid": "772464d2-4a49-4e0a-95d4-3699f112bd65", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628141891, "uuid": "e75fac1d-c06a-4b38-87b6-048e67fb5ff0", "value": "Mosef.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc55df06-f618-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628187273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187273, "uuid": "31db3d7d-5e1f-4a03-9223-6085e998e067", "comment": "Malware payload", "value": "c1d4cd3f7d5415127ca216c696faf3ed", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187273, "uuid": "b1350ff0-a4db-4cbf-8984-3d54fe963b9f", "comment": "Malware payload", "value": "ee2cc931d5b4bad780abb0e5cee7d9bb51916035e4cce0e8239fe0a444ed523d", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187273, "uuid": "a1ab558b-c513-41af-97da-3f5949f442db", "comment": "Malware payload", "value": "20777d706729a819dbdaf225b7e6351b89f093fc", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187273, "uuid": "1459e1d0-dd89-453a-8dd2-40e33fe465e8", "comment": "Malware payload", "value": "afc732478f357a2ace32e25daf368aabc2b4706391909a3d6f7f2e0ded7df2487586d793847d79676154743ed8f9287c", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187273, "uuid": "4a77f05a-51bc-4731-b93d-11f179961c7f", "value": "T167621859FFE88376D5EC5EB11C73A20007F9D2029C22EB2F5DCC946A2F53AC54A64B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187273, "uuid": "adddfb7d-cb81-4560-82d9-803f6d83c42d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187273, "uuid": "4dc4aa10-534d-4186-a475-bdd66d64f633", "value": "192:mD20IbT4eB2DPQuQoAVKvr3QWfxd1obkB0g9oCAts0uOTpKyxLmbfvSTgVtkv:MwzBC4ZoGexfobCD9oCAt9pfQt7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187273, "uuid": "e97ce137-2b32-457b-9ce2-0389f74134cb", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187273, "uuid": "9de85061-d26e-422f-9a89-898a5f75874b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187273, "uuid": "425d903a-2c82-4a67-89b6-a23dc13b13a4", "value": "ee2cc931d5b4bad780abb0e5cee7d9bb51916035e4cce0e8239fe0a444ed523d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6170e99e-f600-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628176706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176706, "uuid": "33ab8345-521d-4840-a394-268aa86de92c", "comment": "Malware payload", "value": "a551bc7c95ea5dd39255a0fc48033f89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176706, "uuid": "25efc75d-53b2-4bb5-9f6e-5218f971dd5e", "comment": "Malware payload", "value": "eeed35b6db912ba4accd50f23c4abd5f517cf9bb2981e1286c1783424121be14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176706, "uuid": "67fd661c-4146-4124-80ad-349d56f24138", "comment": "Malware payload", "value": "2056ee8482eaac060e050e15441999cfdf4385b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176706, "uuid": "ee4bea03-2cfd-44ea-96c1-f790767ca507", "comment": "Malware payload", "value": "ba7513b549a83277f8dea26145a0488d8d5c4a59ebb6f8e493ddea5663c040143a905c0f5ab94732b36daf0986b55909", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176706, "uuid": "badd433b-e945-4136-b683-bd50dfe70375", "value": "T194E44B92F2D0803AD01A653E4C29AF64A66DFED14C28588B6BFD3A4C5776F01743E49F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176706, "uuid": "1f83449c-780b-4ab9-93f1-bb48b85fb6d7", "value": "f1f21c88e9cb261ec581191bb4c538e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176706, "uuid": "4b40601d-abf1-4a11-865c-53254f069fff", "value": "12288:cLJ8IaEF3CbhMemzpeVhpEj7c0DFtImnuf:cLJRaElQMePyNtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176706, "uuid": "945858ae-5049-475f-9daa-d538a1153f94", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176706, "uuid": "67eb8a73-7d8f-4a2c-a6d7-c6ab661d34c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176706, "uuid": "98596bdb-231b-41bf-b0f5-90955d7eb029", "value": "a551bc7c95ea5dd39255a0fc48033f89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619e6ee4-f5b7-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628145353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145353, "uuid": "bee07c73-0b2c-4506-b1b1-3c81e8c34dc7", "comment": "Malware payload (RaccoonStealer)", "value": "6f27d8b8ab8e8e64c6d59b598fd89bfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145353, "uuid": "addf08db-0e19-49e1-bccf-836094ce1207", "comment": "Malware payload (RaccoonStealer)", "value": "f0cf66b63a73642f666c9649e2f34351afa85e954d28289fcefd91ab7ec1983f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145353, "uuid": "b229ce58-5ac2-4120-914e-d6237202f5ae", "comment": "Malware payload (RaccoonStealer)", "value": "d7d9a3440fc0a08c89b644332478e84b80959d56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145353, "uuid": "0f34d03e-1d1a-44a4-8360-7514302b3301", "comment": "Malware payload (RaccoonStealer)", "value": "cec307005b04e952c0c2eecfc61919d6d37e0741149fe2ac4f62c770d0106f69a552dd04c1c5393107b5e73b0d8ff1ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145353, "uuid": "70533f03-3d15-4316-9d4b-848b156d9dc7", "value": "T1B3A4010279D5C077E4634E728861CA665B6B7C38493469EBFF8DA7287F32182CF69305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145353, "uuid": "5a943c0b-2dee-4ab4-9a0b-03ec18d7ec75", "value": "2a9c1ca66125aeff7a1c36242be63d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145353, "uuid": "a142f2f7-bf6d-444b-bf1a-bb2261f5c62e", "value": "6144:m6KLpLwDot89AxJpmrEiLNH4O18u0Z2r560gBYW5r+sIJ+EOImCwU6tl:XWp7t89Ax3m4KNYNu0/SeIJ4Ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628145353, "uuid": "ed306cd3-f159-46cc-8f2d-c3493a81f27c", "value": 473088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628145353, "uuid": "bb4ae329-cb8b-4acd-91ea-728a931ef20c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145353, "uuid": "f7e09f28-0df8-4401-b997-ba87181e95a8", "value": "6f27d8b8ab8e8e64c6d59b598fd89bfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f868e4d7-f618-11eb-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1628187267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187267, "uuid": "666d398f-dbb7-4956-aad5-240f595df8c3", "comment": "Malware