{ "Event": { "published": true, "date": "2023-10-23", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-10-23", "timestamp": 1698105781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d4955981-171b-403f-89f3-2e4313ab6338", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626a5d58-7142-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698024042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698024042, "uuid": "4172ed34-3224-431c-bbc6-f3a3df962de0", "comment": "Malware payload (RedLineStealer)", "value": "b3ecef6d20e1f585cee5d468f78f4bf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698024042, "uuid": "76ab303c-1ed1-4037-a67c-c4c05312e47f", "comment": "Malware payload (RedLineStealer)", "value": "0003fe34723231d0ea6868d5ce9d64147b51b46be984d8ea4fb9a358c888aa79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698024042, "uuid": "d9604949-1fce-454d-8e55-f6a9d251867a", "comment": "Malware payload (RedLineStealer)", "value": "ca75b45187fcd468dea1723f04b2dc0d45b3a844", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698024042, "uuid": "0d00b68c-c9b7-4d6d-8262-a51fbcb139a2", "comment": "Malware payload (RedLineStealer)", "value": "71489485f30e8950f0bce2fe3e74d2211a81d347e0b622a4d33c2f4b2de6968c6329c2f77b4b52b1565ae75f1c460d32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698024042, "uuid": "1ed05ec9-13bf-43f3-8827-24e5bb8d299e", "value": "T15A752317EBC44072CD5953B029F911531629BEB2AD3892C622CED9590DB26DCB932F3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698024042, "uuid": "af3db600-0bb9-44fc-8733-54be752cb236", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698024042, "uuid": "f0481d23-04c5-407e-9412-39f254be693c", "value": "24576:xyYfT97UTmhFHqvJ+FBhEEjdvqVE0+h5GtbOAAmHTJiCU6TEkAsoDn1jBbr:kYuTmhtYM3hys5sbOANHTEnrDVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698024042, "uuid": "17b0ed27-609e-4b93-9401-957a14c4c805", "value": 1592320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698024042, "uuid": "07377426-73db-4293-b92d-c74d69a0f8db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698024042, "uuid": "4f15b18f-7903-4837-a3cd-2462444faa6f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ee51d3-7164-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698038564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038564, "uuid": "a7be9557-0b0a-4ad2-bf20-186e0ad9c329", "comment": "Malware payload (RedLineStealer)", "value": "7bd1119099b0414134b4754e74200e44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038564, "uuid": "81e3a935-0c9a-4960-a168-43f5aaae5c23", "comment": "Malware payload (RedLineStealer)", "value": "00a3673637e5204a634a8d0bbd7fd3cd0464c8af7be4cb812bfae1fe87ded59f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038564, "uuid": "52bb044c-0661-4897-a39c-72adb6ccc2e0", "comment": "Malware payload (RedLineStealer)", "value": "563184d6e9cd51e5cfe02ba47dff880e796cdadd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038564, "uuid": "febfdebc-db0a-4cf5-b223-f9400bc91bd1", "comment": "Malware payload (RedLineStealer)", "value": "db08561413f12f04ec76aedf36e3fdf18dd67475ac825e5ff2f4c8987e3295596136b39947315ad11f29ff3d2461b397", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698038564, "uuid": "9f411dae-8e40-4728-b41a-c52f249238ba", "value": "T1FC7523A6BBF98527D8F16FF118F801A35A35BC62987502172284EF1B4D733D0E43176A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698038564, "uuid": "f46c39d4-fc68-4482-b057-ee3b5f3970aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698038564, "uuid": "ce4edfcd-8276-43fb-b1c1-f068468004c5", "value": "24576:Xyma5zo2CoT9eqdLaVRBGgnzY8M1rI2C906+738bWC1mQDhNLgqTaTqZK01OlJ:ipzowxt0Jz992Ce643VC8GfBYeho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698038564, "uuid": "7963d873-707c-44f2-bb06-7897648ce2b1", "value": 1591808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698038564, "uuid": "4b0004c6-ee21-4653-aca5-bdfb50930d79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698038564, "uuid": "4f2f11af-cc0d-4613-a30b-726ce437c759", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f352b4-71bb-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1698075928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075928, "uuid": "9ce61d84-bf7b-4e41-ab96-0e04a4fc957e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "5191692662d8c6f5cd3ebef642b68d9c", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075928, "uuid": "49406366-e109-42bd-9151-f2ca4c2534fd", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "013ae26e9f6534bcd3a7473274abc017b4acb752079df16c41537adbcca45114", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075928, "uuid": "f464d2e2-dc80-461c-8936-485779956cc6", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "dfb5dddd810db8527b9ac9dc7c3615e72a3268ce", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075928, "uuid": "43834e74-1e92-461a-9dd4-8fde8ef61387", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "2f18abb250e5ca50906702f168c2a50dee5b982d1aaa176d7493431d6d9b01b6c02d9820b9c923fa4e13a40778dd9f8c", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075928, "uuid": "0e6956f5-e1ec-43b5-80d0-d04931ad44d1", "value": "T160448FC3A692FC60E9164A718D2DF6E8362EF8718E59E65733187F1F1870161D2633A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075928, "uuid": "11cc8326-60d6-454d-9703-afde11539ac9", "value": "780437e8c81fd22a5669fb9201842564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075928, "uuid": "92643067-f08e-466d-ae0a-93b654f57dbc", "value": "3072:YwXmq0IT+LFHOY1r6fZvDTXKofW/Stt+7p0EeuVN1XZ5k4S2yfrA:Vj0IT+LV91r6fZSeW/C+7eEeuf1XIl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698075928, "uuid": "5baf9176-b027-4209-952a-cf9a9e19f907", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698075928, "uuid": "0bf9ec45-da9f-481d-9d61-f31d87fbd38b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075928, "uuid": "f75cef3b-9f33-4447-b0f1-c0a46394dd2e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7ffcda-7195-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698059736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059736, "uuid": "247095ed-ed23-4756-a5e8-00a54a5e25f3", "comment": "Malware payload (RedLineStealer)", "value": "18f9db7b37fa629f3ac8b8c6af48f09d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059736, "uuid": "ea751bff-c59c-4d66-a6ba-73128fe5df92", "comment": "Malware payload (RedLineStealer)", "value": "01a38706d64b9fbe061485f9de02cd18a34fbb382f5830e67a9d847314b3f8b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059736, "uuid": "fea20711-ec62-4257-9023-e6b7348c50e3", "comment": "Malware payload (RedLineStealer)", "value": "85e612c325a60e46d423b943cdf5c342b8816cc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059736, "uuid": "029321e0-a8e3-4cb6-bdfe-f07c227d8726", "comment": "Malware payload (RedLineStealer)", "value": "0d0c3279bc972c26e5080990af42d00f2ca3534092e09c23b0b03801b5844b0fe2b30e17c91c3d21f5245b399fe7eb67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059736, "uuid": "a710ba65-7bb7-4267-884a-ab15bc22f51f", "value": "T12365235BA6D84533DDB057B90CFB43870F32BD261E68925B238B6C5A0E305A27474B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059736, "uuid": "2e9ebcfe-4a75-4769-acb5-ddeefdce2906", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059736, "uuid": "e1361f0d-4e78-4317-bcdf-63737431b29d", "value": "24576:0yxg5LNjgcnERkP7SLNM4SJT+B1WbGWioXecaSMGb/OPynzihGtmh66:DxuNjLnEePum4SJT+ZW95amOPynuQEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698059736, "uuid": "3fed6836-aedc-4a59-b29e-d5ceb4ce0639", "value": 1530368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698059736, "uuid": "2addff5a-fd88-4162-b5f7-4b11e11c8750", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059736, "uuid": "2cedcd84-d568-4ac1-b242-607e3fe78c8d", "value": "18f9db7b37fa629f3ac8b8c6af48f09d.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0735eab8-71d5-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698087025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698087025, "uuid": "6aa7c08d-a54d-49f4-ad5d-8f927811d5e9", "comment": "Malware payload (Amadey)", "value": "0cd7f311e23c36e24d27aa025cdf05d1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698087025, "uuid": "98ca097e-9c46-4583-8533-f0ce6aaf32af", "comment": "Malware payload (Amadey)", "value": "033edac5e7eb119712ef7cf19f766558f6279ad008047719350d88f3c2dbb245", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698087025, "uuid": "81e70dae-e911-42fe-a451-2eebbb64c63b", "comment": "Malware payload (Amadey)", "value": "3e290411a2428b4f68ab3ce5218c8f6bd104ca25", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698087025, "uuid": "ac8da53c-5cd6-4974-8154-3e6441458070", "comment": "Malware payload (Amadey)", "value": "6fe87df4d7d88a6b3bdb0cfaa856f4e97d60eaf0df8580e05bbede5d78ebcce32a75f12f0e1b280ad3ef7bcc20aab003", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698087025, "uuid": "a4abf35a-1320-4ff1-af93-4e97aff48db8", "value": "T14A752316E3E658A3E4B61BB01CF646930B39BC95DCB8D77737D0640E4C622A2A631377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698087025, "uuid": "74bfcddf-ddf7-476b-a6f3-b722224964b6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698087025, "uuid": "d193c9b5-6835-44fb-a2a6-0a6db0879f44", "value": "24576:tyFX5WFKdQuzhioy0tTxB3bZ6K1UuwstyOWXL5ursfHhlPrLH6ebivfr4y8/5Eg1:IvQeDrBQuyHXQQf76ebiHMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698087025, "uuid": "1611f450-4ae7-457f-b845-7ba41d68b0d0", "value": 1586176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698087025, "uuid": "0783b91e-9a68-4658-b3fd-89ae0eb76ba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698087025, "uuid": "b73d77f2-0223-411b-bcd3-15043ae9011b", "value": "0cd7f311e23c36e24d27aa025cdf05d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20adc36c-7179-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698047554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047554, "uuid": "30590db3-32aa-4d26-a08c-cc9d0c794397", "comment": "Malware payload (Formbook)", "value": "d0589c025fcb96a689d4c8e7a689ac83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047554, "uuid": "606cc8e4-b663-4019-a9ae-b280d91617b5", "comment": "Malware payload (Formbook)", "value": "0372bd9c40187e5b4df86dae74c475d5f7b01de4424281dda221a579be971fb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047554, "uuid": "54cd699d-5f88-4060-b02d-c2ac8083251f", "comment": "Malware payload (Formbook)", "value": "1f227a6bdc3099ab7b5a1cdcb11191668dd48f43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047554, "uuid": "09818509-d483-4714-82d8-1d16c68e2130", "comment": "Malware payload (Formbook)", "value": "a2f0cbca604376bb124aeccaebaf1fc4094c2374093585501cfc6864c4d5cd5fb65da262cee0725fee4e595f38cbd540", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047554, "uuid": "9ea36404-c8b4-4856-88f0-14acc2218a5c", "value": "T11315497D1DF98227B978D6A6CFA0C432B0A1D6EFF5625D2AD0E746418702903B4C71BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047554, "uuid": "b308e843-fd74-4aae-a13a-edac53703509", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047554, "uuid": "6a2e54ac-1311-492c-9ce5-3a882cef3884", "value": "12288:dFbaDjLnmxh+5xDJhW1JxLa4qy1MCRjZCUzOQzkYVR9Q:a/Ln045xDJQRLa4jXDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047554, "uuid": "14fe1c10-a2e8-4771-aa4c-846bf71df8e5", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047554, "uuid": "ac63af8a-921b-40b9-b568-680821bce1fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047554, "uuid": "c75d5a95-93c9-4e37-b3a0-806f3f50e849", "value": "PAGO 72094.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148ba43c-71ac-11ee-8907-42010a9c0042", "comment": "Malware payload (Gamaredon)", "timestamp": 1698069438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698069438, "uuid": "2bf8de4e-9e04-4b32-ab47-1d177d80b652", "comment": "Malware payload (Gamaredon)", "value": "9ef96a2ca17ba3371fb5480b3e9083f9", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698069438, "uuid": "3729c00f-85b4-4ae4-a93f-a8249c11373c", "comment": "Malware payload (Gamaredon)", "value": "03edccc606b54bed98c3eba3cf3a2d46539c82e2b166ceb3878926227fe89085", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698069438, "uuid": "152e8636-2bb1-41c4-ba20-50c4c9a085ab", "comment": "Malware payload (Gamaredon)", "value": "f782937279bf9ef47c72f2b3128c608d87dc0133", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698069438, "uuid": "fb749ff1-799b-42b0-afb7-b092162b5613", "comment": "Malware payload (Gamaredon)", "value": "dd6e4b943f94e7f6cf938ee3758145ea542dbc13edf7e679612074934b23b0caaf9c77207656217f5ed554a49699792d", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698069438, "uuid": "ba61a765-786b-44fa-87ed-d2fd18710ce6", "value": "T13894236F5D245820F4AB3639D0771EE2F72C4D8246398BBAC4C7E77A49F091AD5993C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698069438, "uuid": "256fdc8e-6fc3-4eb8-bc5f-83b6b5417888", "value": "6144:NXxqx6HrqHiXObC6O6q8MFtW4F3q6mzLzMpgN5NvOMzv1vFeTkVlH6vjr:LAUrqHsOZhq8mtBF3dmFNXvhzlDin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698069438, "uuid": "b00c0027-d655-4277-8259-3bc0d32d2da8", "value": 418687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698069438, "uuid": "5f77b1b6-1831-4b20-b7de-8ba92c10deb6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698069438, "uuid": "144d324c-efce-48d0-9707-cf702465d387", "value": "Undangan dari KPU.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595453ee-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (PredatorStealer)", "timestamp": 1698057528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057528, "uuid": "a0263e9e-bbc7-448c-a3a1-65f329efdb37", "comment": "Malware payload (PredatorStealer)", "value": "b82a8c646ecc5ef5122666f5d5778877", "object_relation": "md5", "Tag": [ { "name": "PredatorStealer", "colour": "#904552", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057528, "uuid": "5e1e87ed-3d75-4399-923d-f397fc7e8537", "comment": "Malware payload (PredatorStealer)", "value": "04381cf3b4597b3d6075bda97853e289074790cf1d3290d295ecdab1bb95ad0f", "object_relation": "sha256", "Tag": [ { "name": "PredatorStealer", "colour": "#904552", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057528, "uuid": "ed6dde2f-4905-4b0c-87fd-1be7309caba3", "comment": "Malware payload (PredatorStealer)", "value": "7a973a20cb91e69a084b7fd00e3c1e7e0ccac167", "object_relation": "sha1", "Tag": [ { "name": "PredatorStealer", "colour": "#904552", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057528, "uuid": "d8ea6794-53c6-48d4-82cd-519334b738b5", "comment": "Malware payload (PredatorStealer)", "value": "8d070fa3a7273f1f44c613588bde5c64bf90d9292fa782f54b0be49aac9d3ef963b3200fc9a622b603a184115b5dae9e", "object_relation": "sha3-384", "Tag": [ { "name": "PredatorStealer", "colour": "#904552", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057528, "uuid": "01ecea14-490d-4412-b249-09604007badd", "value": "T10D1533B9430247977BDE3505F412FC8AB217DAB6E54BADAAC3F42190DA436DD61E2CC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057528, "uuid": "d8caee05-1bd8-4cba-8cc3-339f5e3f3998", "value": "24576:X+XlEFppV9uUZl2EZZbQm2TtNKKEheu29mzNvCvvC6p25q9:uuVgUl2QZH2hNuenuOvZoQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057528, "uuid": "812f252f-b037-4f51-b0bf-bd617a48ba0b", "value": 928120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057528, "uuid": "d75695f7-fe73-4fea-8153-cc07916e1106", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057528, "uuid": "fa6eea06-c5ed-4833-8c11-7df5287c92f3", "value": "DRMS Tender No. P500-2023-102.R00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0886cef-71fd-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1698104543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698104543, "uuid": "589d96e5-3add-40ae-980d-53f6dfb3fa24", "comment": "Malware payload (Tofsee)", "value": "b7f42bcf0e5382c39024c4c2549b795d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698104543, "uuid": "37c51a20-72e7-4e6a-af9a-773c5dd95387", "comment": "Malware payload (Tofsee)", "value": "04660f4cd0746888f055f49a8a4647bf21bc3a12a9a4d922a161ace93df2236a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698104543, "uuid": "5142539a-1b6f-49a6-a286-0121a020b6ab", "comment": "Malware payload (Tofsee)", "value": "33ee55c770d8be551d4a0a77976a9a020032193c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698104543, "uuid": "e99aca18-c0bf-48f7-bc56-ae3be85e6b94", "comment": "Malware payload (Tofsee)", "value": "19fffb7d85531d52d8b984b30a24e4bfce20ea4d279e1d581cb93cde598f2a1d8f2a9e59694c93c74fd54796dda345a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698104543, "uuid": "bede6be0-2ae2-4393-9f5d-c14fe3316b38", "value": "T14A44AF03A291ECE0E52645319E2DD6E87E2EB870AE19EF6733146F9F1772161C663313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698104543, "uuid": "1d45585f-5693-44ed-b4a7-73eeb5043ae4", "value": "a068146a0be0aaa89f57a8b52abbacb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698104543, "uuid": "8ed7882d-2ffa-457b-888d-a3fdaffb636d", "value": "6144:MYBF5r58LmKU9HvMLpVk3oMY64qwI76B:Mgr58qKU9PoVa4qPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698104543, "uuid": "58938890-42fd-4b69-a693-32babfe2aabb", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698104543, "uuid": "d8cf94c4-cae0-4b36-9c10-c24b18690fa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698104543, "uuid": "75d038f5-9891-4f87-bc56-4c43bdc5b5cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a148eca-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698057422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057422, "uuid": "af7ed599-3481-4d7b-9d5b-6f1e73e9a0c2", "comment": "Malware payload (SnakeKeylogger)", "value": "b14e49dd5671ae89f3624ad7561731af", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057422, "uuid": "b0288bc9-39f4-4738-9bc6-74af64407ef6", "comment": "Malware payload (SnakeKeylogger)", "value": "0477755f4c245b988aa85d1f9375836a72953d6172a7a82f917bbf9e59dd7294", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057422, "uuid": "1f23b84b-e46b-433c-844b-35367c723c3c", "comment": "Malware payload (SnakeKeylogger)", "value": "b2aa05a7ad52059560755fa04439413afe184ca3", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057422, "uuid": "16d57bd4-ace6-4eea-836f-b2753b10b222", "comment": "Malware payload (SnakeKeylogger)", "value": "bdfdb167eaa437b20c20e356809dfd7b8a7deee7f3949d783c70023ab371e5f1ff77ecf7762f8b43d45d7093187b9ef0", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057422, "uuid": "b40444b6-2fe4-4686-af47-270c21757bb9", "value": "T1B594F0492B7C8B67EA7BABFED0181501077877B29500FBDA1D0AF5CA05E1B458E82F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057422, "uuid": "1ef22dc5-b856-4f69-9926-63b08b9b6e43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057422, "uuid": "96d522b8-7e40-4756-9c1c-1346bcf45568", "value": "12288:yD7gUiVHOazGypq9Q/NGbEP2a6JYrOiqot:nHOazTNYEz6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057422, "uuid": "9ef7e800-3a16-493c-82a7-14ff7f3cc91a", "value": 442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057422, "uuid": "ee6a3b0a-ba2b-47a4-b885-0fdc5a6547b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057422, "uuid": "c235c561-1b92-42ff-b257-cc3ce7be1b50", "value": "Design.