payload (njrat)", "value": "d33dec279966da2024c05d5fde688253", "object_relation": "md5", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187267, "uuid": "3d002d5a-f639-41ca-a1ba-ef9ae1d47969", "comment": "Malware payload (njrat)", "value": "f17fd9ff93d1b3db6c3e4463d5ca5c11b99827890c58721d2860df75d4323705", "object_relation": "sha256", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187267, "uuid": "94abeec5-d575-4994-8d6f-bb207283a904", "comment": "Malware payload (njrat)", "value": "74bde021ba65fdd33fd420568b6a2da406ac07e8", "object_relation": "sha1", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628187267, "uuid": "61fcc28a-f87d-4e88-af89-aedf456bc896", "comment": "Malware payload (njrat)", "value": "470d54b1bab976b5017c96c1a7ca6feece1f7b6e58b79e58e3afed7c1cf61fc023de67e9ddf7f635a712726a74004635", "object_relation": "sha3-384", "Tag": [ { "name": "149.248.52.61", "colour": "#409979", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187267, "uuid": "5c6b4881-a778-447d-8562-fada11e1c295", "value": "T11F451202BBD588B3D1331D325A359B21A97C7D200E38DA5FB3D45E6DCA711C1AA34B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187267, "uuid": "7e3c844d-d6d3-41a9-a5f6-5fcfdf9496f4", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187267, "uuid": "35f8597e-8cc6-4183-a06d-a6d9c47962d3", "value": "24576:ANA3R5drXPrfi4T6sNNuT0Zb7mnyxuYuroyvUC0l6:55jl6GuT0tmNTrTsCe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628187267, "uuid": "488c53ac-d4ec-42c1-8dd3-dd21fc12922d", "value": 1220614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628187267, "uuid": "efe5b8d3-a84f-4471-8bf8-fb595c756c50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628187267, "uuid": "ad2404e8-a055-4290-8a99-d9f1c34b173b", "value": "f17fd9ff93d1b3db6c3e4463d5ca5c11b99827890c58721d2860df75d4323705(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10eec082-f5b8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628145647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145647, "uuid": "e901c425-b0d5-4ee9-b4dd-9449efe3f2b6", "comment": "Malware payload (RaccoonStealer)", "value": "0f44283d911fd4b823fcad624ca9deb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145647, "uuid": "38c6c80b-4d07-4c0a-8f38-48d387f9e8de", "comment": "Malware payload (RaccoonStealer)", "value": "f31538e8ea191fbb1ea2e89e4c3e9e8e6882aa31ffb225b35b3f68db4dbd83fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145647, "uuid": "af4c35d2-7027-429e-a0c5-917d5e14af24", "comment": "Malware payload (RaccoonStealer)", "value": "130ba0b8621de4efe5a38473330d275ff8b6fac1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628145647, "uuid": "41f5e466-3716-43de-ab84-212e721b6190", "comment": "Malware payload (RaccoonStealer)", "value": "3e82767ac70c46bc1a9bb08b71eacf30fab030f225be56bd170a043627a64e5804b1d072ba6e56f2b1a1c69584cf1181", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145647, "uuid": "b0b586b9-3a9c-498b-bf66-64db9cd32f81", "value": "T12DA4022135E2C073E15106B40C65F6926BAA78B05CF45ACB7B8E72BD3F71692EF1A341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145647, "uuid": "b2835ec1-fe83-4c23-b5fe-fc94352cb31e", "value": "2a9c1ca66125aeff7a1c36242be63d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145647, "uuid": "0074ed1e-12cb-44ea-97f6-b9e664ee5ba8", "value": "12288:Y/cnGM/8xn2SQjd3tG7fJKBbTb9SaUR1:YK/8x2SQBtGQBbTbAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628145647, "uuid": "2b71a8be-be41-44b4-977a-2bcbc545579e", "value": 473088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628145647, "uuid": "0b0ec396-b6de-43bd-af71-37af60aef939", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628145647, "uuid": "ef415ee8-285e-457e-878d-275a8539a397", "value": "0f44283d911fd4b823fcad624ca9deb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01bc0664-f61d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1628189000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628189000, "uuid": "e0e5e234-6c79-4ce6-aa91-3e1a7ad0e77b", "comment": "Malware payload (RedLineStealer)", "value": "a1a42afb2f1c3bd8712afc75994dbf59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628189000, "uuid": "b83d591d-ff5a-4df2-a915-ad83a519f736", "comment": "Malware payload (RedLineStealer)", "value": "f45368b12c083d91a92fa5e629986e8f06b57970ce3718ea97514fc2eed0cf9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628189000, "uuid": "933b76f7-4cb8-4d86-93ff-6b16d4fea6e4", "comment": "Malware payload (RedLineStealer)", "value": "93c069362d05e82f9f273b8ce9a878ff85ec93bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628189000, "uuid": "21ed5e9d-1876-4a7b-8f72-57ccd19c505d", "comment": "Malware payload (RedLineStealer)", "value": "78cbb7fdd5de3b7001372e96fffe225fb7ff3e7ad18213ee7fe24b0a8dc1c634647fb6b8a92047ae132c5b8132af5d35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628189000, "uuid": "a09c2f29-bb33-4730-819b-918d488ac372", "value": "T1D3D402123640CC77F6607AB18D55C7B14A7BFC79D82A9A9B3B85534E2F212E29F31306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628189000, "uuid": "70fd97c8-9106-4b68-9efd-6bce7076ef05", "value": "7d2c4701a9e00af48c63738cadcb0b55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628189000, "uuid": "405bdf5f-6a61-47c5-98a2-6a6e06049e75", "value": "12288:/lCjdB49pVPgGCXUiKZad6glSisBi4eqQOC0ELrFaEZe1W3OiP8DrxY/:/z9fPgGuhK86glBL4eq+0ELQAe1WeCWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628189000, "uuid": "374112b3-131c-423b-9733-42f804bb3a19", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628189000, "uuid": "870a29a1-fdb6-40d6-85bd-817e8c8942f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628189000, "uuid": "a893f5ed-1503-4a21-b460-2683eaf278b0", "value": "a1a42afb2f1c3bd8712afc75994dbf59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dfd91e3-f62d-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628196108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196108, "uuid": "0babc170-7bb1-4121-a5e8-d66746c9adb4", "comment": "Malware