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c84b16-718b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698055262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055262, "uuid": "c58b1455-a818-4255-a310-fccf4379a4c5", "comment": "Malware payload (AgentTesla)", "value": "ee47ad5ac1c133ee18a5fee1fb4b30ac", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055262, "uuid": "18a93991-b843-4f5c-bcbc-b27d8b99a719", "comment": "Malware payload (AgentTesla)", "value": "04ce881adac5660788c1bcf7168b2617c28e5a1be76d0926d7b690f8e18a9fb8", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055262, "uuid": "be0800ff-e53a-44cd-9cbc-5006288327cc", "comment": "Malware payload (AgentTesla)", "value": "2facc486accb20f7afe4ece3033cd2bc2687a9ad", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055262, "uuid": "de036317-3740-4329-a99f-5c754b184de5", "comment": "Malware payload (AgentTesla)", "value": "4a3c8e4740e11ff8d33f74f23bde0a3c1904f842e65c958713cda61c5b387a73612b461abf7fca6a74ccb43fa1174945", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055262, "uuid": "a80d7c2e-f2b5-484c-842c-ef3279aadba6", "value": "T1C0E42355EC3FB078B4628329C1D84904FDE2823ABA2DAD10931FD35F9C7EA8576D1E25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055262, "uuid": "c908d288-d600-47d1-b31e-597399f1440c", "value": "12288:byfQNNWT57c5YZc6bM9HpoRO6mdqFtsZDinWitpLvfv8MXXTWRfp0Pk:WfwNWxaJ6bq8OldqFtsZDcTttD4Oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698055262, "uuid": "95e05d13-aa92-4ef3-9f75-96ac3e156ba4", "value": 711776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698055262, "uuid": "20ea13eb-d6d8-4197-be29-08dfb444556f", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055262, "uuid": "f66d0910-612e-4816-8669-ec31cb44a3ad", "value": "TRUCKING INVOICE 01168566.exe.gz.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddbdc779-7197-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698060756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060756, "uuid": "9f598a54-a96e-4815-8ce2-814bb834ba1c", "comment": "Malware payload (Formbook)", "value": "33adfac7d22b02adb13a09b5a7a88609", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060756, "uuid": "f345365a-1abd-4a01-b370-b91fb0191940", "comment": "Malware payload (Formbook)", "value": "04fe36ace53086105b6acdf4055b1e17094466fbe3b493deee6a83db885228d0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060756, "uuid": "efb339f2-ab44-4d21-bbc5-a61ffe1aa401", "comment": "Malware payload (Formbook)", "value": "6a45566ddbaea9285ce904d3cbbaa4b4e2073079", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060756, "uuid": "de1dd333-92ea-476a-bd7a-2decd63d88ad", "comment": "Malware payload (Formbook)", "value": "2024fcc4fb07b8da9a0ad680250e765f75c5898d05f1b8ac3b390d169c39f737975676756a62e501f74349dd7c61bff3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060756, "uuid": "bab98ed2-1a8f-450f-be65-39cf781c685d", "value": "T1F4C42300035B67744A716650CB7F92AB26731386ECFC1E67E38BB89759F1B18D390E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060756, "uuid": "28eb835c-d36c-4fee-83c4-6010e6d22733", "value": "12288:ULch+8cZr4OHepKTDg7UQ072Pd4l0jo/09w8A:5+lZr4Dc8N0AmH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060756, "uuid": "78d7ad7b-42a8-4ec6-9ef2-42e775bceb35", "value": 569722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060756, "uuid": "622e8c63-1d19-4f9e-ab24-88275aa1690d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060756, "uuid": "d7ad65ea-1a45-4c6a-a14f-047c30182dfa", "value": "Payment Copy (MT103 _03 _171023)_pdf_1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3c6601-718d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698056167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056167, "uuid": "65037ee5-aae7-4e38-a023-5927d00c825c", "comment": "Malware payload (AgentTesla)", "value": "e5f4077425379163671dfc873b0534b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056167, "uuid": "e205245f-4ce0-4ecf-9ecb-3d8aea39ca6d", "comment": "Malware payload (AgentTesla)", "value": "0531e9471b7a6d95a135f133898d9eca6cf9d1e6145f322ba04813d07085419b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056167, "uuid": "de0ecf74-7b55-4078-a653-a9981ad24185", "comment": "Malware payload (AgentTesla)", "value": "3edeecd01c1b54617bcb503999bf50b472881af4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056167, "uuid": "f9e98967-c2a0-4c6e-83ad-79b019d81628", "comment": "Malware payload (AgentTesla)", "value": "c71fff082bee9967879e4e179c596f0ff5609d5581d9eb668784f784c3d786050d2db2dee5c06af7ab635dedc19223fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056167, "uuid": "3aabd6e2-e5d1-4e98-a8a4-67d9f312a688", "value": "T11EB312AC4DA9A0D378BD0CE2A51A3AF29D512042A477F95C00BCA1DF5C3BD07FE99D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056167, "uuid": "93ed7633-f83c-40f9-a86e-a4b746d275d3", "value": "3072:unr0ufqigGKDIpyQgaw9y9TG0N5V9DlyTD0jvPc:urVyigGeQgawIp/9D0ToPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698056167, "uuid": "f78e9c14-a241-4792-a8d9-24e128cdeb02", "value": 115331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698056167, "uuid": "9761fe78-14a5-4b9a-b96e-0f270e3aad32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056167, "uuid": "c9f2d700-67e8-498b-ba91-755542dff166", "value": "UPDATED S O A.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79e1823-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698057659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057659, "uuid": "ea997c9f-5fe8-4e23-b280-0de4d5c97252", "comment": "Malware payload (Formbook)", "value": "868e6e8caca1e526e17e825a267ad2a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057659, "uuid": "c3ddf722-8733-4869-8e31-b324ba02c4fe", "comment": "Malware payload (Formbook)", "value": "055b80bde855baf4e6a3d20ab9f9bb014bf47172d98aea3fd4282aad6a70a85b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057659, "uuid": "f04c151c-4ed5-4e9b-9a00-52ad508e401f", "comment": "Malware payload (Formbook)", "value": "24568a1584a0abfdf66588e0d1925b051f9ed4c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057659, "uuid": "06c1eda5-a3b2-4c11-840c-6959ed7defd6", "comment": "Malware payload (Formbook)", "value": "b322f4904be4fb3808dbebaadf48b90f962f2549d5530f29efe48eb33f46875905506b0ecc274f1afe389413230254aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057659, "uuid": "9673816a-19da-413d-8024-900ea8d7694f", "value": "T103D4BF86F68082A9CC19A3B07932DE7107166D6AED74645E5BCC3E673FB79F30066843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057659, "uuid": "f3465109-73a8-422a-b249-19cb8cde4575", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057659, "uuid": "8a5d9e20-6fc6-415a-9ee7-de3237120b71", "value": "12288:4nPd87SQzNMbu3z1iVO0/gSSJFquCn6ThFKECo4UpBnNz4v6q5d:QPdQiVOIgaRnCF9dLnNsvH5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057659, "uuid": "a7a91abd-1f35-44a5-90c7-0c1b9406cb15", "value": 605537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057659, "uuid": "545f2165-d98b-4cea-9ba0-c114d664aa9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057659, "uuid": "22ea1bca-6d9a-4903-ad44-e69c4b4551ed", "value": "FACTURA095457890000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a7dc3d4-7197-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698060644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060644, "uuid": "1b37b9b9-d8df-43e1-9cf1-fbdf4ddacaea", "comment": "Malware payload (AgentTesla)", "value": "b92ed81b2854bee5ef7a8def9ca9685e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060644, "uuid": "9cb549f8-3cfc-43f4-b393-8a450ec151a2", "comment": "Malware payload (AgentTesla)", "value": "06f1464cffab6f356003b39e5dc300cf0a0c783b785ada4f5b43038939e23604", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060644, "uuid": "68352209-3668-4d0f-b97a-64e8a7f55263", "comment": "Malware payload (AgentTesla)", "value": "9c58c338dd8744f323bbb8439f8daafb994118a3", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060644, "uuid": "346244e7-5265-4a86-b48f-8bc1cdea9c56", "comment": "Malware payload (AgentTesla)", "value": "4b42948a71aab0be2520b056e06978f84beff83ba3bcd8f707208c77c424f4ae0a8a7420f17c8c92c1dbd3171aec0001", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060644, "uuid": "319bb115-b920-425d-bd4a-2be70240f69d", "value": "T160A423E738E1D41D22CBDF2816B2D5618A7DB49D2C6FFC311742C41A8AAF9AC1BD2D05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060644, "uuid": "f9a82987-8e33-4ab3-8bfb-d8a4c6046778", "value": "12288:tdak4bno6yTY9yRsMCsh6JVSqlmrQ1x87Nqk/Q3EjLuP1ZJe:P1Cn99yRsMhcrSq9rc/MEc5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060644, "uuid": "30760996-3438-4c21-bc80-dfc1e2c85225", "value": 489393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060644, "uuid": "b6e0e6ed-06cb-41e2-bde1-3c33a91080f3", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060644, "uuid": "31e53765-bd70-4528-a198-66178e08a1be", "value": "Customs declaration form & declaration elements.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f3c996-718f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698057249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057249, "uuid": "a89f2876-2480-4525-8d56-987737241e8f", "comment": "Malware payload (Formbook)", "value": "457727c9b8dd78217d49bea020449909", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057249, "uuid": "f63c0a40-4d77-4f30-bcd1-ffd922229100", "comment": "Malware payload (Formbook)", "value": "073bd91e3126ffb49e91e35f401d096e6bc474b973d432f001e9df2fb62d7a42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057249, "uuid": "5e4a0c7d-8f09-41e9-9aa8-c13af685cd5c", "comment": "Malware payload (Formbook)", "value": "6a48ed1d66e3d097e1edbc0366196c6045b16db6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057249, "uuid": "bc434143-6965-4a82-ace2-ad8df2a3e4d0", "comment": "Malware payload (Formbook)", "value": "ced14a0cf09532c9b13aed9e73d4b2f94040838125aa7ff425f2150a1af81f91ac8106e07d6be863e0a39caaa51cbf41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057249, "uuid": "5110cd63-2780-4518-a624-a144084f502e", "value": "T152F4121037A8AB52C93D77FA98C9900497B6473EA367E34C2CC272D915A571CCDA2F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057249, "uuid": "360b2307-dc9d-472c-b61d-59ee76fbe7d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057249, "uuid": "12f1a6ee-f0d9-47f9-813d-38a143186655", "value": "12288:sMX+MtgR/mZRM+BPEyp1mKTJ1+rz9SiA8hkhvRT+Jvn2FxZIrvGEdybhnnI0Cq+G:9gkZR52eTJ169SLJRROv2D+vGEdybhnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057249, "uuid": "ef9b46d2-ea81-4f55-abd2-90f3dbeda83b", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057249, "uuid": "971d52e9-fa22-4bbf-a676-dfa1fa9fbcf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057249, "uuid": "520c3d83-81c4-417c-aa3d-1c16b50ec249", "value": "457727c9b8dd78217d49bea020449909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9cca36-7166-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698039632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039632, "uuid": "80069fed-31fc-4e5f-8d98-172e9462b496", "comment": "Malware payload (Amadey)", "value": "b04b96a73e3f5d5ab5cd20b1151f47ad", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039632, "uuid": "9e7d16ae-7b27-4d3a-9ed4-9c44f189b92a", "comment": "Malware payload (Amadey)", "value": "0823ad8ade8f13609979cb7340ec8ba45382d4e073b22b576bceb85d94412b63", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039632, "uuid": "37567142-bbd4-44df-9e00-d1a398463bf0", "comment": "Malware payload (Amadey)", "value": "973b798e33ecdbf1a143970ee7fbee728ee481ee", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039632, "uuid": "eac95301-92a4-4432-87a2-5a56012c2c7a", "comment": "Malware payload (Amadey)", "value": "dcb383b36d987a3f8377311158b10c401f4ee7dd3c78e62fc94a4a680f17e31973359d804c639b0a45cd633ba09d7dc6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039632, "uuid": "a405f5b6-2492-465a-ad93-1fb5185ea717", "value": "T1DC7523A287D98462DAA807702AF74493567B7D764CF8432B3385D90E4CB3286F93536F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039632, "uuid": "e5f9cb27-6bec-4d86-b728-f42645bc455e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039632, "uuid": "7d135077-7e4b-486b-8396-220171c341f8", "value": "24576:oyH6LlRWSJ0NdYw0niY+Yz6QxPERiQW/44WLev87LYPbnmzIg/kwmkDgnTVz:vH6CHYw0nidqzKE44W6v2LYPaXMFkDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698039632, "uuid": "f6eaf602-5806-43ad-b560-3386765b444d", "value": 1589760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698039632, "uuid": "5ba2f216-5873-4a4c-9195-9adfa9690da5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039632, "uuid": "f05d8f77-6101-4f05-b6c8-c3ad267132be", "value": "b04b96a73e3f5d5ab5cd20b1151f47ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0310306-71b7-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698074397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074397, "uuid": "5ef75519-b4e6-4013-8408-82144b480cb0", "comment": "Malware payload (Mirai)", "value": "43a425651a63cd748cafee422fefa40a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074397, "uuid": "acb675fc-5342-4ee2-ac50-819d55af0533", "comment": "Malware payload (Mirai)", "value": "094e37a4b31464cb91ee2cb8f9b3b3d407eea489d066b3051ae8f24c35707c24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074397, "uuid": "04f242cf-c2d5-4c36-a1f2-d03f5b7fec94", "comment": "Malware payload (Mirai)", "value": "d1f08df8fa1397e8934f020405c1d55e53efec2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074397, "uuid": "81479348-2ca5-44d1-b735-05d28588008f", "comment": "Malware payload (Mirai)", "value": "bc0b7c7357e667ced6fdfdb5933ebca7d5c24fabd711b9e5221c6a15cda63cab6a3290b72bb6a30a7e005af73464cb4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074397, "uuid": "bd8c80fa-d6cf-4e73-a934-ff8dd15ab096", "value": "T1F3F2F10E9386C1A4C25B0176B5FFAF066440B11A4B58CB20EB69395E80FBF287F0B717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074397, "uuid": "3e9b3d1a-d1af-4aeb-b1b3-88b0f45e7518", "value": "768:mvOupg0Ft44NCimaofCmdXXsVGrC1R0DnpA0PEcZu+6Bc6nbcuyD7UWyqd:mW0g0M4NCtagCmdnsYC1Ra5upBdnouyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698074397, "uuid": "b8553569-32be-40aa-9e07-c783d66800f5", "value": 37628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698074397, "uuid": "75415feb-749c-4e00-8ce2-a2a936a09909", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074397, "uuid": "cd9392b8-ef3c-4814-8a2f-54e3bbada73f", "value": "43a425651a63cd748cafee422fefa40a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "748a8631-71a3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698065734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065734, "uuid": "42e08f01-f6b5-4d7a-98c7-8e38f1913e04", "comment": "Malware payload (AgentTesla)", "value": "20506bbf3674eaaf11d73fec51c1d727", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065734, "uuid": "d9332acf-e050-4bee-a414-d702043b86a3", "comment": "Malware payload (AgentTesla)", "value": "0975dac147ea1889d7b10b37ae8023a627a73a47d499ac89fec2ba8cb2d0d37a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065734, "uuid": "3507f961-ffd1-46b8-bd7e-c1fdce5a906d", "comment": "Malware payload (AgentTesla)", "value": "0f31abe11abccc775676ca8c6499fb1085ecacf2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065734, "uuid": "f979677f-220a-4083-8738-27910451dc5b", "comment": "Malware payload (AgentTesla)", "value": "ff8c3d228d5f473143e8f1c46fe6ec10eb5dd264a229db86fe45afd7f41d1dcbf35216099edbaf979280f5098a2262c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065734, "uuid": "77c06a9a-a644-4fe1-8e1d-18799a096363", "value": "T1FBD423ACED01808C093894AFA5DAFC39C0C4A12E55E75445D2DF60DB0E25BF54BDBEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065734, "uuid": "13fffcf3-d966-4fed-83ee-2596e9ca4800", "value": "12288:qxm5qwAcHX6PAkTw511+QSDHtylyRi1P35meLR7Gbvi8kfVlW0eS5J:qYIwAI6Ip+QEUee3iiJVQ0ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698065734, "uuid": "b25cf3b6-d319-4b28-8677-fc4cf1fb2732", "value": 631530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698065734, "uuid": "f5b1d1fa-a60d-4bfa-8272-8d09d07b4cb5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065734, "uuid": "a55a13d4-f2a4-4d01-937a-3fa69774573e", "value": "Delivery list for October.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e324a8-71c8-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698081789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081789, "uuid": "194d6b31-aac2-4cfa-a95b-c417edb70703", "comment": "Malware payload (Smoke Loader)", "value": "2b2e13a67cb0fa902023046983089267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081789, "uuid": "2c33ca36-b463-4310-bf43-379c8b5c0b68", "comment": "Malware payload (Smoke Loader)", "value": "09f72f18c0c70401b82ed7295831c1bf26e158b1b0288f6ed871d7283133d0f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081789, "uuid": "13449799-a228-4afc-8f23-fdfd31a44dd1", "comment": "Malware payload (Smoke Loader)", "value": "2bbc06e6b5a8d53f7f930972101776ce8fbf48c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081789, "uuid": "e585455c-f44f-4de8-bde4-7b9cb9cc242a", "comment": "Malware payload (Smoke Loader)", "value": "fdd2fe610d98229d5415bf64d056b17d54498341674f73f49277ecfbf21fb860096ddab00e992dbb4b37bb3844fa32ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081789, "uuid": "cae0e742-75b8-4573-b697-2df65f09e1bb", "value": "T1D3448E02A2D6FC60D92B4A318D2DF6F43A6EF8714E19E75732187F1F1871962D263391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081789, "uuid": "f4d7e40b-dbc2-4af6-b995-589de1c87332", "value": "8c07249af3e9a51b651a1c99624861e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081789, "uuid": "b732c40c-9f73-445c-84ff-79bb11862719", "value": "3072:JwXKG6BaLRqOzej/Art9FKrgw7qMGPuMBjh/6mR5d8kTHZE48frAh:2D6BaLsOej/Arf4rgGqMZMJFp/jZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698081789, "uuid": "c6d80b08-8a9a-4e74-9c05-da7713f6cfb6", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698081789, "uuid": "0ff9ed05-1dc7-41d9-838d-07e08aec7806", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081789, "uuid": "203a59a7-f4e0-4a37-bf61-c1d8835b0610", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae77ac60-719c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698062825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062825, "uuid": "3e39b794-044e-4404-acf4-28c1cc1122d7", "comment": "Malware payload (AgentTesla)", "value": "1d3c814cc0fe0ee6c33e2e67114c62b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062825, "uuid": "9a09d129-4ac3-4749-b8d7-af04e8646aac", "comment": "Malware payload (AgentTesla)", "value": "0a3284eb33b90115298777d0280162d1dfc7ae0706ef9a173898dec9558b42b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062825, "uuid": "dc43db5e-b67d-4961-9435-3455abb5a5d6", "comment": "Malware payload (AgentTesla)", "value": "e878becfda586358498389af485c372abaf49878", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062825, "uuid": "2994d3cb-45df-41c7-87a6-1037fe159750", "comment": "Malware payload (AgentTesla)", "value": "9821c2bba707410e0a116358208d9d89a050e362bcce94b122ff3d67006a66ba9c0191a19de420aac97babe01622e8d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062825, "uuid": "95be6b08-cfb6-4d35-bc28-1741f790337f", "value": "T14CB4238470F52CF2DC5BEA3291EB4E9CD4155303E6AE64A1304B0AFCF1A4DD6F619B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062825, "uuid": "c5cdf9dd-a175-45f4-9e5d-cd9189418b47", "value": "12288:WvRFAMGT7JpIc1xB/NpAUzl6zOwfhOLmQfJd/uz51:q/ANXJ26n1zwBELmEJQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698062825, "uuid": "34cba43c-2c1d-4310-8642-ae032425fc70", "value": 531405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698062825, "uuid": "0d9582f3-3858-4eb7-9599-cff762af9286", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062825, "uuid": "fe74ec6c-9d4e-4870-a701-36052cee76a5", "value": "Statement Of Account.pdf_____________________________________________________________________.