payload (Mirai)", "value": "e57ed2f54fb08aa00dfaadb4c9e0f9a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196108, "uuid": "9cda3304-ada0-4c75-990d-5c127fe5159f", "comment": "Malware payload (Mirai)", "value": "f497a17cda95a0f60ec5b0795750d07dac4b90935f566889217b3da388d9c4bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196108, "uuid": "94193f77-3390-49c6-b05b-36736982cd2d", "comment": "Malware payload (Mirai)", "value": "6ea19af90b8b4280b141202df3963a23fece298c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628196108, "uuid": "06663295-7346-4c9d-b45e-f370de05b6b2", "comment": "Malware payload (Mirai)", "value": "383d2d6df0e9f3670a79e38939af4aada32a54c7e3b0bb03800b4f7b7e11795651590e0c8cde6bab0625ddf8ee02945f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628196108, "uuid": "ffa3b57c-5a84-444d-8023-c97377821bf5", "value": "T13773284ABC818B12D5C522BAFE2E018E3313576CE3DE72229D149B2477CB96F0E77615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628196108, "uuid": "24d7935e-636e-4810-ab0d-2d92b33c1f2d", "value": "1536:flnRKSpVML+xJv5d29DGgdTaIijz3IBimQtoBWx/b656YF:HpHzxp8aEQtoBWx/b6MW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628196108, "uuid": "65e75fde-314b-4b09-b4df-30fa8f268568", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628196108, "uuid": "cbd01a0f-1bab-4e7b-92e3-a224b08c0cd0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628196108, "uuid": "647f9748-e2ba-4c48-bd67-ee68e084486a", "value": "e57ed2f54fb08aa00dfaadb4c9e0f9a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b7ae07-f5ee-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628168812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168812, "uuid": "ad8dcc8c-3d36-4d24-9171-7a0f999b06d0", "comment": "Malware payload (Formbook)", "value": "ae60fb877b44fb7cae71fb5f57207aa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168812, "uuid": "ec105c33-312b-41a3-bee1-839c01624438", "comment": "Malware payload (Formbook)", "value": "f5f438857e1d75cd3a0c7c8d8fde494ec31705db16f19e3d026d9f09e503fbf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168812, "uuid": "6b795e47-7c26-4936-87a2-cdbb631dd80c", "comment": "Malware payload (Formbook)", "value": "7b3e167a838b09e52af62ba99c0702a150ea6f94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628168812, "uuid": "988b6717-7f56-4eb3-8b6a-18e703a4e6f2", "comment": "Malware payload (Formbook)", "value": "b6ed2af53d300f4fc50634296871d9cfd3e0320f132822e9f3b92aae690841c42cdaffd4c097a7d8776d97a14995d60b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168812, "uuid": "0ea9ba47-828d-4e51-a5a8-69be630893d1", "value": "T1F8057C2229EB059DF3B29B764FC4F8BF56EEE573570AB0B638910B464322940CD61736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168812, "uuid": "a70d8a3d-a1ef-491b-abbc-0c910556a83f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168812, "uuid": "8dce51e1-1882-43ca-8428-35c9356144bf", "value": "24576:ioR6qgmswwE1p80qdg1+81OM8fEj1zUgSLFWPZy2:hsKbY0qds+sOI1IguFuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628168812, "uuid": "d71cedaf-863c-4bb3-86e3-42990e6faee7", "value": 871424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628168812, "uuid": "8c140592-a717-403b-9fb9-648a4ba4045d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628168812, "uuid": "42d56dc1-2e1f-4d4c-b682-77682b85dd12", "value": "P.O Contract #007676.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4044cc6b-f5dd-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628161617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161617, "uuid": "9916fa1a-d3f6-41e6-a4a3-41126dfd6059", "comment": "Malware payload (NanoCore)", "value": "5261b690a9c631168bf7c369452ec2b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161617, "uuid": "62da036c-5ef8-44ff-8efe-2ea3cd389890", "comment": "Malware payload (NanoCore)", "value": "f61ec8c71bac6919062cddd77fa7fc6fa664c31cf71023925385d37ee42dc673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161617, "uuid": "6a804ef0-5cab-4a68-9d21-e07334677860", "comment": "Malware payload (NanoCore)", "value": "93d78f3a3b2537084f67e5d64819017d4d4173ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628161617, "uuid": "b68fff70-369a-4a58-a274-29d153b8df9c", "comment": "Malware payload (NanoCore)", "value": "bf9981ad4c8c3b0b7144e089f989d73395d5767d2251d5887d8780489c62a0225fcf46f5fee7ab3971a6455e52d58c4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161617, "uuid": "cdde61c5-e149-4922-b074-4e4d8c8cd0c7", "value": "T1BAE518B9AE9C455EA69D0437F4ADC68DAFF16F07D5D3B0883B832A56101FE2EA3150C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161617, "uuid": "c16804a0-66bf-4e03-adf6-b18441928318", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161617, "uuid": "d17df3b8-c03b-4ba0-87f7-0f66a908dcd1", "value": "24576:gwcQzHJLSkwTu2G7lWSh/TlDJNviZYwdpj3z94dpxeNgiDh31T0Bo0GFtAiS+x:1wTu2GzHHiZ0dL1o4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628161617, "uuid": "51a6bad2-6287-4d0f-b726-ce103b421d1e", "value": 3170304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628161617, "uuid": "cfea84fc-3bb8-4c2d-8dac-5b9570e9a174", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628161617, "uuid": "7928f881-1295-48f4-ba53-0aee56e0ba47", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3544188-f5b5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628144657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144657, "uuid": "6b3023d1-6d3b-460d-8e65-5bb5d4832c02", "comment": "Malware payload (Formbook)", "value": "1ec4227e01f054e388d706bd2467940b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144657, "uuid": "16944487-b7e9-44e6-9937-48eb1a298c1e", "comment": "Malware payload (Formbook)", "value": "f676742212a35929267bfd3750a0bbd5609de0cc2ad43955331d2b3f27af6e8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144657, "uuid": "aaa6d41f-642c-4a51-8882-42aab193c94e", "comment": "Malware payload (Formbook)", "value": "990defee5baadc100bd9c5e535a551ad83d05dc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628144657, "uuid": "156bc733-1b70-4ad0-8fab-97250bfd9c5e", "comment": "Malware payload (Formbook)", "value": "263cc7d840daad086e722576f9d523807701748f9daaac6c6b844c8e42e82e563f0b52cbc7eb003f48a18699132c9926", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144657, "uuid": "d97f7e86-671b-4f56-9627-960519d30a53", "value": "T1CD64F14A35C1C432D6262831A860CFB05B3EFAB04F701FEB67D859394F646D15926EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144657, "uuid": "4c61de3d-7018-493f-909f-7b0b32dfbb17", "value": "7f3a4a0e96d9bcc5b3425ad3dca611da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144657, "uuid": "dacdd062-1efc-49db-b82d-7e2b74269e90", "value": "6144:jZbfkNQfL5Pu7Z1J+JJWFJmw+h9CwlZnbEnxDs6/DcO7tyn4btBj3qN:tbfkuj5OjYwk9/Q3QO7An4bnj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628144657, "uuid": "5a61627c-71ce-405c-8b70-e1623e611004", "value": 332846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628144657, "uuid": "0665f551-445c-4943-b081-5dbb08b89d4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628144657, "uuid": "dfc5ddf5-8da3-45fb-8b13-f3c177748676", "value": "PO 331385674200010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c51dc05-f5e8-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1628166496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166496, "uuid": "831f82fd-ff33-4b19-b0b8-0810d92ca22a", "comment": "Malware payload (NanoCore)", "value": "334782b6162242816e2b287d3c36aeaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166496, "uuid": "74a7ae68-3316-4511-aa12-8612a26a58ee", "comment": "Malware payload (NanoCore)", "value": "f700227db2f3823db45b8fa8f2341966c5d2de035f41b04b64714d6caaba92a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166496, "uuid": "11f4068f-7ca9-4cb9-ac5a-b67ee277c1bd", "comment": "Malware payload (NanoCore)", "value": "7b0d89e4cb7b6f738d53743d2d531af614266815", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628166496, "uuid": "40017580-ddc8-4cd4-9724-94cfa2dd00a5", "comment": "Malware payload (NanoCore)", "value": "e42443675dd23c2d4270b2fd2e4f6f5cb5c0f1fc6eb805d3847bf028a711c1c53255e0a9fd8457df83047922734955fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166496, "uuid": "bf8dd101-e845-4c29-aa50-d1a9c8b99541", "value": "T1ED157B222AEF145DF3B39B760FC4F8AE5AEAE677570AF0B638910B554322940CD60735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166496, "uuid": "80476902-080d-4a02-90cd-11d9a360a70d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166496, "uuid": "6cffd4ec-9eed-44cb-a528-17193f72e1b9", "value": "12288:HSloR65AXwgFvuSSdP3OwIWXmOByE8b1gVnuKuXho//66KAEEID0lOEU5Ac3iCHM:HuoR6qg/3LmjpeuKuX8C6KeID+OxRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628166496, "uuid": "4bfb73f9-54b7-4571-85dd-773bae55cba4", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628166496, "uuid": "d417a770-2ae4-497a-ac54-a78d0f26a52c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628166496, "uuid": "7f1fac64-2256-4e68-9d50-55d29f56d2f6", "value": "payment slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d3174b-f5cb-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628154142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154142, "uuid": "79a20586-f13b-4a8f-9761-fd287f22c0a0", "comment": "Malware payload (AgentTesla)", "value": "b31897885eed4a19ac5d844e7129b95c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154142, "uuid": "81247e71-eaa1-4c99-b175-9ec8ae4555a7", "comment": "Malware payload (AgentTesla)", "value": "f85e23a9186f817f26ac8ea4d90788b1a2b341118defbc2ba92b7e3756681b93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154142, "uuid": "26f2d8e3-c648-4e54-abb7-80ca3689764b", "comment": "Malware payload (AgentTesla)", "value": "6864a7b4e1e71ab9b850f5fa50002000a7d4dfce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154142, "uuid": "65c291f9-4d9a-4490-8562-905e7e8281e4", "comment": "Malware payload (AgentTesla)", "value": "2844c5d56ee325773669fa2194f9d85845e46ef216edc9d8c320f79af5b09cc5cc038ea16ae9ae44fe86c103177fcfc8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154142, "uuid": "265f9aa3-19e5-4af9-852a-9a0885be941e", "value": "T10C056C2229EB114DF3B79BB60FC4F4BE46AAF673160AF0F639921B954322940CD51736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154142, "uuid": "8a7a9e24-3640-4288-8c8e-0cbb4ee57070", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154142, "uuid": "6e0e8a7b-d799-4cf3-bab0-c3c98ad37de2", "value": "12288:YXjwheATZWoR65AXwgFvuSSaIMGTIotWroHY7Iq0iQd9ppR6Jlk7YPZ8U:7koR6qg/0otN/D99pa88mU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628154142, "uuid": "29f02643-7a03-406b-b677-60fec03c8bc6", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628154142, "uuid": "69bdafa2-eb88-4d05-873e-ace1f13899d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154142, "uuid": "3702717b-4172-4ab3-8ff4-b2800f55d47e", "value": "VwzS8y6GLlAWyz5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e9d2b7-f5f1-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1628170435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170435, "uuid": "17c92b4a-7f0e-4a2e-90bc-7272ba82efce", "comment": "Malware payload (Formbook)", "value": "9a088b75ee4a463c2fb6b96c9d59ff46", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170435, "uuid": "cbe622d2-f8c8-46cd-9379-0715bfd3d2c2", "comment": "Malware payload (Formbook)", "value": "f9447e6f26775ea209542cdfc7bb9ecffa28de1a85c18f149907529604838e9b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170435, "uuid": "58d00978-8ba8-4599-89e1-bc4b8a4b0dd6", "comment": "Malware