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353cffec-7186-11ee-8907-42010a9c0042", "comment": "Malware payload (PrivateLoader)", "timestamp": 1698053172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053172, "uuid": "c8aa5ad6-5086-4a03-9f95-4d6aacb46f2e", "comment": "Malware payload (PrivateLoader)", "value": "4b6d751b82bc09f7290e6cdd9ba37ee2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053172, "uuid": "85ac3bd0-b41e-439d-b3bb-e4891018c439", "comment": "Malware payload (PrivateLoader)", "value": "0ad5765ff2058fabe14de8e0910c8b7ea16449885be5f0d5c3fad913e874418a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053172, "uuid": "cdefa149-1cd2-44ef-8916-44dbd744e415", "comment": "Malware payload (PrivateLoader)", "value": "5d4ecaed6f3f4beb605b2d74476741f7fa9783df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053172, "uuid": "e7985021-36ba-48d3-9deb-017fd0d9e30d", "comment": "Malware payload (PrivateLoader)", "value": "7de89fbfe4984e8a2674e57e04fab06b5e89cb1170741592117df1b773f6aa13110013c027ac8331547ff3cec6c6b2d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053172, "uuid": "2c8aa897-bfd5-4d3b-9d06-f7a8e734d639", "value": "T1ED562383BD8159C6FC1961348466FCAC32756DA46ABDC90BB096BEDFECB31524332217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053172, "uuid": "92646aca-b102-4fd1-bcbf-c6892e84868b", "value": "46afc61b34fb8e20ac7399f0df86ba31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053172, "uuid": "a93d7448-ec63-4057-a1c7-d9b246048db9", "value": "98304:ETKJw/ceReKn0ecgrtTPGQYQw4RYwm6swBlkEZb4rCxxCrmTgcDiA:lJw/Dn0etNP144RYe9BGOkSxCiTgcDiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698053172, "uuid": "b0e0fb6b-f062-4ae4-a28c-38b5345b0482", "value": 5983744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698053172, "uuid": "a49eebcb-2c75-4833-991c-aca28e2a7e4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053172, "uuid": "f8180250-0b9e-4c39-bd12-a4e748d58f4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b28498-71ad-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698070079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698070079, "uuid": "210b00be-f073-4430-a3b5-9efe3e153ab6", "comment": "Malware payload (Amadey)", "value": "c78485ab51b93ccb4737c6c40ee13a09", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698070079, "uuid": "f727d28b-a829-4f89-aca0-63f6e6c9aefb", "comment": "Malware payload (Amadey)", "value": "0b475c953c756fdc8cc9093a4e97aa3e11615c20f081fe1efa6d702f7c91a0fc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698070079, "uuid": "8caa3354-96df-4e65-8046-100b5e8b5b44", "comment": "Malware payload (Amadey)", "value": "d843c02d7c2373feb9597d6db5b4e475bb9d2d5d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698070079, "uuid": "a55726a7-9faa-4d27-842c-79dc28789eb5", "comment": "Malware payload (Amadey)", "value": "2dc46a63b15c62056165ec92143e6f8061b9f2c95de04a95d119a11c533a04f798f96b17d61732ffc4207bc1d1a9f7cf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698070079, "uuid": "454a57dd-fc2a-46d2-9685-b772c5dbc4d4", "value": "T150753303B7D55877ECFD27F02AE703531A36BC234A264767129648252EB3798AD303A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698070079, "uuid": "01735cbf-b198-4adc-81e7-42934b20413d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698070079, "uuid": "bab9e08d-5e64-4921-ad60-f710d6da5377", "value": "49152:9aVItUBgX2Z6SbFyEnNMQ7EHrjtcU+7OmWlF7:k5UO6yF9NM2E361ZGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698070079, "uuid": "ceac07c9-af03-4d42-a431-0cbb73bfa371", "value": 1584640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698070079, "uuid": "95719806-6590-4572-a7c3-d5c856f43663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698070079, "uuid": "adbe09da-f50c-44ff-99a0-667794976180", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564e57dc-718e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698056664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056664, "uuid": "acb50983-775c-441d-a8ec-b9b5d0b91a05", "comment": "Malware payload (AgentTesla)", "value": "1595d6f9ee9eb5a27def6ae27241d019", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056664, "uuid": "1cada45e-3555-4eaa-bdaf-b1dee057eb82", "comment": "Malware payload (AgentTesla)", "value": "0bf2eace6c65d7ba3d5e276ca086e28b43217cfd236f88ec03551801357a0b9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056664, "uuid": "43be825b-6f67-46cf-9ef8-38ac6174d879", "comment": "Malware payload (AgentTesla)", "value": "5a332d1499530aa3ab5e1b1781c31e2fd1d513cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056664, "uuid": "c782d4e2-ef6f-44c8-9364-18d4e043eb97", "comment": "Malware payload (AgentTesla)", "value": "21b156d888b4b7626bf01eb50ca0d78af7709eaba5e3921774051e4ca666f23f67dbd85a498dd791b9f5030c307c2df6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056664, "uuid": "863f2708-2fcc-415a-b566-2c06e8f78f82", "value": "T174F48C1072D96B92D939EBF24354184053F6BD23E22EF64E3FA532DA447DF419B23922", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056664, "uuid": "9bbdb44a-7fcd-431a-8b13-7a4f7feadfba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056664, "uuid": "55a430b6-6e58-42f9-a953-e17c4388f31c", "value": "12288:+EEvsphsDwXkaIDfijh3t+kSA/bXIt/eualjqz3Cm:NEUkn9sPzImlGz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698056664, "uuid": "2bf5b734-6f06-4930-ab42-7cb96b54d500", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698056664, "uuid": "b6b1cad7-da35-4c9c-b659-d1291ceda1f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056664, "uuid": "8e940f8c-acba-4dc8-91b7-544f1012c3c7", "value": "bankcomfirmation.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8d20de-714f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698029559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698029559, "uuid": "6c8568f4-ba06-4e55-9eea-1baa64171f80", "comment": "Malware payload (Formbook)", "value": "9b835cd8f06eba8491764ed984f44914", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698029559, "uuid": "eb8fd8c3-cef4-4792-a7ff-adfcef4fb243", "comment": "Malware payload (Formbook)", "value": "0c3897edf9556121ba516be9ae09ee2d312b46fb9935eeb22d96517ad835e3b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698029559, "uuid": "f9b03b7e-64c4-4bd8-bbc5-84c4b0ce69b2", "comment": "Malware payload (Formbook)", "value": "3081306a3b4fd75f413e85200808f716a43793b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698029559, "uuid": "26e94514-9d3d-418f-8dd0-e179c25127e0", "comment": "Malware payload (Formbook)", "value": "b0e156228aa28bf4565dfe2f07db25e4bbb9a276f8156be17a8e83ece3865f15aba896e3e774125590ff0d2ea0e0368a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698029559, "uuid": "7d44c92c-9d97-4d38-8b4a-04715e0d7356", "value": "T141752389A2E44433DA6627B268FB039367763CB56D38939F3A44EC050CF125475BA39F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698029559, "uuid": "52f0f8ac-16ba-4565-b43b-6cb670b991cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698029559, "uuid": "77e4c8d1-f7a5-4d9a-8469-fccbe66caae7", "value": "24576:/yMLme1wC4tUdAaUeQNheEMP9rewZrcKS0GhNxFgWAVAlqLb56LZdjJALANBTV56:KMLmXJtBjpNhNsJP0hNdRJAMLNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698029559, "uuid": "9648e0e8-906b-4176-bc49-1bcbedf7df97", "value": 1590272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698029559, "uuid": "e10fa192-b4a0-45c6-a8e0-af027e111aa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698029559, "uuid": "e8bc3994-d71c-442b-ad8d-bd69cf385676", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b87e455-718c-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698055733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055733, "uuid": "f549ce96-b697-47e7-bf01-32616a13cfbe", "comment": "Malware payload (Stealc)", "value": "97fdcb73e50dd265d20f3e838bd5b82b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055733, "uuid": "aa448257-67ba-4faf-af63-5b8555d1f1e8", "comment": "Malware payload (Stealc)", "value": "0c76aac50ec94b20877a3483eda8b1135fd9c5e9a221d71cbcc75a170ee696a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055733, "uuid": "fddfcdff-0c79-47b2-9fbc-ebfd6de9d98f", "comment": "Malware payload (Stealc)", "value": "327e2bd9e228d5b637bd66c9849de540f176878c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055733, "uuid": "d413e754-be62-4fab-86f5-7bedeaca91e5", "comment": "Malware payload (Stealc)", "value": "f3f621c3e1e24b09b85357b0ca51600973bac9cbb22cb98b399c7ead31f1c91d4377e8e7a11db87453673af29af91aa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055733, "uuid": "25aee50e-cd59-4930-830e-191a2907bdd6", "value": "T178448E03A6D1FC60D9168E328D2DF6E83A3FB8714E59EB57B3186F5F18701A1D263291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055733, "uuid": "b75dd810-0377-4069-91c2-773c94f94761", "value": "83ea5da75a27345768c26298d1e8b469", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055733, "uuid": "8474046f-3c0f-4dfb-a372-b895f558f603", "value": "6144:95RZfLinO+QHub4s/NO5s0ofn4FM9ExXS:9fV2nOdOb42NAsN4JxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698055733, "uuid": "c46bd7d4-7b29-411a-82b7-2eae2035aed0", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698055733, "uuid": "5e961fd7-3750-4d99-989a-d1031dec4029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055733, "uuid": "1f8f902a-c9e7-4428-bb52-848bc7772e19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404e2d06-718f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698057056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057056, "uuid": "851d1ba7-3afa-4a51-b47f-100cbfe46a4f", "comment": "Malware payload (RedLineStealer)", "value": "ab68632d1ee722156bec4532287cbd1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057056, "uuid": "805bd201-bb98-4de6-8af9-9c56b51534ee", "comment": "Malware payload (RedLineStealer)", "value": "0da664056314412da13e68acfb3bdae0b16f10e61dc9e3d3e0f2519be0749fae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057056, "uuid": "8990c6ce-c907-49b8-9689-abf518f96f2a", "comment": "Malware payload (RedLineStealer)", "value": "648cb02aab28e359770a008e54ff61dc0b1c08fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057056, "uuid": "98c324ec-220c-4181-bfc1-b69ec7a3f61d", "comment": "Malware payload (RedLineStealer)", "value": "fb3bea99f9c7d2d03cf9bf1f1c369484af74dbfcac8f317ad2bc0fb351d2b52e3d82dc395adf698e0936c4fb99a7f724", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057056, "uuid": "cac9bf80-6f13-4b14-b412-65e58934ae76", "value": "T11E752344EBE44063DDB0A7B46CF606C317353EA1A934926B3392AD056EF26C5B87271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057056, "uuid": "8d6a1b08-9b3c-4bd4-a13e-65e03516f703", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057056, "uuid": "e0d5e9c3-3184-44f5-8741-277f33e9bde9", "value": "49152:OFlecb5HugYfsEG3xGrHrxk7Y4cEMjlVQedn9e:4UwZEG3ArlFLEM3r9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057056, "uuid": "86438d14-e552-4fec-bb9a-abd5a5aa8264", "value": 1591808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057056, "uuid": "9fd37932-1d40-400c-a27b-bbf04fd65b29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057056, "uuid": "8228c93f-04cc-4a0f-b0ff-745b3094b1f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1081fb02-71f3-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698099926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698099926, "uuid": "1a9d6d3f-831c-4d2c-ab3f-175606249496", "comment": "Malware payload (RedLineStealer)", "value": "b7d073aa3011a1a001f31a755f3f65fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698099926, "uuid": "a115e925-7ebd-4995-93ae-431af11f31d6", "comment": "Malware payload (RedLineStealer)", "value": "0df7cc3bd6f29744cc5866ccd20ac15cfe7fc7d1bf1b234be01593b121708e44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698099926, "uuid": "f086d4ef-b2b1-43bd-b50e-dba5a5e59d00", "comment": "Malware payload (RedLineStealer)", "value": "a5cc55c8a1d8b689ea401d70eca5d78e755d2496", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698099926, "uuid": "618ae084-1bdd-438a-b1b9-9254324b388f", "comment": "Malware payload (RedLineStealer)", "value": "a7bc485442f74ffbbddfb6057fc0453b72f66ce5c7e5afb55c92f5df141ecdc4d26716cb3d38325dbcef7b5ace968b26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698099926, "uuid": "68a6ba63-7dde-4a71-8435-accc6dab1585", "value": "T1221523012BEC1563DCF52B701DF303930D39FD6189398AAB6B85AC9A2CA3664D576337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698099926, "uuid": "a6c78f02-af75-45b3-b789-00230ebf46ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698099926, "uuid": "034615ce-27ad-4512-968a-10189637f332", "value": "24576:XyPVLiABTRRJdlADPSXf9I1BHg6LAVH5zR+SrTg:i5i4RRfaTSvW1LEVHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698099926, "uuid": "390e023f-5c74-452e-a56c-e28e9540da3f", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698099926, "uuid": "9a9e6327-ac8c-44b1-b494-56b38aa783ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698099926, "uuid": "18e8deb1-6de6-4c8f-8bcc-873fb49106e8", "value": "b7d073aa3011a1a001f31a755f3f65fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1e0adb-71b1-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698071568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071568, "uuid": "480ca7e4-520e-4554-8b44-691efa7f8a2a", "comment": "Malware payload (Smoke Loader)", "value": "3d85c9bf966288bbb25b4c1572add20a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071568, "uuid": "59e84f75-080d-4ef9-8851-5e559b631033", "comment": "Malware payload (Smoke Loader)", "value": "1059f5e73d027fefc742c588ca8633a15daf252d1fb9bf3b636234d8b5a9fdd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071568, "uuid": "47a024c5-ebb4-41bc-bead-18a4386fdcdd", "comment": "Malware payload (Smoke Loader)", "value": "be6dbf45929fd3f53f9757db052035eea8631f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071568, "uuid": "3bab5392-4e8d-45c6-a4c4-a6d5f81e8fb2", "comment": "Malware payload (Smoke Loader)", "value": "1a2e62a23645e5c3b0df6dbfe2a6372580c2428a4f5c4dcc7a00d061edac2b04f76456a2af978c13c8794eaf6605e941", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071568, "uuid": "458881a6-c227-4757-8030-e0a5fae09e17", "value": "T16D85FB1176F95B59FAF30FB85ABAA611487AFC6ACF11C2DF1250508E0D21BD09970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071568, "uuid": "6544f1b6-5e16-4ea7-ac71-f38232aa0d0b", "value": "037522269f8348aa17add864631a3f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071568, "uuid": "e1ac97be-3f83-4175-b16f-94fe83d3b488", "value": "12288:AFV2CcpXmPAfSBsqe7E95XuHCbdPYmstzd480uzzvs9X6a9DhvhVfes5gIY:WrxAfSKqe7E9xfdPWNK6a9Dhvh5esWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698071568, "uuid": "b7a00f30-6b73-4708-aea7-e9cd2aac89f2", "value": 1724416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698071568, "uuid": "d6264679-8f19-4b76-9065-03fa04d3620a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071568, "uuid": "4f303686-6a4c-4e4c-a4ac-509436b250d6", "value": "SecuriteInfo.com.Win32.PWSX-gen.1004.30079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d884f1-7171-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698044134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698044134, "uuid": "7188416b-e7a9-4723-92f7-4fe49d8d4c0c", "comment": "Malware payload", "value": "04a65069054085cd81daabe4fc15ce76", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698044134, "uuid": "015e5de1-0cc0-48ab-8680-d18060efc0e8", "comment": "Malware payload", "value": "1122e444eb6726986882c60c2158b11829d895a53b48cd7129c3fe0d74bb2c74", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698044134, "uuid": "42888b8c-820a-495d-8ce9-60dfb535367a", "comment": "Malware payload", "value": "7c81509a9b0b8cfe78e8a6db6bb9cb93fc0ab820", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698044134, "uuid": "fe4b967a-dc36-40b8-bd28-506e337e560b", "comment": "Malware payload", "value": "3a08075888375e7f10e61160514a8a624504e3219a0e1d77767c60bc2b0e8cd92a549ce0fe8c0147558cf598d09c7d6d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698044134, "uuid": "78a74082-cc2e-4bda-868a-14119460c250", "value": "T1268533BB972E510F50E12322CCEA59ED9A23FBA55026FC323E5F44F5D91284413AFB16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698044134, "uuid": "c20d383f-ba10-44e8-a1fe-c60ecdb571a5", "value": "49152:zC6DrcoojeD3g+4jiSMdEWdQsqp7RXxA5HD6Vx2hiL6nnYM:m87ojwwrjiSM9Q3pM5HD4hM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698044134, "uuid": "d4b8c727-6f8c-42dc-b858-d14506e3f45b", "value": 1872902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698044134, "uuid": "366d24d8-3d89-4667-a323-4aa14ea734b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698044134, "uuid": "ce507907-7cd6-4609-8216-51ca72b18f1c", "value": "04a65069054085cd81daabe4fc15ce76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e318dc-715f-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1698036629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698036629, "uuid": "e596474c-b782-4341-9c25-20bcc3f36182", "comment": "Malware payload (LummaStealer)", "value": "110962b369a9be33655e8232d1a47ec5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698036629, "uuid": "e604d1bc-21ef-4ebe-b851-bdc2657477de", "comment": "Malware payload (LummaStealer)", "value": "11e3351eaf488a5e535b2298f6bf297cd5c0b2ff388d51f4752bc0e1cd6ae249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698036629, "uuid": "fb0f44db-2643-4f54-a859-2ff171846e08", "comment": "Malware payload (LummaStealer)", "value": "23ba4dfb817d0e31dfdb18ebf3f9392278d5d697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698036629, "uuid": "00874d84-bea9-40b6-b33c-89210b7dc66f", "comment": "Malware