payload (Formbook)", "value": "5effddb62b9c51b1aefb8dd3784426a450db3d2f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170435, "uuid": "431c68df-cb3e-46ec-a289-336aa35c586e", "comment": "Malware payload (Formbook)", "value": "adeeec50ff58915c435ce99d973c940491d75e81bc0f9193a9ac2c71ca288bd9d27e601708403b1de433e0a0d1a2da88", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170435, "uuid": "c24d56a9-cc44-4afd-b530-b2a9c53f5b24", "value": "T1B8552398AFC4472BE21F41394C179F7557AAEC133BA8F526439C734A72362A016A77CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170435, "uuid": "58211603-6ffc-4623-b4b9-9ebe364c7b57", "value": "24576:STnhfQMzM+LDLL/x9ws+KsGkZN0zNWaAU4MK0jEFpmEapTzIRc7v+qqznpKo:SThfQMzM4X/xysIoAJlMLhzIi7v+qqzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628170435, "uuid": "88c26bb8-3064-48e8-b029-cc4ccab8db81", "value": 1368064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628170435, "uuid": "691d46de-63bf-4500-89f2-5caed42992ff", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170435, "uuid": "8a80dbd0-23c3-41c3-9cfa-413c8bc9f63f", "value": "Agency Appointment.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e088c3d6-f62c-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628195817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195817, "uuid": "a9c3337d-dea2-4a79-9e7b-9e16b2d68875", "comment": "Malware payload (Mirai)", "value": "80cc25d03665c6d194b1de24f03fbd34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195817, "uuid": "21eda658-fdaa-4db2-a4cb-5bc9b47d66a7", "comment": "Malware payload (Mirai)", "value": "fa196bd3ad5fd4b33b6fcdb8ff050cfe303dc12e553f239d371a86373f672d95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195817, "uuid": "001c6dd5-7713-45d6-b875-2c3a4a89db6e", "comment": "Malware payload (Mirai)", "value": "ae154591d626bd13cac5959319324a31ade9c4d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628195817, "uuid": "9b112733-9b27-4f9e-8bc1-fdee99dd0313", "comment": "Malware payload (Mirai)", "value": "467a2958ec380ecba0583133337cc1de511ebc135883758f82a728507ea6df0ef3e93bb22e4478fc5befc7b380710956", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628195817, "uuid": "8a149137-07d7-431a-873e-d19e8de5a577", "value": "T113633BD6B800DDBDF80BDA7A8413050BB630B39246A20F36676BFD577C731A85927E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628195817, "uuid": "c232a5c7-e7df-4ad5-96e1-7fb9ab0ba9b0", "value": "1536:gkjfliTZ7iLRqYC/TKHAz5ksi7A7Z/7/0z8wnty23EAI6cOqsLD1mD8n++:gifxWi7At7/0ztyAI9Bf8++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628195817, "uuid": "cf0e7d54-aff4-4eab-8d55-965b35a0b0ab", "value": 68860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628195817, "uuid": "bd44e1f9-dff9-4d91-bb63-b5ad83daa7d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628195817, "uuid": "8116bfa3-8648-4391-aec5-5684afa12266", "value": "80cc25d03665c6d194b1de24f03fbd34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c42ae66-f60a-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1628181045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181045, "uuid": "67c08a9e-2230-44c7-aeb4-40d8e4608203", "comment": "Malware payload (Dridex)", "value": "f7f3b808180d0d7a498a9d7b022faf7a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181045, "uuid": "1d827ba7-36e1-4f59-95d1-c2c2f7490a1c", "comment": "Malware payload (Dridex)", "value": "fa287fe02d71ed4b44938c6cb1f08854c8d8be976b5df11dca5d5719d7555799", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181045, "uuid": "95812ab0-c6cc-4c96-8b99-df81b5be096a", "comment": "Malware payload (Dridex)", "value": "cbcdd285f86d3cf2c8474280b3eeff898e5e5e17", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628181045, "uuid": "682244b6-523a-4751-a389-97c22f3feba2", "comment": "Malware payload (Dridex)", "value": "cede3905b33a4bcae48921fada99c048c06399a41889d8a3627ca415d04ad1a5692f792ffd78c5ed787abcf0b621b711", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181045, "uuid": "75bdf0f7-8fcc-40f6-8446-b73f5880cb88", "value": "T1A404D042E3CE23D1DC97B43248FC262924F05444D85ADCFEC995EBACD7E1F574A64A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181045, "uuid": "65747c82-62a3-4fbd-97e8-a4543f2a8771", "value": "6eb7ecc6c2e948f718b1179f888ea193", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181045, "uuid": "1c42f5ba-33af-45a3-b59c-5e162efd919a", "value": "3072:EcYhzpn9z75jWpmrL3gA99hXkKsorn+AOr4ROjvaT:EcIntom33RDvn+Rrxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628181045, "uuid": "0ddc120b-9988-4bc7-a227-b0629001b836", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628181045, "uuid": "9d7e74fd-202a-4df0-8445-b2395db1a70f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628181045, "uuid": "19f2301c-7a7e-4bbc-b136-ac6bd43f8ade", "value": "uJcx8qCuTZnP.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e1e663-f600-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628176686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176686, "uuid": "2657665e-f188-40a5-9af6-0a28a4ad5add", "comment": "Malware payload", "value": "df5e3ee9a6098d1e29b31603672d5a8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176686, "uuid": "8bc7d5ae-73b9-4801-9cb6-659a31514658", "comment": "Malware payload", "value": "fa98235aae1687afb628d39a16645b6d2f4afeb97d113229c660425464e296c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176686, "uuid": "9e2f6d3e-99d1-4f64-8f4c-a0120ad7f385", "comment": "Malware payload", "value": "0af2378effff0a7451317874efe4e6682365c03e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628176686, "uuid": "9434166b-7bab-4ff1-85c4-a934f4a7a64d", "comment": "Malware payload", "value": "81169218cbfd8c21e50a1e7fbbbfde709502e813d903566d6e642f1219b21542c150e2646ac839b8ff6ab08d09199541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176686, "uuid": "d1d8e485-27ea-4a2a-99da-5ddd9ae4de9e", "value": "T12FA47B6F3650619FE47AC43DAE681D16F524EEE3F6CED483E4431188C93D9839A841BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176686, "uuid": "444f4dd8-d83c-4947-861a-5c349c62f15e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176686, "uuid": "12bd4e82-7033-485e-9324-5da268f0373a", "value": "12288:QkK9h6wAtre8k9SyaqSx5lEdu54rcfQbpQfcom:QX9h671k9Ja5F54A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628176686, "uuid": "1eb0cf7d-780b-4589-92dd-da63654c8de0", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628176686, "uuid": "a92a2bf4-6f92-4647-81d3-53d281a9052e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628176686, "uuid": "aace6f42-ced3-4a33-ab8d-1b3d1c1d8bdf", "value": "df5e3ee9a6098d1e29b31603672d5a8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc38e540-f5f2-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628170872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170872, "uuid": "3d7b326f-3836-4c89-9f76-8633024ec9aa", "comment": "Malware payload", "value": "a0e384da6258380d1b1df90f8bf160c0", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170872, "uuid": "e64453f8-fc49-4481-94d4-39f15ac73711", "comment": "Malware payload", "value": "fb7fe37e263406349b29afb8ee980ca70004ee32ea5e5254b9614a3f8696daca", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170872, "uuid": "970b1dfa-635d-4973-badc-3c18a323e66c", "comment": "Malware payload", "value": "fd0b27a0b2f8713c3272d4854fecffa1bc300aca", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628170872, "uuid": "10ff06c3-5e8a-444b-aa89-8652bd5bbde7", "comment": "Malware payload", "value": "96f5a0d6297ecdc7892d88b18628ca6f4bd8251a6477515036bc0bdff640de84ab2d9ea8080213272b6e03ab93b91bf8", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170872, "uuid": "4318f0e2-4f18-4356-9e30-0c8740f6a414", "value": "T1A93402FF15D0D8A7D0E6003781D6429C3FD697FD2294F1305627AC9C39ABFE46A485A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170872, "uuid": "b50ed685-d4ed-414e-94ef-c038bb2553d7", "value": "6144:+yId860LCZ0al467daz6AyXk4YyId860LCZ0al467daz6AyXk4M:+yP6O6N7k6HYyP6O6N7k6HM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628170872, "uuid": "ea60d12a-4384-40fd-ba1c-40b69f334a30", "value": 252007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628170872, "uuid": "bdf3a193-379d-499a-90d1-ed958393f116", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628170872, "uuid": "ab3544a9-43a1-4bb9-92a8-47e30e3a6216", "value": "Request_for_Quotation.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ee0087-f5a5-11eb-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1628137501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628137501, "uuid": "db7dbe75-5afd-4036-a2b5-fa52a71cde3f", "comment": "Malware payload (Mirai)", "value": "f89000531b994153a3e9d55a0c3bae5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628137501, "uuid": "fbc4dc2a-7857-4736-ab8a-c8922c086b7e", "comment": "Malware payload (Mirai)", "value": "fbfadce5ac07df5704d5828c303a8014f1970b580cae114304c7d362f15f54cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628137501, "uuid": "5aae84fb-d152-4890-b547-5cc1dc6e39cf", "comment": "Malware payload (Mirai)", "value": "7dd055fc4830b64b6c4f74b8724db24bed0e6a05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628137501, "uuid": "bff79c1f-2069-4572-bf39-782585c5cc6a", "comment": "Malware payload (Mirai)", "value": "f99cca3ac2f8c5f37f92f55c7cecf864d8a2cf565574ec5498a4398e717d8e5298343ad166012e967cbb5cd2ca19c66d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628137501, "uuid": "18337c24-5db0-4428-a4b2-38eb1f87446f", "value": "T1A864F1CAEA01AD7AF9C947B96A6B0B0973F1CBD8D3C3B140E224C6543DAD3459B645C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628137501, "uuid": "e3def31b-e299-48dd-a557-4934ae475dea", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6conqwPa5POdOQ33Q:7O/QJHZweEL/NOjCHm7FZZncMqfPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628137501, "uuid": "75259d63-b835-480a-b609-5ea9da492740", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628137501, "uuid": "e4503b07-333a-4b1f-a422-39069c80e1fc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628137501, "uuid": "7ebf04f9-4cd4-4626-a8fa-4fea7115e8ba", "value": "f89000531b994153a3e9d55a0c3bae5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7874538a-f5c5-11eb-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1628151404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151404, "uuid": "bf03991d-9ca0-498e-9392-184e97671397", "comment": "Malware payload", "value": "aa016e61b46abb155850fc9e1b942c6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151404, "uuid": "02d0ec3a-e307-41f0-a0b9-7a834559d3b7", "comment": "Malware payload", "value": "fc797838f2b0bda1a1e3bbf85609a2d795dc35a52940a2aaeca5500aae2564e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151404, "uuid": "ef7fc9fe-7434-4470-8596-020c1c1b34c7", "comment": "Malware payload", "value": "edb7067ce198f6413562449e9db8a38bd8d9feaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628151404, "uuid": "31c30d53-475a-47fb-bed1-4c87fab88aa9", "comment": "Malware payload", "value": "a8c90363571dc1b7360a7b9025a864593e51ca47a6e6c96bfa864af4ad1fcaa229053e7ae73f5c2324caca90680dda86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "null", "colour": "#B8A801", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151404, "uuid": "8515f5fb-832a-4913-8d59-094b923ff188", "value": "T1B3E47E92B675D072C3111936AC779FA6243D7D711D04288FBAE03F1DAABC9A8370598F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151404, "uuid": "75914be5-60e0-4c7d-962d-e8c10041dc85", "value": "f1f21c88e9cb261ec581191bb4c538e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151404, "uuid": "9f3c4bac-f7a1-4452-b77d-1496e1bd77b2", "value": "12288:cLJ8IaEF3CbhMemzpeVhpEj7c0DFtI2nuz:cLJRaElQMePyNtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628151404, "uuid": "caea2eb4-c996-487f-b867-6f0ec6d0338a", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628151404, "uuid": "b997ff0c-6830-46bf-947a-d1708cac6c78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628151404, "uuid": "aee97b6a-02a0-46d6-aaa8-80de05f337c0", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ca2f41-f614-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1628185269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185269, "uuid": "cbf99f41-38ae-4cea-8f56-a048786dbf7d", "comment": "Malware