payload (LummaStealer)", "value": "4eaab2d6a55be8301ca06785cfcc397e52414a2afd3870fa3407b65f294cfaf13f8795c6e21956573fa5a6cbe1ce8bc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698036629, "uuid": "fddf4e98-47b8-4b83-9154-2180b2481869", "value": "T193152343B7E89032DCB42B7019F603831D25BCE158BA879B6655B8A90CB33D5E57732B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698036629, "uuid": "65d66de4-1c60-4af8-98cb-85311a8e0a33", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698036629, "uuid": "52c3fa19-9301-49c8-b74c-df32c278be71", "value": "24576:xyRHNW2ntY4XGU9i27LPFvc5ePvSiJ87cVN:kJhtY4z17LFkAaia7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698036629, "uuid": "970b6e1a-be42-433e-a61b-c20810fb6724", "value": 955392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698036629, "uuid": "b11ac668-c8ac-4f76-8b1b-eeae2213f103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698036629, "uuid": "8f15156f-34a3-45bc-9104-74e2cb0255b9", "value": "110962b369a9be33655e8232d1a47ec5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e5619a-71a0-11ee-8907-42010a9c0042", "comment": "Malware payload (Healer)", "timestamp": 1698064574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698064574, "uuid": "4ab9d666-2951-439e-beb1-d985282330f0", "comment": "Malware payload (Healer)", "value": "f536f5df19df0a0530af2b54bf26a147", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698064574, "uuid": "560b82a7-a1b1-4a6a-a222-27db4e0a66fa", "comment": "Malware payload (Healer)", "value": "126c0f9959aa4a01bb5e8254b72b4bac370a12cddded7d815ea09b0894f1ee59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698064574, "uuid": "a41c3893-eafb-4a8b-af78-704ffdb893c0", "comment": "Malware payload (Healer)", "value": "a25e39e1f67cc7a78c201182af75e04038e25240", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698064574, "uuid": "b6479b9f-a269-4bc1-bb81-bff7858364b2", "comment": "Malware payload (Healer)", "value": "735f2e6f8f702e9a81ba5210bc9b9a75e7ad76b9bd4378abcab5c035150ad9c3371513236754e45366a43d502609357e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698064574, "uuid": "5831d97a-3644-4f6a-8101-1bdc34e7a4aa", "value": "T151752383F3E8A567D8B41B7018F963C359366C739D3447262AC9A96F1873708A93173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698064574, "uuid": "34e09dfe-500d-4da4-a9bb-db149300d5c7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698064574, "uuid": "71d9bf01-2aee-4ede-b85f-e143f042704b", "value": "24576:zyZiQsZhOKz9F5E4HyyRyDDGk05C8XRVrT6JLUq54o0b4+U2TjfbbrSKC3:GIJcaF5hHy8y30BhT6uS4o0b1jzbuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698064574, "uuid": "0734a511-23c5-413e-8279-7c183400cb69", "value": 1584640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698064574, "uuid": "05d013e6-e113-4354-bd09-984531785bbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698064574, "uuid": "5f2615fb-0d51-42d0-a71f-4a88c126989b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b5ab0b-7197-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1698060761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060761, "uuid": "da63f819-3333-420d-b9ec-af508f427b70", "comment": "Malware payload (DBatLoader)", "value": "ed7a957ff5a7e3c15aface649a3c89b3", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060761, "uuid": "3fcba6a3-39dc-473b-a99d-bfe488bf7852", "comment": "Malware payload (DBatLoader)", "value": "13a14e45ca00f015b20954bfd7eed1a9eaf0a763da1d155e673e53d31821abb1", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060761, "uuid": "e97fee78-041f-4738-8caa-f47c91970fa6", "comment": "Malware payload (DBatLoader)", "value": "cfe6ca7d0e67df1bd50b8ae504907c62bbfe5e45", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060761, "uuid": "58ca035d-e088-4854-a06e-7e56e18aa88f", "comment": "Malware payload (DBatLoader)", "value": "777a394486c4e8f370e3d4aa18fbced5b5033b9073a554615ab6e58dcfd3338d3d92ee95b99bbad73e796c42e67f5421", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060761, "uuid": "ad572b9e-e000-4216-925e-a2dff5428f46", "value": "T16255D01BE661D9B1F06A02BA6C675B2D9B1C7D2D3DA4780E26FC7E481F30246742D0B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060761, "uuid": "1cdbd999-f90c-4545-8c6c-eecc14afd6f3", "value": "91a1eb4157c5e26a9ad6d8fdf398dbf8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060761, "uuid": "adc38996-8731-4cdd-ad2b-a0c1b58770a5", "value": "24576:UHQhZtDKt9N6+arvC0/hfYPzyB+4Buxrhre0QEd/0hkEBSBrTFJ:UPt1h24mwe0XMkEKFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060761, "uuid": "6f205ebf-4d4b-435f-8ecf-712a3a31ccb2", "value": 1296896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060761, "uuid": "28431c72-3f25-4a9d-8f07-58073dafe431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060761, "uuid": "0b813f79-014b-4a0a-b9b7-ef36bf03ab49", "value": "U prilogu je potvrda narudzbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf88c81-715e-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698036329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698036329, "uuid": "02fdaae5-c651-40df-8b81-ebeda4b2e15f", "comment": "Malware payload (RedLineStealer)", "value": "190c291693082de8abaf041a59297daa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698036329, "uuid": "412af288-0757-4e59-8976-98c20bada556", "comment": "Malware payload (RedLineStealer)", "value": "13ce85057303db2f0e27cbf81a12e7a1381ccc5367facb68d329e4c88e811569", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698036329, "uuid": "4155f8fa-7a48-4556-bfe0-1c7633ce8108", "comment": "Malware payload (RedLineStealer)", "value": "7a5db23e3d85534003d752c34d419d6df28d3853", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698036329, "uuid": "b0b36ba0-6ecb-4c67-a914-38bef056436b", "comment": "Malware payload (RedLineStealer)", "value": "f01846824fc0c829af2306a59ecc283d5a67837e1b13e78adcc9b11b77dfa81ae86038f85457e1f67988c06d03135b3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698036329, "uuid": "ae93d5e8-699a-4565-8405-1eac11bed96a", "value": "T1D1152216ABD84026DCF527B018F517930739BCF1997D836A2796A89E0EF3690703277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698036329, "uuid": "e5b36a56-1e34-4aef-941e-4f02bd29c87a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698036329, "uuid": "1c394873-0770-4113-8e9b-4bc323ef1cab", "value": "24576:qy/S4IBFIatSWIV8+OuEAkhs3cbekcmEVe:x5IBFIacnV8+OyAwe9KV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698036329, "uuid": "ffb72227-d0d0-4d4b-9b97-534a4d6bbd74", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698036329, "uuid": "54cb369c-2f49-4c45-a954-1d446ce37a29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698036329, "uuid": "3c4fc801-1605-4f4b-9fa1-8500dcc2dcc5", "value": "190c291693082de8abaf041a59297daa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e31c322c-71b4-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698073221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073221, "uuid": "787d3794-255d-468f-afa1-8adb7d0251a2", "comment": "Malware payload (RedLineStealer)", "value": "cb7a5441a3d5f2f9cbc3862ca9e5534f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073221, "uuid": "91c3d66b-747b-4018-a5c1-b96cb06594b3", "comment": "Malware payload (RedLineStealer)", "value": "1420ebf3abfc176294ee36beef4448a1f48465da81c1474d413337f835e23771", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073221, "uuid": "1ed88068-1564-4611-b47d-c3d1a90e6868", "comment": "Malware payload (RedLineStealer)", "value": "1b18cf8c7d9cd584b6138e55f12812c7645fc4c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073221, "uuid": "4550d536-4d78-49f0-83be-8ce41c841329", "comment": "Malware payload (RedLineStealer)", "value": "0b097475db4fd59440d324742a233ff1007b7af7ef83d0d6a749693959a2523c3eae71c5308b7b5cc7c997bef85198c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073221, "uuid": "95b7b82a-8c61-4c3e-9ef4-7d1fdd1bfe73", "value": "T1EE85238396E8D573E5F8377048FA07831B22BED18E3987632B95BA1B0C34691453A777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073221, "uuid": "8195151d-2306-421a-b272-c1a8b51f6915", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073221, "uuid": "b66eec96-2910-4403-bab9-dad20095e6b5", "value": "49152:tfDax6DfXrDzbVMQuxNCBEr6+SqhrPHBnnBmspK:9aojXrDHVMQ9Er3SqzHBZpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698073221, "uuid": "6feb689b-c0d2-4005-be27-a8fc8552fdfb", "value": 1761792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698073221, "uuid": "db5c62ad-d2bb-4449-bafe-04f952461c3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073221, "uuid": "72791754-94a0-4f3b-8912-ef69268dbdd5", "value": "cb7a5441a3d5f2f9cbc3862ca9e5534f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc1fc93-7171-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698044434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698044434, "uuid": "1d3512c5-472e-4f37-a0f6-3a484eef11da", "comment": "Malware payload (RedLineStealer)", "value": "3814d00e768cc9ad7056261ff78a84cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698044434, "uuid": "a8f52840-97bb-47e1-92d1-8947903435a4", "comment": "Malware payload (RedLineStealer)", "value": "1428167ddb4bbdf6ea5956af4d64371efa2d980b1c2fad56fdf6bc4e64244752", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698044434, "uuid": "8aebbdbc-bae2-4cb6-9b0e-16d9fa8fc1db", "comment": "Malware payload (RedLineStealer)", "value": "3ec1aeb19e7c721a225b8fb4984f37ade5119e7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698044434, "uuid": "7c3aa754-4d91-4942-bdb3-63c6cedf4801", "comment": "Malware payload (RedLineStealer)", "value": "c3a56bf73a3bd5f2a735056bcaf5b2b928a1b20b01ca4f02a1a1dcac2fc72145c5070bfdc1c3a8c2f7b3d55e41eb4311", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698044434, "uuid": "4deeb519-9e9d-4dfe-8f1f-57e1d88f765d", "value": "T12224D776E304951CE83E433DB45C34B09F707C62E16ED32E55EA7AED683BB498A244D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698044434, "uuid": "14280027-5a21-48b1-82e2-ceb9464e282b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698044434, "uuid": "e0db3cf0-ab9a-49f5-a537-453cb623c8df", "value": "3072:CtaCObU4nXNgcBGkc53UID4N3wGt/qrhtCX7IWB4lAV8:CtatbTXNgcBRm3U/UtCXk04lA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698044434, "uuid": "ec05aab1-5bcf-442f-923e-597f414c54f8", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698044434, "uuid": "276769ac-38c4-437b-bb3b-e510648f0781", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698044434, "uuid": "bcaceea1-60fa-457a-92a3-400c16e7d039", "value": "3814d00e768cc9ad7056261ff78a84cf.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd44e34-7166-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698039362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039362, "uuid": "7d1897f2-4adf-40de-9b44-1f416cde2acf", "comment": "Malware payload (AgentTesla)", "value": "6256099937593e3e64e37e8028625f38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039362, "uuid": "e75968a9-04c9-42b7-9bc0-a89500162c4f", "comment": "Malware payload (AgentTesla)", "value": "144686e1819ba60b0b7c23cd93b457a788595c17a10b1c4a058f5b015517bc3e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039362, "uuid": "b28c66bb-976a-4217-a0aa-15f1fa94f2f2", "comment": "Malware payload (AgentTesla)", "value": "1a55bdfa299143c47a577bf72e8865bde9e82c7c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039362, "uuid": "bd7d3a5c-5058-4e20-b525-bc1b719bde56", "comment": "Malware payload (AgentTesla)", "value": "f6c98012528a4fc54c0569ee250515a5ddf7d718c415de0b1953e9d18fc5c9b9fc35ee6ad05fc2a7002e9e64dcaaf327", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039362, "uuid": "b27a3025-1454-431f-aaab-38b253709dbf", "value": "T1D8D42309B86DE6DD3B431D1AF61543A3F857C00632CBEBA8751CC60AF83356ADE419DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039362, "uuid": "c8169391-679e-4eb3-a5d3-e14f97cfbab9", "value": "12288:s75Z0yuY6vpKknB0hQYyrUzfQ94Zvx3dw3BQTP255C7PprCmUOLEN7LrZka0KV5:s3FgxB0XyrU094ZvJdw3BQ72vSBmrNDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698039362, "uuid": "b6e5eb61-80c5-4c41-9d4f-48a7af04950a", "value": 645118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698039362, "uuid": "7fd51e49-90a6-4e43-b3f1-e21fee78f682", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039362, "uuid": "3ce75ae6-349b-4be3-8a5a-9b2bcd895a1a", "value": "soa pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c46b49-71b1-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698071667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071667, "uuid": "bfc64686-f0d4-42ec-87aa-1f3d888056d8", "comment": "Malware payload (MarsStealer)", "value": "5ed7e655c5cd16b04490c6caf0e70990", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071667, "uuid": "8fef1ac8-2976-4c51-8def-9a3e7df5a819", "comment": "Malware payload (MarsStealer)", "value": "14b045989ad6bc4b3919e72fb898ea0394c5294be0cebc0823341b2ce60173af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071667, "uuid": "c13ceb15-cb5b-48a5-baab-b9d6b43a6d5b", "comment": "Malware payload (MarsStealer)", "value": "2d9116e0797e58fc4f4d7cc19a7410ad2e083e65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071667, "uuid": "4c2912f8-6dfb-45c1-aa51-eda1b2ba2701", "comment": "Malware payload (MarsStealer)", "value": "5688589033b679808c3b5b0947ebae788df1c5057f4adbc531c95cae67c12974ee936c34a44f2843781a318da5343192", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071667, "uuid": "f2d1b7c0-7214-458b-92be-a82b6cddc3d9", "value": "T1DB650613A1CE8D36E33E35386AF701B448983D80B664A8467FD87ECB0721A7965DD35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071667, "uuid": "6b921de7-e68b-41c5-9e13-ef7b50e4e562", "value": "f5fcef2eacb86c1adad598b65c67a3ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071667, "uuid": "c0a4c993-ff10-4490-b5cb-914f14ba294d", "value": "12288:bRgcdrhCHwfbv7rHMUtXe44Lzynektxn+9WXH3ML:bmqewfbv7IwOlLzynektxmWXH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698071667, "uuid": "92aee233-15d1-4ab9-ae82-16287a725748", "value": 1433088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698071667, "uuid": "054735cb-3eff-4441-98bc-f496a90a3f6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071667, "uuid": "1b04a438-8405-422f-b4e8-d3353c3c5ea7", "value": "5ed7e655c5cd16b04490c6caf0e70990", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a34a81-718e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698056656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056656, "uuid": "e984a81b-7b88-474b-96fe-fffa30ca0efb", "comment": "Malware payload (AgentTesla)", "value": "fd1eedea3cf098587c832eed7c86cfe9", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056656, "uuid": "a094cfdb-7dcf-428f-ac40-c2a2b05ad9fa", "comment": "Malware payload (AgentTesla)", "value": "15581ec2c17fa909913d454729a3980f9fe50af47cd6a0d4881dab95d217c8bf", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056656, "uuid": "70c4fd25-63b0-4c22-9f4c-742914fc4739", "comment": "Malware payload (AgentTesla)", "value": "bd2e39f5dc5438a4a317e35f38a301a277fa4508", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056656, "uuid": "fb644850-0bdd-4d28-bf54-a1a12080a51d", "comment": "Malware payload (AgentTesla)", "value": "8f3e3e4c0219d972ddc3d2829fbbd16b818d33839ddc477e9d63548927334f8fe0f6d8bb1419f915129f6883e64f72c5", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056656, "uuid": "99ac1546-0d5b-4e27-bc04-cd203e51a61f", "value": "T11D9423079C990C0D35AA08B8EE871094C661F68767C296487E84133F5B77FFA2DF7A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056656, "uuid": "ad950277-cf25-4454-b034-dee092a141ca", "value": "12288:mQp1D7VIDfijh3u+kuipiXIc7JSa2r2tL+zg:mQpUssII+2eLog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698056656, "uuid": "3be874c7-e7af-4a7c-9cb3-8a268dbdc41e", "value": 443264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698056656, "uuid": "2a13909c-17ad-4ac3-ac46-f951130d4178", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056656, "uuid": "2eab9017-bc06-48b1-8efc-2ea2a49a930c", "value": "bankcomfirmation.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d589813-7188-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkGate)", "timestamp": 1698054152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054152, "uuid": "c09570b2-76ca-4f97-bc4d-b86680e77a8a", "comment": "Malware payload (DarkGate)", "value": "6f87cd47913c60e70a087534c07f14b5", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054152, "uuid": "8120914f-616d-4706-b431-711e58045952", "comment": "Malware payload (DarkGate)", "value": "15e4de42f49ea4041e4063b991ddfc6523184310f03e645c17710b370ee75347", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054152, "uuid": "9a5522a8-8585-4cae-b35e-db6c627bfe8a", "comment": "Malware payload (DarkGate)", "value": "ae5c8937272da7ac482d492fe2c2902e4e7c62ea", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054152, "uuid": "c12c2078-fa9c-495d-9faa-7a85b6726e32", "comment": "Malware payload (DarkGate)", "value": "75ae31ca48f6e11c7e94caf2af3c2db6e173020213c51fe5c30b470b54b3a97c055a59a4ee50f3a0775eae5e0c861b6c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054152, "uuid": "3d2d2b29-c77b-4aae-a26a-c7b5d435cd29", "value": "T16F45F1F366947D72EC720EFFBED5B0149429F9552E2C570AA7D04DB8072A64022B878F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054152, "uuid": "d9e5ef55-03cb-495d-b804-e27396a37e6d", "value": "034f38639699e92397f7a2b852d870f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054152, "uuid": "04b19951-9160-4fac-a2ba-a3ab60d7cad6", "value": "24576:udKa5x+tEWhqlIVibDrGw/gxoTcX3ApgGl92RY0cPL/e:cH5xRWhZ+L/g6cXwiGlz0c7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698054152, "uuid": "2ea2ab06-4386-45b1-b9ec-62109927d7ec", "value": 1247964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698054152, "uuid": "87fb58b3-aece-48c7-99da-85e20c5557bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054152, "uuid": "75286efe-5f9e-4417-89bc-4340447ec2a0", "value": "xrN.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da80d30b-71c2-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698079219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698079219, "uuid": "7e82db20-ddff-4312-a67e-c2cd79618abb", "comment": "Malware payload (RedLineStealer)", "value": "6a6d8ab14fd0cc7a7d8abbd0c1579464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698079219, "uuid": "15a7f364-33ba-424f-bf99-600a2f52ab06", "comment": "Malware payload (RedLineStealer)", "value": "16f72e18e82b49e6e5fb73c127ca02d84abd538f3b0b78b9729f8ccfa5f9ad96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698079219, "uuid": "bcf38702-646b-4b73-b04a-76915a835911", "comment": "Malware payload (RedLineStealer)", "value": "3b3594c61246f692ed1b35e8cb59478a5d34b089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698079219, "uuid": "6c60b87a-fd5a-401d-bf0c-cac87f374be3", "comment": "Malware payload (RedLineStealer)", "value": "836cbb9795b9eefac2d9f05b6300a35935cd5a6a6926f9a5e38424fc7766a18d2d95e1cbc67d93404c3c03232c42e4db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698079219, "uuid": "3afb2ac0-444b-4c5e-bc3a-d750863f377f", "value": "T14485231176DCD632E57923B039F613DB0E3A36E0291D076BA619A86E18F34D1923673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698079219, "uuid": "2d5dc8ce-2e4f-448f-b504-26acd95dbd75", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698079219, "uuid": "895ff85b-adda-46cb-b6e1-e7070899cd94", "value": "24576:ByI0KYWek56P25HZTfapDeYjsKBEJTyteHFYVpOeBmMKpdsP1olCMJO3KVzy/fZA:0I09EQmhapvjTEFkeGtwMGG3COlHwiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698079219, "uuid": "68dc16b6-678a-40bb-a49a-da28e00df10a", "value": 1764352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698079219, "uuid": "8af98f17-c9fd-4de4-b824-6448b3931651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698079219, "uuid": "28fadb33-fe3a-4cee-948e-67f6969d67b3", "value": "6a6d8ab14fd0cc7a7d8abbd0c1579464.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1836bf8f-718b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698055271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055271, "uuid": "80e610ac-78f9-46e9-a784-776b62d1d786", "comment": "Malware payload (AgentTesla)", "value": "f0dff3c8867e2d889cbd6393cd89a930", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055271, "uuid": "f713017f-e092-4578-bd73-5600d179f937", "comment": "Malware payload (AgentTesla)", "value": "170083303e53e3af9b4c44a3dabafa24c33c1c38c1f479588a8935318f25d710", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055271, "uuid": "1d89bc89-a254-488d-8f0a-f31a1289caef", "comment": "Malware payload (AgentTesla)", "value": "11dcf565df466baccf89d33723762cea3cbcef27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055271, "uuid": "4ff3df9d-01f8-413a-9c72-06a31969b75a", "comment": "Malware payload (AgentTesla)", "value": "bc14456b06b18a9232ab5d4bc36ac0789802e5fc6515bb6facedbe4780664ded82a619a3556100ddd134e8411683ede4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055271, "uuid": "c7409091-1ca7-479d-993b-c4659dcf6525", "value": "T10A05BF1031EE77A5D53AEBF28354584493F6F123A31EFA4B3FA606CA442DF419F52922", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055271, "uuid": "f42fdf18-db2e-4ca9-b55e-a0dbb369ffc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055271, "uuid": "8766ed60-7e15-4426-a55e-45362c93790a", "value": "12288:DI9ahsDwXcjNNWP5ZI5czgybMBdRsr8imZqntsZDibCilpdbfN8MXZ3Wl9pApB:EHX5NWXeVybsS8tZqntsZDQXltloKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698055271, "uuid": "17cd948e-59f8-494a-bc8f-f5198f2e9c8f", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698055271, "uuid": "423b16b2-aba3-42ac-ba80-6bba0ac8fc46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055271, "uuid": "6b282e77-1480-4ed2-aa23-c53c7be595d8", "value": "TRUCKING INVOICE 01168566.exe.gz.001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b6c55d-713e-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698022226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698022226, "uuid": "514e93fa-711b-4286-bd0e-24b141800832", "comment": "Malware payload (RedLineStealer)", "value": "02e271ad5b88e521f5135c4c09997b76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698022226, "uuid": "f48d820f-516e-4415-ab31-2a5ae4e44a9a", "comment": "Malware payload (RedLineStealer)", "value": "17aa98a2d2078003e57cef8d7fea7efd934eb6a2124ca5b56428466943cfad00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698022226, "uuid": "7867f5f9-e019-4079-99ce-b46818b6f1fd", "comment": "Malware payload (RedLineStealer)", "value": "62674939e9683022aebe0e5e063d6a2c881c2847", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698022226, "uuid": "f25e06a4-49bc-4034-bbef-887888981857", "comment": "Malware payload (RedLineStealer)", "value": "1a9d02bca870ca09fa4891c6733ec93f16442c593ddcd18d159f67185803eae94dba93becb9daa43bfabf54a67eb422b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698022226, "uuid": "513d881a-1b4a-4a5a-afc3-f0a1fd23825c", "value": "T142C41252E6E88436D8B127B05DFA03970E34BCA65CB8975B3345684E1DB368169323BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698022226, "uuid": "b55f69e4-a780-4441-a115-ab0c961ee538", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698022226, "uuid": "8af07444-aaa7-4746-a876-381117bbef25", "value": "12288:aMrsy90OJ8FEk13pXU/fcfmVC9Wo03b5E4aW1E9rSUJb4YF:SyZJ8b3pXUXcfvJe5EW1EvJb4YF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698022226, "uuid": "06ced474-4ccb-4e54-b3dd-0309d136e9f9", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698022226, "uuid": "e237e472-8af7-4acb-9e35-78a59f5704be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698022226, "uuid": "66236f45-6000-4e13-87c8-df64a8720e61", "value": "02e271ad5b88e521f5135c4c09997b76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc517986-71c1-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698078739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698078739, "uuid": "e641d438-01e6-4802-9301-c27f71e9d74f", "comment": "Malware payload (Smoke Loader)", "value": "0e20ee2c2d385cdac2b09cd0e6ad01ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698078739, "uuid": "079af06c-cb67-44c1-ade4-0b7938c1e1f0", "comment": "Malware payload (Smoke Loader)", "value": "185a11a8f7ead5953a8ec8efa95788bfcfdea70855432745b5fc4b5793efaf80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698078739, "uuid": "3dae6601-b077-45cc-8d28-8b882de164c8", "comment": "Malware payload (Smoke Loader)", "value": "eb401a5e5dbd35b38efcbb67819bb2e2d47c26c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698078739, "uuid": "5ebeadb5-e34d-4f1c-aa5d-9b9951390d67", "comment": "Malware payload (Smoke Loader)", "value": "121618b6ff8b8fc9eb03d2444854145d4dccc1cd3760cee4da4cce1b2c8dfaea05233443f07062a2146aa98d1f36d0e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698078739, "uuid": "8b3f730c-f010-4055-a28c-c46f19495a98", "value": "T14A850A1176F95B59F9F30FB85ABAA611487AFC6ACF11C2DF1250908E0D21BD09970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698078739, "uuid": "78103e8d-c72d-41eb-aac6-f3f8b7930bd4", "value": "037522269f8348aa17add864631a3f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698078739, "uuid": "a2eb1443-5260-413d-847e-240def4c1957", "value": "12288:eFV2CFpUmPAfSBsqe7E95XmHCbdPYmstzd480uzzvs9X6a9DhvhVdDozk15hgIY:0rbAfSKqe7E9xndPWNK6a9Dhvh/DZQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698078739, "uuid": "cc120fcc-d0be-48e7-9c26-ba29face8fcd", "value": 1724416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698078739, "uuid": "fe9fb316-4514-444b-91ea-a1ab4d21eee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698078739, "uuid": "a71d8148-8dd7-4a11-80f5-bf02fd699206", "value": "SecuriteInfo.com.Win32.PWSX-gen.880.29362", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008664d4-71a9-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698068116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068116, "uuid": "c964d13e-257f-4014-ab07-190678189476", "comment": "Malware payload (Formbook)", "value": "523b14bd2c022ca29baccc5b0fdd0ba9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068116, "uuid": "4e0b7db5-d984-409d-bcce-50560081fe5a", "comment": "Malware payload (Formbook)", "value": "18e593f8cf5ccfbce8e118db3d4b50d67ac7876431e253bba5006e3fbd6316b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068116, "uuid": "6d1f5f0d-21f9-4bcc-b451-ac04ae868a86", "comment": "Malware payload (Formbook)", "value": "fd7b0677f1ee8e1ff719eafbf4c37b7061baa267", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068116, "uuid": "c121a85b-2de5-4bd1-9db0-e579c73726b6", "comment": "Malware payload (Formbook)", "value": "b8d76151ac22686475f343fe8a1711c22e05c757256adb85a854ef9df6943301d82dc3d00b23a9cb7d36ad08ac8d0421", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068116, "uuid": "f446d19b-61cf-4623-9ddc-5a5001b0aac1", "value": "T16385FA1176F95B59F9F30BB85ABAA611487AFC6A8F11C2DF1250908E0D31BD09970F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068116, "uuid": "ae129557-5c40-41b2-a305-e4c09607b6f7", "value": "037522269f8348aa17add864631a3f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068116, "uuid": "1ee332ff-ef1c-4f0d-8103-256fbad9eb45", "value": "12288:eFV2CjpXmPAfSBsqe7E95XmHCbdPYmstzd480uzzvs9X6a9DhvhVUevrggIY:0ryAfSKqe7E9xndPWNK6a9DhvhqejbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698068116, "uuid": "5a1c5152-a007-4d84-b4a5-ff52df2096d0", "value": 1724416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698068116, "uuid": "9afc79f6-d005-466b-bd0e-367b79a46696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068116, "uuid": "4fac8e32-a9e6-4f98-abbb-783b9447df02", "value": "523b14bd2c022ca29baccc5b0fdd0ba9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75783fd-716d-11ee-8907-42010a9c0042", "comment": "Malware payload (Riskware.Generic)", "timestamp": 1698042707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042707, "uuid": "464e1584-e98d-4ba1-a16e-83ee50c0a752", "comment": "Malware payload (Riskware.Generic)", "value": "3537b4d56b3b37a48251358f23a8f4e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042707, "uuid": "35582853-4316-44d4-a564-30f88407a64e", "comment": "Malware payload (Riskware.Generic)", "value": "199aa258d827bea1dc8986ed300b079e13d2f87c24e50e97a9f5a58c83617991", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042707, "uuid": "f1f46277-68b7-43ef-8a30-4b0b5913ec75", "comment": "Malware payload (Riskware.Generic)", "value": "44ee78b88cd255dd1c02aa0b125d9f52e2e052b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042707, "uuid": "327b42e6-5cf0-42e7-a52c-0c32820ec2f0", "comment": "Malware payload (Riskware.Generic)", "value": "7701762dca18de1720b1c518c9c418c0a6995305874a6a86b86e243678045c56ad8faa5a387de8ff67c057b22f1e2d64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Riskware.Generic", "colour": "#081407", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042707, "uuid": "7b371c7f-4f58-4635-bdc0-82878f03cb19", "value": "T170D423397928FF6AEE9214BA264F411D56704800212ECB6B230D7E957C9EBB47F70277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042707, "uuid": "3ac8e796-8681-4139-b969-e1bfa3866d7a", "value": "1b231984013dfc65a9ea922ec8d5e1ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042707, "uuid": "93c2706d-3016-4bc3-a7da-c9d9ea4fc33a", "value": "12288:ZqYs8NBcpn+UGtmrO3SypoLukeWdfVG0kL8ZJUXWvjQdJqEX4:ZqYs8spnZtO3SypdkD88XUX2jQX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042707, "uuid": "b8fdfac6-9376-4daf-8f4f-4d5dce074740", "value": 622904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042707, "uuid": "2cfaa050-4794-4493-9bc1-dd811007e832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042707, "uuid": "4499caba-aea4-4815-a2df-7408bad0b188", "value": "SecuriteInfo.com.Win32.Evo-gen.5212.1329", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7df0f31-716d-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698042735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042735, "uuid": "8f9c19b2-150e-4a3e-88e1-11fdc564b806", "comment": "Malware payload (RedLineStealer)", "value": "9908e2bceebf855e80ae54af8a2df889", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042735, "uuid": "a92928ba-ef20-46b9-a903-5e4b801614e8", "comment": "Malware payload (RedLineStealer)", "value": "19a5970b745f76201f5d67ea465fb8256defa0264337f08713bdfd2818f9c2b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042735, "uuid": "390f8eb9-a08c-4fa9-b7f4-85f14d61b3ab", "comment": "Malware payload (RedLineStealer)", "value": "43aaa84bfd335beb91d7ae11bd8f14f42c66610e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042735, "uuid": "56014375-e7ab-42f0-a2d7-1c16520edad1", "comment": "Malware payload (RedLineStealer)", "value": "f62b50bf970987757b4d2a3106bb0341df35b4322133f0a33fcc7b312e201e3e25fcedbeb4e894f2cd199d0830a09968", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042735, "uuid": "16ef5184-a620-4b40-ab44-0d6934e47f5b", "value": "T1D8B47DAEF5D0F831C077C572C81F6728D4939E788B061BE77EA1C56C16982E2BA764C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042735, "uuid": "6e4293de-fcd8-41eb-a147-02e1ba228b16", "value": "d52ccff4f325ce6b295038c3a3f9150f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042735, "uuid": "149d50c6-8e50-4a48-bceb-49e38365da2f", "value": "6144:XnWQry0u881Z62/vpUOXia60CoOO5R2ZnxQdLTJFb246eQB8ApxwNh:3WQR8zlvpUOXia60C3O5R2sdLu4uBPyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042735, "uuid": "bb8ad655-ad89-47e8-be17-d2bfc5eefaaf", "value": 509512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042735, "uuid": "02b0a1dc-6c96-4eb3-a2e7-79f412cc6b91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042735, "uuid": "2b5e1698-ae48-4eda-89fc-21de5728f06a", "value": "SecuriteInfo.com.Win32.PWSX-gen.6893.13413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3a55bf-7191-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1698058148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698058148, "uuid": "79be7128-31c8-409f-82f0-410bb6a1d28d", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c8ee3a6885f27af7f2c2e918f8d2baed", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698058148, "uuid": "73dea34d-c157-4ac9-912b-6e17cdbcfdd4", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "1a648c4a8df863ea0ffdd17c5f4a07250f4f40cca5e7f9a628266acd8d08817f", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698058148, "uuid": "7974c770-28d2-41fe-8029-b2675d6a2f2a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c5acd6bdebd71ee1443004939c359d67d7cf8f1a", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698058148, "uuid": "fe42790b-57cc-4bcd-aaf2-bc902b5397b5", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "60d3adb8506bb207d969506ca33253d552612cca81c0359fe81b056bd36b2bc3720570a1ecf5e012b7bd19dc90cb5191", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698058148, "uuid": "a7f3d615-1ef6-477d-a525-ccf75f798acc", "value": "T189752352E7C54173CEB573F098FE02871635BF660C7C81563781AC848DF2AA9A176B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698058148, "uuid": "40744fb6-b8e4-4e4a-a85f-bb32f08f6ffb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698058148, "uuid": "ae39fbb4-77cb-4bd9-8bde-d42a25e7d806", "value": "24576:/ylfzZWAQ0dXIEieHexkOuiY7HpAO19j5HmTjPQLE9p:Kl8AfX7Z+7ur7pr1v0jPQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698058148, "uuid": "035b1628-3180-4776-88a6-60d0ccd728e9", "value": 1591808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698058148, "uuid": "5419ad7b-a68b-4057-ad59-070bf3460daf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698058148, "uuid": "5ae8eb07-5467-4993-8c7d-35cf9dd1d3b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0270239d-71cd-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698083581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083581, "uuid": "f02ee16e-f817-44fd-8ba6-ef91bb6dd4a2", "comment": "Malware payload (AgentTesla)", "value": "a385f200176ae9bd01f4f6fdff239a6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083581, "uuid": "259d277c-96fb-4dda-931a-624f4006ea9a", "comment": "Malware payload (AgentTesla)", "value": "1b238c709bf27d31a7509cd6fccc6fe63ad2a3595a91634c912e3f46bdf3ba15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083581, "uuid": "02058a42-70b4-4ce3-91eb-326d80092f6c", "comment": "Malware payload (AgentTesla)", "value": "26872b5be85628b432ee45caa5201c4f894aec25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083581, "uuid": "d5a12d86-52ba-49ba-9b8a-92e56b2f0067", "comment": "Malware payload (AgentTesla)", "value": "4b8280ce767f6b945f1ff9dbcb6aa6cccf9ecd2c31f519eab20d49dcf8e92d2b3c86fee6ba71f0730babef84f696d52c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083581, "uuid": "6b6c8406-4c60-48db-ae88-354ca42f6144", "value": "T1D7C423B1099E48BAE631F4A74D5634F3A507C32915C7AF0E32523FD8AE3503A91CD8AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083581, "uuid": "71fab9d3-b2bd-46ba-99a5-609c7ae8b732", "value": "12288:3PVYqntrrjF4w/cd/P57Gnm40Zge2tLC+RmC92A5:3PVYq9jF40c5FGn508C+Rm9A5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698083581, "uuid": "8644f4bc-e5e7-49d2-b417-56ad37d875df", "value": 567409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698083581, "uuid": "3008dc59-8ae0-4871-9197-a3ac3690da06", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083581, "uuid": "1004d07b-d05e-4696-b809-a2133a265463", "value": "IMG.00HJEIY PRICE-QUOTE SSG 0874087.R00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af589dd-71ee-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1698097876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698097876, "uuid": "c264210e-9c2d-4a87-bed2-8eb35e359d54", "comment": "Malware payload (Tofsee)", "value": "b0711856dae32e948f5c34e0510b26c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698097876, "uuid": "5c596e5f-2591-44d9-bb02-a6ffaf08df3e", "comment": "Malware payload (Tofsee)", "value": "1b516ba7ed485066ca4fda9a0323fa66407ae8904719829679f7fd27911b1d27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698097876, "uuid": "04700975-7c8b-4365-9dee-ac8ff67dffcf", "comment": "Malware payload (Tofsee)", "value": "f4e9627f8b3ddbfbea9d7db64f3a0f920e099430", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698097876, "uuid": "719d9f6d-8bd1-4180-8827-a581181fbaff", "comment": "Malware payload (Tofsee)", "value": "6bb919dccc19aac7529e9e8222a3dace92a7e2429ae730ba60aca3a4f210800a6a7c8e7ab7da5d512512fe571ab166a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698097876, "uuid": "7c6db2d1-9b61-4a5f-b4c5-5bcd0a51437b", "value": "T1D0448E13A292ECE0E51685318D2DD6E4762EF9616E18EFDB33187F5F18711A2D263313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698097876, "uuid": "53666990-b565-4b29-a998-a1e13bcbce70", "value": "8476da44cd20575d5795ed699abb22f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698097876, "uuid": "d6fa69ad-aed9-4cd5-9cca-ad3cd97a0e1f", "value": "3072:DwXfBGEuDLRSOFfADmM/bpsa63m0MA0gtxhnSa5dvUZB7Sj:AUEuDL8Uf/wC8qbjGBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698097876, "uuid": "b1cfb940-6fcb-4a07-a068-4d0241084abe", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698097876, "uuid": "29dbbc0f-08e4-42db-8533-20e698a750d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698097876, "uuid": "db931e61-a606-44fb-860d-84c6efa737d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4d8085-7197-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698060652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060652, "uuid": "a428404e-65c1-4ec5-841e-5d05ea88f685", "comment": "Malware payload (AgentTesla)", "value": "af01f39fd130b370288686adfe699c21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060652, "uuid": "4d70855f-16d8-4815-93ef-b3c3eb1b5105", "comment": "Malware payload (AgentTesla)", "value": "1b96cccba8208b1f786a5fbf1b877e967a3720dba3614044ad0fa3a5c4f5fffb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060652, "uuid": "0d8c7021-b819-4a9a-92fe-5d6de191024f", "comment": "Malware payload (AgentTesla)", "value": "0d9378ba59b833ad1626bcb698cecb5c1f4c501c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060652, "uuid": "cfa52f21-c4e1-4218-b020-6de7f930f3e0", "comment": "Malware payload (AgentTesla)", "value": "24ddf5851773342d3fcde757554436bc64436b36fe27523805b6342c333cefa91eed90750d6e00bed81d2e7e6cc16ca6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060652, "uuid": "cc389ce0-5070-43b9-b8c3-81a75510775b", "value": "T17EF4AE4131CDAAD6D037ABF2035D945053F5B95FD21DEA0F3F82664B40AEB022A67B1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060652, "uuid": "71f5f9c4-d12e-4fec-b2c2-870c7e76c346", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060652, "uuid": "8d4c7c68-4a9e-462b-a9fb-11a54a99c1cb", "value": "12288:AIJHPYhsDwXUI3TYbyzarCBh6JLtmamJQYe87c0k/LCSiyyjK:HpzIUbyzarwcJtm07Z/LCd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060652, "uuid": "f2f44e6f-5291-40dc-96d9-5f3c57223ebf", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060652, "uuid": "c906be45-55cb-4fbb-b9c9-7fc01330b69a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060652, "uuid": "aaae0f0a-c08b-4da7-9742-e3a9afafbfcf", "value": "Customs declaration form & declaration elements.