payload (NetWire)", "value": "70c228aa3c939bf9a489cec192c9fc62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185269, "uuid": "7621a32a-88cb-4042-8aef-4a14ede0b8b5", "comment": "Malware payload (NetWire)", "value": "fcce8faff23defa0d6e979846a2e6c998e7eaa4a8683837db7ddf9a7a2bde078", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185269, "uuid": "2c27327c-2c65-41f2-9b78-b545a8f07728", "comment": "Malware payload (NetWire)", "value": "5e53c899c75bcdcb35736789ae6fa19fdcac308e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628185269, "uuid": "4419db54-ef1a-428a-997a-0f1b996b589f", "comment": "Malware payload (NetWire)", "value": "cd855d2ef1c91cb8120c2214e3f266ea5d9f3fd5a75aed81b545dac3982f693a16c4fee7c9e4b5657a41e5eb9d1845e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185269, "uuid": "2efe0490-2eed-4344-85c0-1b6b713c836a", "value": "T12115E7213381492BE1A6FD72CF9F9CDA202D1D750E31A2D951E53B0AB6F12B629074DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185269, "uuid": "e7a0ddb1-842b-4b58-9e98-a9c2acabb639", "value": "a27bedaa147286540d08fdf824189cfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185269, "uuid": "4b015395-b93d-44e2-bd38-146f72c20a82", "value": "12288:EghRSVRxnU8yLl6hqTvkUFZOi3Df0nu7VnuX5:hQhnUFlSekm53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628185269, "uuid": "5e7ffe47-81fc-4cef-9afe-192e470862be", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628185269, "uuid": "281e5234-cf0c-4315-ae39-0a966424927d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628185269, "uuid": "dd01b995-1f72-46d5-a670-c61e425db6db", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47043d8-f5db-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628160953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160953, "uuid": "cbd22376-b406-4457-a4aa-72955a9976d5", "comment": "Malware payload (RaccoonStealer)", "value": "348e9f1bbcfafe855dd57eed972ad2c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160953, "uuid": "ce0c3dfc-0c9d-4b8d-9cfe-a2e41ffe3631", "comment": "Malware payload (RaccoonStealer)", "value": "fd2af8d36668693ee87be023b563e3bdf9aa3bd0cb75aa3bf0ab0fb13da9cff1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160953, "uuid": "a19efec0-2d6d-4b7b-a15d-ca8fb80a8211", "comment": "Malware payload (RaccoonStealer)", "value": "44ac445fff05db583a6890e02d4dad28d63722ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628160953, "uuid": "c7a81333-af94-4c74-969f-465868137da3", "comment": "Malware payload (RaccoonStealer)", "value": "561a1da8b5ad89e28cb56f150ff3ec175f69a19cbf2f40f906f0acc0966b30da1227cfba3114b35b8db4ce166db7d660", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160953, "uuid": "42bd7607-deeb-4207-a71f-a801be7a19a1", "value": "T189B401613250C63BD01542714837C2A9AF6ABCB20D319B873FB1A6AD6F752E2DF6D305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160953, "uuid": "08389d58-c1a7-48b5-b5be-40e2fd5b0c58", "value": "dc9414fe32ad240ba5f174dde5fa215d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160953, "uuid": "3b144619-7b98-41ab-8186-3ae473a2f5ff", "value": "6144:mPCgYD8zdzsjT9pFP0h2/lF+2aoSL5MVdVGrdX4yoZJyeMABm0S:szS39pdO2m+V+JXlo69AE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628160953, "uuid": "b2ab999f-2821-43df-a579-67c2fe1a4985", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628160953, "uuid": "a029e831-9345-43f7-8382-a69f8aa40d75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628160953, "uuid": "aefe51e3-3aec-4855-bd95-160862aeeb9f", "value": "348e9f1bbcfafe855dd57eed972ad2c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff842906-f5cc-11eb-8fa1-42010a9c0011", "comment": "Malware payload (NetSupport)", "timestamp": 1628154637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154637, "uuid": "fcae8605-6b40-4044-a5d2-4e02c73d64d8", "comment": "Malware payload (NetSupport)", "value": "88b39340d29f08a450c42eba59f35646", "object_relation": "md5", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154637, "uuid": "d2a0207a-438d-4ef6-bf31-4280004cebe1", "comment": "Malware payload (NetSupport)", "value": "fe46c8f8924406e17a3e3a971abe4da511788e338ba438de9ac5a67c67335759", "object_relation": "sha256", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154637, "uuid": "72e2fff6-f7ff-493f-96e0-2b66dd9749fb", "comment": "Malware payload (NetSupport)", "value": "c4e68a429f12dfc33c63161d63b127ae5ba10f56", "object_relation": "sha1", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628154637, "uuid": "43f7ef06-4895-4bd2-abb7-7323205be31d", "comment": "Malware payload (NetSupport)", "value": "210c6664540ff5f12a58a4807a44dc22da21553bf51a04b58fd21878c1104e31e42406bcf6ab8f5c34079add9915c4f3", "object_relation": "sha3-384", "Tag": [ { "name": "coinduck.duckdns.org", "colour": "#5A6A11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154637, "uuid": "205ba7c0-d555-4577-ae14-55153abae54d", "value": "T1ABF52202B5A1C572DC2E293C4D771FD4E4366E637B1D6ADB93E330598A321D225F0AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154637, "uuid": "f1908b7c-4f1b-41cb-b954-ba8c489fc06f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154637, "uuid": "2393eee7-5e16-48ba-ab9e-7a7ec0b557f2", "value": "49152:CeDfnRnAmd9CTHOmz5buZ+E5yJN3NN5c97qC+/0mh/w6kCkCxvRxYcmM7tx9J6cJ:CwvRniTumMl8NdNoe1dp6AccptJhXmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628154637, "uuid": "e1d8ffd3-70b9-46d7-821b-bc5681f8958f", "value": 