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14399c0b-71ec-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698096926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698096926, "uuid": "3adb76ec-2270-44b0-accf-5e930742f645", "comment": "Malware payload (AgentTesla)", "value": "b551da554933c2c064f96aaa6aa9ff55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698096926, "uuid": "ebf65b0a-866b-4ef1-a6af-348933ccb3f6", "comment": "Malware payload (AgentTesla)", "value": "1bead1d425196aa29d74a07fca9519db1e42242ad63e7a157979b83ee1722980", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698096926, "uuid": "728cecd2-e394-4394-b978-82f211d12ca9", "comment": "Malware payload (AgentTesla)", "value": "ba4c6e1d3ba80c81ba4a371f11a444a7f06fa07c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698096926, "uuid": "471c0835-7fb6-4065-a2f9-c9740fcd2897", "comment": "Malware payload (AgentTesla)", "value": "58ddd26c7e7e9fd3e0bbc2ed1d9fc235b1dd33bed6bd7bad13d1744ce2f48ba3d274833c563d3dfe1dc1208e12fc7348", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698096926, "uuid": "ddc98c10-a692-4272-b0a4-09d0a769232b", "value": "T105341E077E88EB15D5A83E3782EF2C2413B2B0C71633C60B6F49AFA519516825D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698096926, "uuid": "37f31834-675d-4213-bbb6-cec2aaacc85e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698096926, "uuid": "2c5f27ba-9287-4262-a078-3c30c881265e", "value": "3072:ZFMX/mqWSGU/7ucFPBrOLTDZNtEwU5xVrRNGyQ:zMX/mqWSGU/7ucBB6nZNtE9rK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698096926, "uuid": "7b7bd87e-7ca5-42d6-abf4-37721111c8c4", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698096926, "uuid": "1c8ed5bf-9bff-41ad-b2ca-1e703687c3f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698096926, "uuid": "b4c57e06-b5f6-4a98-98a4-88c3dba4a9ea", "value": "b551da554933c2c064f96aaa6aa9ff55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1152dc03-7166-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698039368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039368, "uuid": "c897134f-cff4-4d10-896c-4d3a577d89dd", "comment": "Malware payload (AgentTesla)", "value": "dfaf2b95477c1fc5021d56865f24c9e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039368, "uuid": "8b098da5-546a-405c-9bac-70bf4f71c0a3", "comment": "Malware payload (AgentTesla)", "value": "1ecf4a80641db7366f049cd1a60eb75d36eb68578d5e71e4e72d2474aa9be7bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039368, "uuid": "df2b8056-3f50-4703-bf69-d13db9512db7", "comment": "Malware payload (AgentTesla)", "value": "4e3193faa031502b523812a03f7a4f006fc12d86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039368, "uuid": "30df66da-a53f-4a51-a591-324700ee5577", "comment": "Malware payload (AgentTesla)", "value": "4c1c91947cd195e5c54c29a04a0132b4f64c6062dab6ca37e8d4d58e7ed259204e0782afe43e941c337790177ade7a1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039368, "uuid": "43828659-9cfe-4590-b41d-5b474aedd5ec", "value": "T109558C495F4AEA13CD100271D496C6F72A49DE9F9707A3335BECBDB3308738956883A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039368, "uuid": "f611fb4f-9c7d-4fe9-80a8-384eeca42354", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039368, "uuid": "d4aa72be-bd5b-4119-ae87-48483ce24957", "value": "24576:3Jw+jqObbKGdxzYqhf9VMM+YzdtCExxi14:Zw+GObbKGHp5MM+odtCEni14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698039368, "uuid": "7a1e232e-873b-4ce5-bbdf-6b5ede23c31a", "value": 1396224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698039368, "uuid": "1cbdfe28-5d77-45e0-a979-d5dc4457b0c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039368, "uuid": "67e52461-82c0-4d08-af4c-01ee94a4df2a", "value": "SecuriteInfo.com.Win32.DropperX-gen.26932.6773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18aa7b79-7192-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698058278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698058278, "uuid": "75f188cf-ade4-455a-a33a-fb6d7ed094f7", "comment": "Malware payload (AgentTesla)", "value": "bd8ea9ba4a17d36f1b8dc2b9d2eeac69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698058278, "uuid": "4f69290b-72a8-41df-ac76-6b3d11d66590", "comment": "Malware payload (AgentTesla)", "value": "1f8b414a36c3fe2b9539eca8ec72742f22ce69b899cb9071f47072e814a0a59e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698058278, "uuid": "3b931eac-c1fb-47ea-a65f-8239b40d9a53", "comment": "Malware payload (AgentTesla)", "value": "5355dd634959d4d3557d94f83af5012ed29ad18c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698058278, "uuid": "33bfd638-26a4-4099-8b57-088b3cba6d87", "comment": "Malware payload (AgentTesla)", "value": "42af5e43f51dba2b9b511c5922141411a4543d1924f1054e1cfd3bb3e974e7108446e16e7c3285123d1b9782d0ac6f76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698058278, "uuid": "c2339944-63e6-4d97-afa8-fdbbce226baa", "value": "T1F6D433C883282B73D41A6D0C04D8927D81EAE487DEF63B7A91CDC785B657988423D9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698058278, "uuid": "c41513ce-44d1-4081-890c-9121e3d527c0", "value": "12288:4WeqvDFRiExTBfbr2UsSWk8IuNcZyFEGBIDPRpI30GJV6wvKiQtRGtg+:1vXi6xr2UsRHIui06GeNpWJV6oKi0N+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698058278, "uuid": "fd077254-7d2c-4fe3-9c26-2ded03041272", "value": 617572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698058278, "uuid": "2006034a-866c-493a-8fa2-5caa368b6c86", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698058278, "uuid": "336b1212-66f8-4f09-9aba-65e80674e1f1", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65c380d-71e7-11ee-8907-42010a9c0042", "comment": "Malware payload (Heodo)", "timestamp": 1698095131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698095131, "uuid": "d2504e66-03f4-404b-b178-da907c0f2d8b", "comment": "Malware payload (Heodo)", "value": "69f900118f985990f488121cd1cf5e2b", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698095131, "uuid": "696d28bf-bc21-4f3d-974b-909937adfb4e", "comment": "Malware payload (Heodo)", "value": "1fb6b8bed3a67ee4225f852c3d90fd2b629f2541ab431b4bd4d9d9f5bbd2c4b7", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698095131, "uuid": "f5636439-184e-409f-bcff-99991827b578", "comment": "Malware payload (Heodo)", "value": "33f6b7aac2afaba74eeac1a44ba9ec5d0a53d00c", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698095131, "uuid": "ed014942-2c77-41f0-b0b8-6cf411991948", "comment": "Malware payload (Heodo)", "value": "4bb3e7042affcea1350f9cb02669c4d69d5bcddc2702925cfe83725f2806a4fb33340fb7913ec0f2550080dd5b0781aa", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698095131, "uuid": "9daf5bfb-0ee6-4bb4-a96e-a19be459b831", "value": "T16EA633317984853BE64E0532D6EA8F206A7EAD241710D1CFBF54B2FC59B02D279363A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698095131, "uuid": "6b8ba506-78ec-48a7-819d-8bb50bd69ff4", "value": "196608:zhbWzPMCeNrs0rczeuNr/QnMOsaB9QVuHSzdUupBqbHSDjs6cv1HDQfgaP:FbWzPM5HCZNrgMVw6wyZUupkjSPcv1jO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698095131, "uuid": "57ee132f-6b3a-48a3-94a3-a31ea2330a54", "value": 9617408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698095131, "uuid": "49e3ff0b-09f3-46a9-b24b-9da9bace61b8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698095131, "uuid": "d57b38dc-ce4a-48d0-900b-2fb2e1b85ed7", "value": "6cda346f63d0573b10b068df355b53abd1abe75427db0925244d94a8.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808d9cf1-71aa-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1698068761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068761, "uuid": "eea90118-39dc-4652-8b5d-ac029e334614", "comment": "Malware payload (MysticStealer)", "value": "148a3aee3ea8c0c9973daf8912e6e2be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068761, "uuid": "04d19f99-caf8-4c54-a55e-e56d5ded9ea5", "comment": "Malware payload (MysticStealer)", "value": "209c2d7ecfde3fa3b6b93f4270d7fd57ba37accc202f5a2ff518b1895e29cd8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068761, "uuid": "6080a872-96b4-4651-9a1b-ecb75485caf3", "comment": "Malware payload (MysticStealer)", "value": "e103553c8f6ef7d05b2702e51a97ffcd539be4d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068761, "uuid": "fbc76627-a01f-4a32-aa62-0f2a5c336113", "comment": "Malware payload (MysticStealer)", "value": "c8939adf3c668b058913ed29f0dfcf5ff379567981d75a0cb3d5b55d0ccb7f77cc4ef1d7cb79dda99c47ee471947f1be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068761, "uuid": "9f878b6b-dee0-493d-ae12-81e7a2ec4513", "value": "T1C4953C1176F92B59F9F30FB85ABAA711487AFC6A8F11C2DF1258504E0C35AD09970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068761, "uuid": "16538f99-bef6-4e0a-9a4a-e39b6f9c5d3c", "value": "037522269f8348aa17add864631a3f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068761, "uuid": "06291e62-6ed0-4a69-9169-66f25b20e174", "value": "24576:trsAfSYqe7E9k7d+WNO6a9Dhvh6mJV3I:ttqe7E9rW06a3vlJV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698068761, "uuid": "29023ea4-5f76-4390-9e5f-6f9652ac5a09", "value": 1909248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698068761, "uuid": "a46e652a-627f-426e-8ccd-327312cc7ef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068761, "uuid": "63be7c57-5331-4e11-843f-c66bf85491a7", "value": "148a3aee3ea8c0c9973daf8912e6e2be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dccdb18-71be-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698077158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077158, "uuid": "9a087fb1-d0ef-46b7-81dc-a1729c7c7653", "comment": "Malware payload (MarsStealer)", "value": "308f20d5ead9c5a586c2c0174b31a4af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077158, "uuid": "9ee5496d-8f3a-42c7-abf8-f9f3ed637f93", "comment": "Malware payload (MarsStealer)", "value": "20f1087a34575a211a19f1ac7f8c9743030c21db5bb2e4c34c698041c1be3b75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077158, "uuid": "bb17a769-8e82-400d-a32b-f9f5809f090a", "comment": "Malware payload (MarsStealer)", "value": "c403c72e249aa6b9bd499effc0e78ac4bcc73bba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077158, "uuid": "7fd6b52e-2046-4612-ab3a-8cc31c7f30bd", "comment": "Malware payload (MarsStealer)", "value": "c1e1e97e3634b1b9b028c46a9dd0fab465c8a77e2443b710229e1bd83cd77abaf53260c929c7b96142b3a1967af15c18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077158, "uuid": "3ed2971d-080c-4f28-a709-a9e8b183c800", "value": "T14D448E03A2E2EC61F91646318D2DF6E8762FB9708E59E75732186F6F18B0161D2633F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077158, "uuid": "85ed8e20-29e2-4726-aa5c-b93aff31a3eb", "value": "a31d28b14a82da6e3b2b7ebbc290018e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077158, "uuid": "14a776f0-b46b-4755-b636-5695a3578212", "value": "3072:5wXXJOYvYLd6OeMZrC0tu3AYrMKR4RBI0fGfqRLO9PKVLEaUWvuj+5004UtfrA:GMYvYL47MZe0QQj/RcfTVaZuzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698077158, "uuid": "6079315d-335e-4200-86c9-76ff46d2e843", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698077158, "uuid": "1babafe1-bfd5-4482-b2d7-05a8a262d8cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077158, "uuid": "af8d4e24-5418-4788-9205-af5d1951da84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c199d3b-719f-11ee-8907-42010a9c0042", "comment": "Malware payload (WSHRAT)", "timestamp": 1698063975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063975, "uuid": "cae228f1-4537-493d-ad0a-31c662d72b67", "comment": "Malware payload (WSHRAT)", "value": "aa4bb1e4cfe615e1890c18959f0f6fe6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063975, "uuid": "5ef0fbbe-7aab-4f8c-9ee5-561f94fc1b86", "comment": "Malware payload (WSHRAT)", "value": "21d1b6a68906c9062a548838de678dc76f763bb8300ae753e352716dcdd9be7b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063975, "uuid": "77382a61-b872-4a62-a0ff-5fe2bc71ad08", "comment": "Malware payload (WSHRAT)", "value": "00fead3c49c16e409139630f011a00f2254adb9e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063975, "uuid": "1b730667-830d-4703-b47b-d576c4b54a77", "comment": "Malware payload (WSHRAT)", "value": "d8b888ac8bc75b640046e5edcf0319203b99e7aecc8cf09fe3c7a7cfbb16f5bda3ac74ba18d46ff277931a81a031de1f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063975, "uuid": "f6d6a4f0-79ce-4c9d-860d-937bd9f7c964", "value": "T1B63529C269DD9B23BB92AD86C16D572F6AA5C213050E3401FAC93F4CAF1FC4479B59E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063975, "uuid": "cb8cb469-b59c-4285-ab84-4f6fe18b5824", "value": "1536:MQ65yrQXApr8K8Y898K8Y8y3CAnuCLkxN013iog2jUS0XS0PH6Z86iLvXg0AnhPd:MQqEY1jbMYBX9h34FC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698063975, "uuid": "3d13cb49-793a-4669-b74a-32e0c5033c4f", "value": 1085852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698063975, "uuid": "9de13f3d-56ce-48f4-86b0-143e1400b3b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063975, "uuid": "13ada18b-1330-4c9c-a3b5-a6da62fa8d38", "value": "Tax-Returns-Of-R58-765.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41904fff-719d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698063071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063071, "uuid": "6fb5bcf0-3531-46c6-8df9-8bb77a6b9331", "comment": "Malware payload (AgentTesla)", "value": "052f519a4a7fa9128c300a1f28edf62e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063071, "uuid": "e6199398-0643-4462-9ed2-940f49861b34", "comment": "Malware payload (AgentTesla)", "value": "24f6addd928488e01d3ef7de3efb744bad2fdd4b6dd73238ded1d6ef1302f2de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063071, "uuid": "7e36d795-97b0-4e23-aa89-9b4f8e1ff170", "comment": "Malware payload (AgentTesla)", "value": "7cc0d3dfddc2d7349caab0567e1c7203654ed9ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063071, "uuid": "aefd3170-6425-432d-865a-bef0c652ceab", "comment": "Malware payload (AgentTesla)", "value": "d9f5e29db9743bc0511fbd18f6895c1f4bd41c8cb226ac7f0596ad1c4987043ed7e17faddd59db380926c9b1a1755aac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063071, "uuid": "ca8b0e8e-51d2-4782-ad23-f9f63b762e2d", "value": "T158B4238470F52CF2DC5BEA3291EB4E9CD4155203E6AE64A1304B0AFCF1A4DDAF619B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063071, "uuid": "c82c2947-a5df-446e-8c6e-046ead1905c5", "value": "12288:tvRFAMGT7JpIc1xB/NpAUzl6zOwfhOLmQfJd/uz51:h/ANXJ26n1zwBELmEJQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698063071, "uuid": "28d0f3e0-be72-4413-a560-ae47ef66eee2", "value": 531379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698063071, "uuid": "c4fc6177-3132-4a36-bc17-b5de32ecf971", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063071, "uuid": "e84134dc-1ead-43a7-b4ff-d47364faf323", "value": "BL COPY.pdf______________________________________________________________________.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28dfeb5b-713e-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698022228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698022228, "uuid": "1cd9adef-990b-492d-bca4-f84b65357c72", "comment": "Malware payload (RedLineStealer)", "value": "296c0fbb16c9a97c451a49f04ec7a551", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698022228, "uuid": "1a5139a3-9735-4065-8bf4-cad82f1ca074", "comment": "Malware payload (RedLineStealer)", "value": "2520a9f5b5f634f478b2f46ce1d3bb387f2fe703a789448cce02caf18f8b643f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698022228, "uuid": "3abe59e5-cac3-4e5e-909c-75276b5dce92", "comment": "Malware payload (RedLineStealer)", "value": "af9edc01dc428ba586c914a5ecf62d5679d201d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698022228, "uuid": "082485f2-ebc1-4092-b185-c0a80c3003b8", "comment": "Malware payload (RedLineStealer)", "value": "7850175e1426c49ef4e29b902865eb98993f1bf714eba93896cdd78cdf82a221efcc0bffc676357d87ec238ae73850bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698022228, "uuid": "8837de72-3da2-4c3d-943f-30634ecc27b6", "value": "T16A8523434BE50471EA7413B09CFF47735F2879728DB855AF238AA8594CB3A84A135B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698022228, "uuid": "775c9eed-745c-42f3-9a86-70d970952242", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698022228, "uuid": "59da99ad-5fa8-4f2d-9ae9-f0b1765b185d", "value": "49152:nvnZDklKSNxOLajaGCXbRtBhl9vPOBhSF:vnZDsXb7apVtbl9v4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698022228, "uuid": "60cff5a0-9653-4f1a-94dd-051e1190ce10", "value": 1817088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698022228, "uuid": "7b1a76e9-8477-42e3-90f4-d94f266d592a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698022228, "uuid": "216cf0f7-f106-45f8-bfc0-e65d2c6a697d", "value": "296c0fbb16c9a97c451a49f04ec7a551.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1225cc-7187-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698053719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053719, "uuid": "74240d78-066d-4c61-ac1f-7f043454aa08", "comment": "Malware payload (AgentTesla)", "value": "0a702d6a0317d57161fb3b30fd0e3434", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053719, "uuid": "af859fd8-6480-436e-a27f-c64f0cb86cdd", "comment": "Malware payload (AgentTesla)", "value": "256d5f9e7bc46d9e10ee0b42285f78173588a68e61376c952293f51436beab82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053719, "uuid": "8edcd093-eae0-4d24-84ba-4e5b07d27e7c", "comment": "Malware payload (AgentTesla)", "value": "93d9e021397084dfe348cefed31ee81e2f589cb9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053719, "uuid": "c9db4f7b-6138-4f33-b1f5-a4e949fbceb4", "comment": "Malware payload (AgentTesla)", "value": "38735e52b61e5543e8a8d949f1e1c223b05ca07200ef5f3f90a7901f80aff311b3aa17cfc1218ab0bc2aea20ac21dd24", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053719, "uuid": "2d12ee19-3113-471e-ac99-bc7f5dfe8791", "value": "T10B05BF2132EE77A1E63AEBF14354184493F6B127931EF64B3FE516CA442DF419B13A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053719, "uuid": "63566347-9074-4ceb-918e-84e0b8926b67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053719, "uuid": "1a018a3b-5833-4687-97dd-d05b734a61cd", "value": "12288:cIhQhsDwXpqMFi9tJtgFQtqUigSJl5X+PhYXK5j8xRRw0MKmo9jmZLEnjL:Dx+LobJmFQt8gEuPhW5Rw0MKmoFmaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698053719, "uuid": "e59da415-5e0b-4c0c-8f52-08cef980d737", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698053719, "uuid": "fe9812c2-7020-4d09-af34-75e45e793aa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053719, "uuid": "316ef1e7-52a8-4bb6-b79f-9e645d5684ce", "value": "Outstanding Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d5994b-7189-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698054509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054509, "uuid": "fe72e072-d5b0-4cde-8e26-dfaf938c78ce", "comment": "Malware payload (AgentTesla)", "value": "2aaebe44a0a2a7f2512f13a45a979406", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054509, "uuid": "0a0fa055-2944-4fe3-83a5-8e2d62497672", "comment": "Malware payload (AgentTesla)", "value": "2596ebc0efcdc61bcedda6f54707f35e388a98cf2233d2a95ad3741535ce5838", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054509, "uuid": "a0d5d9f9-bda4-4a68-ab70-600fbf5c6faa", "comment": "Malware payload (AgentTesla)", "value": "99e62fad1ba7ade1e6048ed56ce5f54bd5651f68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054509, "uuid": "d7af573c-4d32-4d40-81db-28ebd949f545", "comment": "Malware payload (AgentTesla)", "value": "594e1d96eb1037a51877d7a79e1a7282a0f36ab1908c7552825f9eff848c242b42bb65568928e8ea561a218835d54803", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054509, "uuid": "3507e9ee-ed12-4b04-843a-340a9ef8f0ca", "value": "T112F412103B98AB52E23D53F5D9CA451807F30B7E1B66E35C2DC270D62AA5B18CE91F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054509, "uuid": "99962185-6496-4061-a11c-a78a1991f85e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054509, "uuid": "164aaf47-3716-494f-b421-123773cb05ae", "value": "12288:pMZCUMRgR/mZRM+Byvxmut4r0gfRT53+bI0K9zWQAL28zjry7fP/8:tgkZR5ymutCvfRT53gKxWQAa8zj2r8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698054509, "uuid": "9c356ed4-755a-4c5e-9e2d-a56fac08439e", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698054509, "uuid": "a30d955a-c106-4e6e-9dd5-950413779cff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054509, "uuid": "9c797192-b852-4a31-8ffa-ed297201e4c9", "value": "2aaebe44a0a2a7f2512f13a45a979406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8d9eb7-7197-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698060758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060758, "uuid": "5776bc05-6648-47c7-9c03-a3e91a836f5c", "comment": "Malware payload (Formbook)", "value": "a57ad3a116cc0b544c63e7655047570f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060758, "uuid": "61c1f707-7b6b-41a9-8f0f-c3b61c5393de", "comment": "Malware payload (Formbook)", "value": "25e8610d483e74bac4bfc7189060e7fdeed775f6e82cd69b3a36d1a12b4e2af9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060758, "uuid": "893d8b24-1b93-4679-8a9d-702ddc515451", "comment": "Malware payload (Formbook)", "value": "0729e7e1300ab2b0fa9cf60d32cd2a15276a1f87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060758, "uuid": "9f8af4ae-838b-4deb-a9cc-48e51a8b0cd7", "comment": "Malware payload (Formbook)", "value": "8f3ffd104321ad5b702404881f0c2639e55604e95ad386023669d3b829ad3eceebd9401d687f52623a8e5cae4a24f073", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060758, "uuid": "bd01a10e-d661-44e6-8d68-4ad77bc2a8ff", "value": "T12DD423112ABD6B92D87E8BFF54A3142153FD8F1EB133E35C1D5614CD606AB20A2A1F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060758, "uuid": "ee2a61cb-0582-4107-99bd-403e14f57330", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060758, "uuid": "721daf52-7c5a-421a-8e1b-a785a12e9673", "value": "12288:p//s02mvB+6ld9l/5ReV2fqy+/xCEL9HJfC/6afTTpcmUbgR/mZRM+:p//Z2mJ9p2hzhppqDrTpEgkZR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060758, "uuid": "02368baf-c3b8-4c7d-9fc1-925438d0ea99", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060758, "uuid": "9525c643-5381-403e-b069-6c217fed0cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060758, "uuid": "4e0f4d19-4f05-40d6-8061-6f7eb2d11626", "value": "Payment Copy (MT103 _03 _171023)_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e93d32-718b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698055484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055484, "uuid": "df59a7b7-e6dd-45ee-a729-589bf4cc7518", "comment": "Malware payload (AgentTesla)", "value": "41983d25a4a7b90c3652fe6475753b1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055484, "uuid": "535d83fb-e0dd-49e0-a2d3-ecb77e7e9099", "comment": "Malware payload (AgentTesla)", "value": "25f72ea3176878f5baa4f12c92e813fa6479c006c4676b3c1b8d2f1bf0583c67", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055484, "uuid": "786bd41b-da3a-416d-95d3-4366fbe8ac6b", "comment": "Malware payload (AgentTesla)", "value": "3836c47ab8d33cf65d1e21856108fe7937c007c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055484, "uuid": "e48cd328-9d24-4a1f-b0f7-dc1ff28c703e", "comment": "Malware payload (AgentTesla)", "value": "753101ef7ac46b5909080a4cd13a7002028a48bcfa188f4a29bfda64d0129242828b01f7d9caa923db9b35a87da17097", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055484, "uuid": "4ba49e3b-bacd-44e3-91a9-2a2fb69c8928", "value": "T12EE4232061FD50946D537E1F92D0E7A6D0A31B0D2143FCBDC563A4C4ACD2EE262E9AE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055484, "uuid": "728c1fcd-3277-4541-b69c-5e98bdbc1d03", "value": "12288:vNShy+u3qRn2vC9jBU6+B6bvJyyOnR2UKrOM62A:V4u3sVyBUxyVRLjlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698055484, "uuid": "e9fc82e4-2be6-4c86-a653-3732a34e96b0", "value": 660866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698055484, "uuid": "3853a894-99dc-49cb-82e7-d3f7ba378080", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055484, "uuid": "f826b8c9-400d-42bc-b50a-9db5f2af8daa", "value": "swift_876423.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814a9e8e-71cb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698082935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082935, "uuid": "8be962a7-6940-4a36-ac63-f3573df65c7c", "comment": "Malware payload", "value": "b4d80d81ce304b6da86020fe00ad7949", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082935, "uuid": "4d46d4cd-19f6-4772-b42c-b0e80ee78710", "comment": "Malware payload", "value": "2683e38ab2e2f0dff7d67142846a14ac8f0cae0bc43f979b8116eb92c9e39caa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082935, "uuid": "3661dce6-1a4d-4b01-aa25-90d1b8907171", "comment": "Malware payload", "value": "9679d1e57ebf2b896ae06d4db9448c72e0d461e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082935, "uuid": "68912142-f715-418d-9681-dd954004e466", "comment": "Malware payload", "value": "53d09d15b9905d24a1cd25c97b4148c7bc66a0acc867c8c2ac8568cc4058adeafbd6610462957f889e3419e3ad738aff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082935, "uuid": "74ebb149-0bb5-4e23-a4db-7181a002062b", "value": "T1E2E55D4A7A015C5EDEDD21F2B392591CAF00C4372F0DF19A1B9663CAEF8CAE7544E186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082935, "uuid": "c62561c0-6aea-4ff8-928a-4794d033ad41", "value": "49152:j4xf1SUAM/QYAN/bzWww3TZ1tV8oVkTyW8FJ4hd:Cf1tLQ9m3THj8oVkynwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698082935, "uuid": "dd87acd7-8b90-43cc-9f03-e3e8b163a194", "value": 3241472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698082935, "uuid": "d715a340-5309-4539-9a32-f11f466350e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082935, "uuid": "511c2829-f2df-451b-8d33-4e6b6b9b95ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98b0741-7161-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1698037530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037530, "uuid": "debb3633-3491-4b1f-868d-54ae904c8b6a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "69f0e28bec8c54582193e0fcba98eb02", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037530, "uuid": "78472e41-71b7-4c95-8549-02419e1b450c", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "27868072354dafeb97a7482abbd9ac8f31ef22ae8e2ed448ec36f602d822d54b", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037530, "uuid": "6c9da127-15c9-4fb9-ab0d-45fb7d8c7d3f", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "d3b5429e2e893d5d396b34850db6837478d9e3d3", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037530, "uuid": "3c6ef70e-61b9-462e-a9c2-4a94f96b1d07", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "f2c043dd11ca347c6742be452fcc0602e9e44f650dd9f71fcc4bb77adb0fceaf46608d8500dccf852a39eaa4145a7de9", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037530, "uuid": "083822e9-d132-4b65-b0e9-894f0207ab33", "value": "T1617523A2D7FC0056D96067B168FA03C316357EE71C78D2172345DD4E0AB1298FA72BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037530, "uuid": "531552a7-4971-464c-a440-a3ffc214631c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037530, "uuid": "406b08b1-d65c-46f6-9fb1-5ff7f835276a", "value": "24576:ny/pd+b6pubFWxEwxa863VmXVCzFmyXOl7WLrnmr0ZdRfsJ1nK5YzkRY:yhQXQCyD1CBJXOl8nkMUnK5YzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698037530, "uuid": "b3f5f981-b740-49cd-bbe6-09884ab6f882", "value": 1591808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698037530, "uuid": "1f8a7373-7a44-49c4-9d92-287df9a77ac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037530, "uuid": "f5133b85-73b5-41f0-a9db-3cea3de3b5a2", "value": "69f0e28bec8c54582193e0fcba98eb02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76817b77-71b9-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698075186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075186, "uuid": "6cecf961-22ff-44b9-bd5a-0571c1535e35", "comment": "Malware payload (GuLoader)", "value": "fbe0ed03d85eeb8d4d18110e0c9baf94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075186, "uuid": "2cf3d9d5-231b-4cc8-9655-5b4927a675ea", "comment": "Malware payload (GuLoader)", "value": "28641ebd6bbdf83f407430885d6f1eba9a4f9cc23fd1f0b941835bb911d98b6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075186, "uuid": "d633ba2a-bff1-4197-b927-7ec79bfa3f15", "comment": "Malware payload (GuLoader)", "value": "8b8b2ce3576688ab751f654cecf84e6c7ec329e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075186, "uuid": "2b79529d-da2f-4e97-a9f1-c42a3059dd83", "comment": "Malware payload (GuLoader)", "value": "30b41501e55992fb6fc04f9a7bdb0a8079ee500c08c668b633ba8290f804dfd9d6995ca4c04d6acf2fb3ec486177807e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075186, "uuid": "9297c453-c770-40e3-98db-35ad7628922e", "value": "T12235336247CFDA23D66B6336193A4AC469D7BF890C8C833BB6690D6DB4717428F1C352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075186, "uuid": "c2a647ca-94da-4acf-aba7-d2097060ae56", "value": "7192d3773f389d45ebac3cc67d054a8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075186, "uuid": "80c32cb9-6bed-4d9c-bb3b-481ef50db507", "value": "24576:gsdpWoBmlSBK5PGmptFpsa9JYf4SZbAOhURWImqo9T1Qn:90o4lS053dsuJw4SKOhUCqOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698075186, "uuid": "8cbd7bc4-f01a-41a3-849e-dfe5c6e9997a", "value": 1065160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698075186, "uuid": "a762279d-1f3f-4cae-a3e1-04a1355a4844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075186, "uuid": "60606fdd-a2ed-4200-8aab-cbe7b7fdf65a", "value": "SecuriteInfo.com.W32.Trojan.SLJK-2619.17130.29308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64d9136-7177-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698047054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047054, "uuid": "63bcce64-6165-4ed6-9bdc-42114c59ff31", "comment": "Malware payload (AgentTesla)", "value": "ccdcffb7594aa0bd637bb23c0d26ee28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047054, "uuid": "89ec55c3-0b4e-4cfe-ac08-5c52fdafb1d5", "comment": "Malware payload (AgentTesla)", "value": "28a46a9953f0b0771ec1bf9527cd35fbefd82119f2f7349faed0e5cbec61abc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047054, "uuid": "b46deebb-abd0-4ff2-9eb6-497dd5b8d29b", "comment": "Malware payload (AgentTesla)", "value": "8cdab5bbdc8e6fd236ed32cab85299024e4ce768", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047054, "uuid": "d123b98a-771f-4dbb-812f-20058d39aeaf", "comment": "Malware payload (AgentTesla)", "value": "60160a72149294b9bb1d004f3d3c8a5d328015d4dd4476bc7c66742a9c0cec1d12db43f2f3c2980ae4bdaefc3110a5bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047054, "uuid": "53220fed-b22a-4e75-91fc-90172c9c8748", "value": "T177256ED1F15088DAED6B05F1BD2AA53024E3AE9D94A4810C569DBB1B76F3342309FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047054, "uuid": "32833292-9bac-4e50-82db-0f7b0fc62a87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047054, "uuid": "fa88f946-9b3f-42e1-9cee-5add3d2785ea", "value": "24576:SgkZR5kmtS72PEaleDqu2wfily95OfyQwD/3Q:StZsmtA2yDlhigLOfnwD/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047054, "uuid": "dd2aac01-08e4-421c-9884-2b5025013f8c", "value": 995328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047054, "uuid": "70b049d9-6b41-415d-b031-24fbbd23f617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047054, "uuid": "c40b8ca4-7fec-4561-9abe-50b5f2c673c6", "value": "IPVXj0ugC9g3EIn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d604a9a1-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042705, "uuid": "b4a524e2-e2a6-4985-94ff-d2a59ad61aa5", "comment": "Malware payload", "value": "c8fb3db47a00352356a6c53008a81cbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042705, "uuid": "c3392c91-be31-4fa5-be8e-b8ef9a053551", "comment": "Malware payload", "value": "28a8b5bee0a75625f7b1d650e058c9b327a4b7f90a934ce29e6c3ae954ce0c47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042705, "uuid": "b77d2451-562a-42ef-9d25-4162bb42d9c7", "comment": "Malware payload", "value": "badc6a6171fbc3abda73458b69d41153e52c49e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042705, "uuid": "e1715cec-e9c1-4a06-835f-21c0709228bb", "comment": "Malware payload", "value": "9f660410570cdeb29fbf60e169b6193c75125a6de5f291595f45942d75a6454894dd3004df8ee5a39c9d1eb6c2a92e46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042705, "uuid": "b63337e8-85f3-42e0-a3e5-7c23a5661477", "value": "T109557C72D688340BFC67AE3E652F4765183AEE5317D668CBAEF81C6C7F365443220189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042705, "uuid": "c78008c5-4345-4afb-a7a2-10f13cb03844", "value": "12288:G9zO2BaUY8IP400oGc8MJ0o0ObM2wRBUShXM8YAey:gbB40oGC02eBUShXM8Y/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042705, "uuid": "dc5f5242-67f1-401d-9035-5ec0198ade94", "value": 1302528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042705, "uuid": "fb54e4b6-dcce-4217-b18e-a6f00170435c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042705, "uuid": "6b18afe2-f553-4a0c-94fb-0acff61f0e5f", "value": "SecuriteInfo.com.Win32.Delf-THP.27157.25534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30726c3-7186-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698053491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053491, "uuid": "113dadb2-7011-4e43-b65a-a7f7ff31f8e9", "comment": "Malware payload (AgentTesla)", "value": "6d81b641d5b9949bf6d8abe6fa048d91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053491, "uuid": "5cf195c1-9777-4e7f-807b-f4e6166c1273", "comment": "Malware payload (AgentTesla)", "value": "295bd870f4cf2316f4e2af5eeed91c906abb7612125b08dce062c811d226765a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053491, "uuid": "5fb8ba0e-ad29-49f9-a40b-35a0eebf79ad", "comment": "Malware payload (AgentTesla)", "value": "72f4d10c920cebecca2612a400b0586fe0418b5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053491, "uuid": "1f30dc6f-0e93-439e-a583-acdaeff9edd2", "comment": "Malware payload (AgentTesla)", "value": "a7b769cd4a4bbd958d984d5ddbacfe4707fba01f81773f103d49a26faafcee35a43318373e3dd2e0e138ac03cad8534d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053491, "uuid": "883f44c1-9b87-4f74-8118-7a2f3c8ed31e", "value": "T19055012033988B66E13D8BBB15B4020213F5B527357AD3ACAFDA24CB5F61F418565BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053491, "uuid": "8e883d44-6850-4168-a565-67bd73b090f9", "value": "12288:ZSX9K7R4SMvuvTXQNTaK3w4EZwtyB9U9yZoBszL:ZStoRmEDQNTRwZwQPU9Yo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698053491, "uuid": "be0a2a09-d36f-4eb1-9dbf-f3739223d8d6", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698053491, "uuid": "0b4b2863-ab34-4779-8a63-8709a24523cd", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053491, "uuid": "22165a85-d216-4bbb-8801-15e213556908", "value": "PURCHASE ORDER-430.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8626e4f3-71cf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698084661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084661, "uuid": "1db83e16-5af2-43fe-9f3b-341d2ee683c5", "comment": "Malware payload", "value": "c706c67bd59055a4144b4ba057f24a4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084661, "uuid": "782a8f5e-24a0-4655-980d-ca91a7a49aa5", "comment": "Malware payload", "value": "295daf4708da6e3b7613e4ea7637739054656332c3dfdfb0499431ef267e6a39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084661, "uuid": "fc2c23ac-1725-4dd8-ad0a-82f6224bc700", "comment": "Malware payload", "value": "cede73afaac1f3bb56d43b838e53cc462127bd11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084661, "uuid": "56813a1c-4e04-4f01-929e-ae8f1945399a", "comment": "Malware payload", "value": "9889e895863435d3e26250fbb8901908a14b20de246598f3c52dbb80d6769c21e7c22c7950be75bf0bbd711e3298198d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084661, "uuid": "2a811f4e-d4d2-4264-8757-f7455851aeba", "value": "T180C62239E5612C4BF9B54EAE9AD9B283CC6174A14F4EC6DC49721EDD02131F193F8AC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084661, "uuid": "08e5ec3c-b559-4e7c-b265-ea9ee0734df3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084661, "uuid": "740dea8b-f204-499f-a5df-2a1f649449a0", "value": "196608:TmFG0u2Iqo5ygREzKuW24oVSn9kUHgIyyH9bhAWYJxID0fbNW:TmFGfqIgHSWUHbHROWYJxjfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698084661, "uuid": "f81b9c21-c933-4245-8ed0-badbbf1d8521", "value": 12210176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698084661, "uuid": "2133196c-9ee3-4b07-bf3d-e24e4fcd2d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084661, "uuid": "3644ad7e-6bb2-4ce2-9140-8427277f1ba5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7773d6-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042719, "uuid": "a7847dbf-6fc7-4332-8097-ff8c36943bed", "comment": "Malware payload", "value": "a58cab6f058a07fb22b80a2b7f12ddec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042719, "uuid": "4e2cf6b1-f20b-466c-98cd-5968149231d2", "comment": "Malware payload", "value": "2983a1666533a5e40ba488761be21de846997537911e1c7394036ca9158dbdbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042719, "uuid": "a3d302b2-9b86-41fb-b538-a91ef5e7ece3", "comment": "Malware payload", "value": "8532c83eab34992cdce66617e06be3171dfc331e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042719, "uuid": "c3aa0bd4-efbd-421d-bf7e-b9efa402eb70", "comment": "Malware payload", "value": "04fca3b4b6822a606658b15a3c21f5da03ebd80ad68e9debf29de68fbf4a7747aa03e850f8e5c8863b5a926d814c1285", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042719, "uuid": "a5efb0fa-6d1a-4def-a8e1-e98e218fdb19", "value": "T127457C72D688340BFC67AE3E652F4765183AEE5317D668CBAEF81C6C7F365443220189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042719, "uuid": "42cc7e65-2513-4b84-bc58-2a5b4e765631", "value": "12288:t9zO2BaUY8IP400oGc8MJ0o0ObM2wRBUShXM8YA72:TbB40oGC02eBUShXM8Y2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042719, "uuid": "08e25efa-bab2-4a1f-8219-1a790d25bca7", "value": 1261568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042719, "uuid": "8b719c7c-aa24-44c6-bc94-6a186e625ab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042719, "uuid": "b743ff61-c781-45cc-a780-1b87560d125e", "value": "SecuriteInfo.com.Win32.Delf-THP.6239.30412", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0dabc9-718c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698055843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055843, "uuid": "d3893933-1ba6-4ba3-96e8-21d738897a8d", "comment": "Malware payload", "value": "99aa03be2ddbeb69a38aaaf9b39bc2c7", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055843, "uuid": "1e722bcf-95d7-4cda-8373-7e8be82a74d5", "comment": "Malware payload", "value": "29a9f4931a1f5b2dd373fa79404361e2f4a3de65967d39277af19c3f58367974", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055843, "uuid": "3466abb6-9209-4c11-bcc8-84431b030fc5", "comment": "Malware payload", "value": "dd4674d32804a958047d9832701d37ef7e3420bb", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055843, "uuid": "13b156f4-7a63-4aa2-b0fa-19e8538ca1e5", "comment": "Malware payload", "value": "1d9c319af116ffd4bdd304ad68d24d0193f4db2e5db1bde87d973bac8d8919bafb9e57d3c989d9f608e8ad8dbf836b81", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055843, "uuid": "c0db40ae-55d9-46ef-bc2c-f5c0b3e258dc", "value": "T1BFA312510FC9B5317CF4FB0A62E2E12E09B0C0B14A67A5F675189854BD34E8FA887DA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055843, "uuid": "0e46788b-e520-4c50-8292-9b0dd214fc05", "value": "3072:E3F7pfRh1MTyj6KLVwVRleXMG2cRy9zOgS:E3F79Bmy1L38G3ytLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698055843, "uuid": "bc93f773-f32d-4759-b64a-0a92b55a0e6d", "value": 103116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698055843, "uuid": "5d76d695-f1fb-4e43-a9ef-13573bd81606", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055843, "uuid": "217c8679-3f31-4663-87b8-69edf5d88c69", "value": "shipping document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6d9a77-719d-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1698063086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063086, "uuid": "f525eab0-6bb5-471b-a683-6e1b7617acff", "comment": "Malware payload (LummaStealer)", "value": "f281b31a99932f0d6c1fa3dd0649a36a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063086, "uuid": "5bcd80ef-7b56-4f7e-afc1-c91670106b92", "comment": "Malware payload (LummaStealer)", "value": "29d9f955b553825fb23351f9daa7d4d0647153073e0d1465f24e674d6378ba06", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063086, "uuid": "605c3b0e-b700-42dc-b255-881a2b25c2d1", "comment": "Malware payload (LummaStealer)", "value": "b89921e26f84dda3c2f52f568824b972be369a0c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063086, "uuid": "7f1cabab-1e13-42e9-b246-bab76df01af3", "comment": "Malware payload (LummaStealer)", "value": "5eaab5f88459377cb058c6ffe1ca3d19b5958a07aa7c4da83cf878a316ade721a6e914228915caca545e8b2d920c56f6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063086, "uuid": "53c388da-fa86-4bd2-9b99-20dbfe99ec17", "value": "T11755CF15B76440B2E1779238C9678646E7B2B8460B7197DF13E497BE1F337D08A3A322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063086, "uuid": "d429a513-bd16-46da-9543-edaf7ad7bd81", "value": "e59505c79d4688c593036694a0abccfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063086, "uuid": "d7f073e2-3c27-4481-856b-3a386df993e6", "value": "24576:t2dY5PVbHkHp3o6IoiEb7orLa9aCAQgaHEddMVmzut7BTF77l//ugU:dPVIo6iE/8LaoCAQgaHUMVmzutdRHNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698063086, "uuid": "bbfbcb1c-2d56-44c7-8faa-02adb7c10ab2", "value": 1408512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698063086, "uuid": "d54a1956-6cd8-41ee-a010-74ff70a58bc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063086, "uuid": "a2e52f5c-e86b-417e-ba45-19ebed050c87", "value": "f281b31a99932f0d6c1fa3dd0649a36a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52559e61-71fc-11ee-8907-42010a9c0042", "comment": "Malware payload (TeamBot)", "timestamp": 1698103902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103902, "uuid": "09a66007-6b90-44c6-b49a-d7433931d734", "comment": "Malware payload (TeamBot)", "value": "8b8b2213065161c5a0998bf86c78cba5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103902, "uuid": "e080c1fe-8fa5-44d6-9899-74f98d65a4b6", "comment": "Malware payload (TeamBot)", "value": "2aa1983e8bebb5c132a6c844c690b9c2fce8c6a3a3022983984c96192e541f81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103902, "uuid": "a5f3dcb5-cf39-44a0-bb23-209e560e61c2", "comment": "Malware payload (TeamBot)", "value": "5ff63cb2ec372189e1074635f74c834dd08957ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103902, "uuid": "410a28e5-9a9e-409b-b66f-01efc4b5ca1a", "comment": "Malware payload (TeamBot)", "value": "f521a3217093abf7bf54836dfa5667d7600a30cfd66bc3f122136c07ddd33bbf8b962e3eb68a12a06769ac5008d7b92b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103902, "uuid": "383119ed-60f6-481a-a7cd-35cbee0f6460", "value": "T1E8449E13B692ECE8E91645718D2DD6E47A2EB870AE19EF5733187F2F1870162D263313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103902, "uuid": "6b119bb5-b3f3-4a75-b416-e68d24c95348", "value": "a068146a0be0aaa89f57a8b52abbacb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103902, "uuid": "f9508744-4316-4bfb-adbc-82c2479eb2b7", "value": "6144:CRUF6obHLhniruNSgkJmmFzr9xxncWWoB:CtobHdniCSgkJVFznH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698103902, "uuid": "248b526b-a71e-407d-9db4-fba29c0a4c2f", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698103902, "uuid": "41f15e34-340f-44d7-95e6-224e0f3e1659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103902, "uuid": "f7986dc0-e3cb-4bed-8493-a6af3c32a8ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3982fbc6-718e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698056615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056615, "uuid": "1a7479f7-f5c4-4ca0-99dc-20a6ee06974d", "comment": "Malware payload (AgentTesla)", "value": "b8879cb1d93833ecbd323388299e1020", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056615, "uuid": "c1434418-cbf3-496b-93f9-71a05b84ee6f", "comment": "Malware payload (AgentTesla)", "value": "2b740ef55ed31627baea39dd67f586a025763ce973415b30d71d2990e4d7fa6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056615, "uuid": "743449f9-3fd0-4f1a-b9ef-13cb1e33a178", "comment": "Malware payload (AgentTesla)", "value": "56e1d2c29e90086474e3f7186af50a85ec5d96c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056615, "uuid": "9d140852-5b90-4ba2-aeb9-6a7d8356c6fb", "comment": "Malware payload (AgentTesla)", "value": "a7a31ab69204f1b76a6d5c092d3259cafb172debe35b9915fdcb51dd3a6533091ed27a792dc89d0e53ffe3ae3d7205d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056615, "uuid": "b746772d-1192-4355-b1dc-01dde5901275", "value": "T155337CA1EA94061A1C4B27C9DCC20991C1FEC41905371565FFEE13EDA20B69CE3BEF1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056615, "uuid": "e5a448eb-082f-4dfa-87b1-e9f0ddb0a704", "value": "768:TV4vfJoGiysuD1F4Wbb+7YrOpexLpmUIUiAp2s40+J38WMMtENKaC3t6AiFj0:54uXu34ib+7YrOpmpbN2kKttaBFj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698056615, "uuid": "c90404a8-79dd-424d-9489-fa6ce2576df3", "value": 53189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698056615, "uuid": "290adac8-134c-4f69-8d9c-9d74131211b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056615, "uuid": "e694638f-4555-429c-ba4c-960b3e724b74", "value": "pligtig.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55aef4e-7195-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698059803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059803, "uuid": "960601e9-cde8-4d1a-8ba2-2fc65ed43de0", "comment": "Malware payload (Smoke Loader)", "value": "b6a3f85daee863668128bd0620df2a82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059803, "uuid": "914870e6-8d93-4742-b2ed-63db96e2c749", "comment": "Malware payload (Smoke Loader)", "value": "2bfb6ad66127b43c3dd5ca8a74e70f7f683d11bb68c74ddaa7968f306f2520ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059803, "uuid": "da4e7cfb-bf22-46ca-889f-11d16a3215a1", "comment": "Malware payload (Smoke Loader)", "value": "dfecf354e1ee8aaa21bf69d49b82df2d43e4c80f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059803, "uuid": "0a42e0aa-b442-4137-8f4e-8a794f79280e", "comment": "Malware payload (Smoke Loader)", "value": "20cb07b191585417b14e3526aa159bb15b3bfb2ae79cbd239220a1e715f89e2ed37084b7bf41a35a0b7ecfb3ac244daa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059803, "uuid": "c55711f9-ca2b-4165-91eb-9ca551e62f5f", "value": "T123752323A1D5D186DEF017B9A4FB01C32A3D3EB6ACB543572756D9861C22288EC3535F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059803, "uuid": "4e0c7490-81e5-409b-a012-c7a21d039416", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059803, "uuid": "38cc9ce0-dc15-4f8e-8499-4f67ff8c4322", "value": "49152:w4VskWd72nvTymu3fffsy2F1K9gUXR8l:c/iTymufM51KKUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698059803, "uuid": "c1105d37-0529-4c60-bb44-949fdc263181", "value": 1591296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698059803, "uuid": "22ed5876-4a94-4002-b899-70d28553fcb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059803, "uuid": "6c88f340-81d4-4798-aa0d-d7d28de5f3fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a3ab58-7185-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698052846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052846, "uuid": "65382a25-11e3-4840-a0b4-746ba5013531", "comment": "Malware payload (Smoke Loader)", "value": "5144b07d4a68c241862de3884e9ce5e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052846, "uuid": "4644d9e2-ca77-484a-a07d-6d4b81a31464", "comment": "Malware payload (Smoke Loader)", "value": "2c25c9d61e444825c5230c19b4be69fbc0a2aa30dda619c9c3d36d275fdcd0d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052846, "uuid": "3858e122-bad1-41a6-8355-c1d99c863851", "comment": "Malware payload (Smoke Loader)", "value": "b9dcd05bfa033ff63986d689f9927ee5f440c213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052846, "uuid": "a7f10774-4ab0-419f-8851-43f079698a7e", "comment": "Malware payload (Smoke Loader)", "value": "2442c701eeeaa8fc1c4bd1c6018addac1ee55c148cdd4640d3672c429800d8ba17561fa7554f96a04dc0fa4dd1687302", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052846, "uuid": "5de0183a-d410-4876-bf16-b25315fd95ba", "value": "T11C752352E2F84426CAB023B0CCF641A39B7A3AF29D74874731959A4D1EB23E87471777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052846, "uuid": "0424528e-1b96-4f65-a55c-7173ffbf20a7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052846, "uuid": "a9504772-15ca-46d9-ab62-eed605357b7a", "value": "24576:eyydAwnXniOtMEugau/E9BJM7X4nq97LGA14y/0gIblqTeC:tydzXiuvhdTUCnd4yGqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698052846, "uuid": "de1bc397-2b98-4f87-b3f6-06b31e9002ce", "value": 1591296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698052846, "uuid": "ca033c53-5142-42a8-9f33-dc8f8e28a696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052846, "uuid": "b097fd2b-4d54-4095-a71f-aec59677be46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fa0fe4-71fb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698103557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103557, "uuid": "144d6f22-e3cb-4070-a179-014fb7c0b999", "comment": "Malware payload", "value": "162707d5bcc56a7f020e620955a55bb6", "object_relation": "md5", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103557, "uuid": "55f7d44b-d8e3-4df6-a658-53773613549b", "comment": "Malware payload", "value": "2c9e5242ad438425d891ee73f864c12738c4a9570fa2e8e64143f9a4d1dac27f", "object_relation": "sha256", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103557, "uuid": "eded820d-6b1c-4816-86b5-d9d863a3d829", "comment": "Malware payload", "value": "2449588323d40ac2e2741a75a4881ff90486bae1", "object_relation": "sha1", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103557, "uuid": "258b3a61-a884-49ca-8028-1a316270120c", "comment": "Malware payload", "value": "c29c1f1e0021ab7735d881641d9b311ca4d6669633f3479d7b0594e0f579f0529660a374e47087be678fe2f9847ab92c", "object_relation": "sha3-384", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103557, "uuid": "a2d498eb-3f38-4e9f-bcf5-7e0082e53237", "value": "T1B9C2E1A628880436E56F85C4C08D1A810E62AF69EC69C343E875EF3DAC1FED75CF54D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103557, "uuid": "83491b5f-dfa3-4c51-9533-9a6477f45fd2", "value": "768:dpeqQSBw6swy1uBDBH8jfvRD9fhn6UOpKI28W9zoOz8osB:dzQL11c4xp5SKI2NapfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698103557, "uuid": "a593ad7a-d972-4f6e-b4a3-1961510603f5", "value": 28219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698103557, "uuid": "9d4a232b-b5ad-413d-9dd2-113a9eb2af2e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103557, "uuid": "b84ea663-3048-42ac-b8ad-f4da4d23cf8e", "value": "nDELIVERY INFORMATION.pdf.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11152aa-71cb-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1698083123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083123, "uuid": "dc6ee644-5a9a-4e61-9123-a1a0d5d5faa0", "comment": "Malware payload (LummaStealer)", "value": "5faa929c92044470b22fbada30affb6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083123, "uuid": "6c9f4cea-41a9-4712-8775-d37a2cde2053", "comment": "Malware payload (LummaStealer)", "value": "2d0ba78ec0d25b6a4dfd89cb22e35570fb12b8dc10465fe88d752c31b98b0767", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083123, "uuid": "4c435c17-d3d8-48fa-b596-21d080c3b712", "comment": "Malware payload (LummaStealer)", "value": "5d120373c61ceebe6ded0b97744b770035f0f3c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083123, "uuid": "6b6ced02-1a24-47a1-a7c5-29814129b66f", "comment": "Malware payload (LummaStealer)", "value": "2a57027d6fd3444e499a2ad5be2f11a3a56cceb4346bd91f20ca24b3862f8ad65c5e12dfae52fc6d58a1a1eec0711f85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083123, "uuid": "5a4dc9a5-bacf-44a5-842c-2d0f47d783ce", "value": "T1C285FA1176F95B59F9F30FB85ABAA611487AFC6ACF11C2DF1250908E0D21BD09970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083123, "uuid": "bbe1f3f9-d3e4-4059-b8b2-286961aa496f", "value": "a23cbfa58d4baffb298f8e637aac34ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083123, "uuid": "057267d6-e3ad-4efb-b652-63c1cb398266", "value": "12288:ZJRkiMAfS5S8a1TxC5289nE+LIqHC67cQuzzd9X6a9Dhvhh1UUIY:ZYAfS5S8a1TSTE+1x46a9Dhvh7UUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698083123, "uuid": "721530eb-9f07-4fd1-8f90-5aec2fbe3f5d", "value": 1724928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698083123, "uuid": "4c07d41c-c837-44be-826b-1bfb5f2a7dff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083123, "uuid": "26a7ef07-478e-48f9-bd1e-ecab5d1f11b9", "value": "5faa929c92044470b22fbada30affb6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05bf9a5b-7179-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698047509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047509, "uuid": "87fa7b09-83ae-467a-aa01-738b988d0dd8", "comment": "Malware payload (SnakeKeylogger)", "value": "4cbadf2f02b55b681ad8179318125627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047509, "uuid": "217e0253-f03d-441a-91d9-e9fb4bcdca40", "comment": "Malware payload (SnakeKeylogger)", "value": "2e070bf82e1dc22ca1b3612faaaed7688cf8041b14cb1be60b953e25d7ef1919", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047509, "uuid": "2d041a01-c2cb-4bc2-a4e2-0d46a52430d8", "comment": "Malware payload (SnakeKeylogger)", "value": "b7fcd5e0ec5b5ca2138c5243e0a2b96cbb3ce343", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047509, "uuid": "c3d5272b-3a29-4881-b4e1-8c844aac6d35", "comment": "Malware payload (SnakeKeylogger)", "value": "2008578d6592227e14fc96c93d32ade2a0834f3901c6d26d0c7ce1c069f0d0561716fda5d32a5cbcca993e5c55cbb1c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047509, "uuid": "0880685d-8a1a-4792-a551-cb5f3b9f0595", "value": "T1DA257C3D1DF98227B978D6A2DFA0C432B061D6EFF5629D29D4D746818702A03B4C71BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047509, "uuid": "7e2eb2e5-8597-40d6-84be-fb04d0488871", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047509, "uuid": "bebb64ac-2135-4b53-abb5-4baa02d156f8", "value": "12288:9yQaMFM0Mvxv9QtXV74LFpMQJfmJFGH/dqsBCSsoik88FXNnp:9yjv9e9SF7lmsFqHoikJXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047509, "uuid": "742c0900-5f22-4ca4-b360-80abfba8e9a8", "value": 971776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047509, "uuid": "e7c32c4d-6fb5-4dc1-a194-d010eda59065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047509, "uuid": "c104ba43-610a-40db-92d4-26e59f26bd2e", "value": "Revised Invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd410f7a-71d7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698088297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698088297, "uuid": "486cfee6-fd76-435b-baf5-2d5dd1a17964", "comment": "Malware payload", "value": "8e2939bd8f15531cd60167ac8a7c5f09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698088297, "uuid": "d0f70687-f673-43d7-8ed2-1017d96e848e", "comment": "Malware payload", "value": "2e449c02287482cf92c13e2097bde3e92fe078c2394331af783ded1c59648f93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698088297, "uuid": "2345028d-79ca-449e-80de-dce388d4064d", "comment": "Malware payload", "value": "08ff48221c0051cf11faed83b775aa9fddebbfb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698088297, "uuid": "388c3def-013f-48e8-957c-d0585b356997", "comment": "Malware payload", "value": "f341a17b91ba95f20d293a