3603925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628154637, "uuid": "70002c40-5675-45e4-bdf7-16343478692c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628154637, "uuid": "bee1b515-e561-42f4-9543-a55c74d8573a", "value": "fe46c8f8924406e17a3e3a971abe4da511788e338ba438de9ac5a67c67335759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ada839a-f59e-11eb-8fa1-42010a9c0011", "comment": "Malware payload (WSHRAT)", "timestamp": 1628134577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628134577, "uuid": "d450c122-f775-4d56-b6c1-fad8ff7d8f95", "comment": "Malware payload (WSHRAT)", "value": "94cedbf96e556f012c1eab9e9b82fb7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628134577, "uuid": "ea05420a-94da-4672-8e95-c8ff19136d1f", "comment": "Malware payload (WSHRAT)", "value": "fe7cb98f06f1cc388f492f98af7dddb68423afd87e431d2bb36a8a68cc0d1471", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628134577, "uuid": "d0376364-19e7-4d40-b2e1-ade402e4f9d7", "comment": "Malware payload (WSHRAT)", "value": "a2f162aac845998fda8f69f3a3874357994fe749", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628134577, "uuid": "c44b1bfc-2bf3-41bc-8041-e00cca8a4e73", "comment": "Malware payload (WSHRAT)", "value": "f96ad52de0e2b365a90f554d24847c4a6c37fcd60fc95f5cfef8691b7a7921f84ee2c85ab9d5ff7ae7464017c712bd6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628134577, "uuid": "4ab832da-d821-4985-bb7d-366da13a1dae", "value": "T13E2512F4EECF8FA4C330933D2EA556D507D64B7C491669075D3AD840AAB02B13E874AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628134577, "uuid": "7b442740-cab2-4b95-a34f-4674e004c98f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628134577, "uuid": "1e26d3e4-4521-420d-bf25-766f9896db16", "value": "24576:SLqbFG0dJ0rk90xHSPJGiyLrLYzfjNOBR3jRl6aGgKEDiQsr:NAHXUzbNMR17pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628134577, "uuid": "ce083cb5-2b44-42a8-981e-588bcf2fac77", "value": 974595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628134577, "uuid": "5bfc0485-30bc-4bb0-a0fc-6aab42eca688", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628134577, "uuid": "ae777a7f-b67a-4c66-ab5d-0b563bec8209", "value": "94CEDBF96E556F012C1EAB9E9B82FB7F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b255c2-f5e2-11eb-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1628163793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163793, "uuid": "a5d4f7b9-e5da-4d8e-8eed-0491df5df46e", "comment": "Malware payload (AgentTesla)", "value": "84bdc792d86cf1581109c2e67925e3a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163793, "uuid": "a4393ac0-02a3-4036-b814-463f8fd5c615", "comment": "Malware payload (AgentTesla)", "value": "ff199cae6652c5056c6b2692128639dff6ff9912b4a8b00ba4d308545925be60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163793, "uuid": "08eb9ad1-f19b-46ef-a69a-2bf6c100ecbf", "comment": "Malware payload (AgentTesla)", "value": "041608ce86dfa9743b3ed5b7497937b9df41b8f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628163793, "uuid": "fcec2a67-4ca8-4eaa-9860-bd8d5d53b907", "comment": "Malware payload (AgentTesla)", "value": "a889c74718f1f88f505663f6f3db73eb4b47161a1a08c1dd23295e1d8383472da6b51e3868f30663df5a62c1735e7b91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163793, "uuid": "23cc21c9-68ac-4605-a856-7b27a89aad07", "value": "T1E8B42322065D918FE9D14794602398BA52BE27141BB7383FF2F7C09E9164232FED9947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163793, "uuid": "11da77f9-70e9-4c64-9e5b-913e8d3ba5ef", "value": "12288:NLuaBpXZCY9bI+DBR9mR6YrnAbfKyIFaCfhL4nN:NLPBpJlU+EVnA7caaLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628163793, "uuid": "37a3b588-3ec4-4cf7-8230-3746427e7397", "value": 516269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628163793, "uuid": "7c0b34d7-6f09-40f7-ba78-b7a24b5a53b4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628163793, "uuid": "fe3268c9-d999-4544-be38-49616e698b09", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b94e5a-f627-11eb-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1628193347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1628193347, "uuid": "a8f61554-6a57-4344-9502-ce3ced76b17e", "comment": "Malware payload (RaccoonStealer)", "value": "6ce3b58eb82c9c51c983b65e84385880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1628193347, "uuid": "86c9909b-3b5a-4be2-884a-0e3121d050dd", "comment": "Malware payload (RaccoonStealer)", "value": "ff49da1cdc28732a213b0f5ba477e0e2337ac9631e07d3d114b813f09e48dcf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1628193347, "uuid": "62236fb0-8959-42f9-9cc7-a6bb2f1bdfa4", "comment": "Malware payload (RaccoonStealer)", "value": "7ce0207c9798a71ba2c221a149eba50b161cd844", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1628193347, "uuid": "2e661069-be6c-4b29-968a-e9464aa289af", "comment": "Malware payload (RaccoonStealer)", "value": "8c348959292466f8a3e7ad49bb6093817adb0b0d26740cc305b4624bf604614343195b9ad9a53c45be9de3ed4f847860", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1628193347, "uuid": "cbe44b9c-9918-4a80-b3c9-238b25582fc3", "value": "T1ACA412117980CC7AE28339B1A856C7E27F5BFCA5CA75861376DD175D2F202E13A3A312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1628193347, "uuid": "19b3b612-5aa9-4657-bb81-eab858b28762", "value": "6809132c99c8b7d8b68eb68186d7f67f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1628193347, "uuid": "888ccd44-c63a-47ec-8fd9-3a3f862f2b58", "value": "12288:+39ZOXWm5qM9nCh3lNs7ZvzpD1+4bBb5GR/InYL:WOYM9naQ7lpDUI3cInYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1628193347, "uuid": "9911d36c-c051-4110-ba3e-40279ab1c971", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1628193347, "uuid": "7f1fb2a9-22fd-4600-a8c6-e2f4b80c2838", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1628193347, "uuid": "2688f12c-d033-4e8b-aea8-c5f61ca98d91", "value": "6ce3b58eb82c9c51c983b65e84385880.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }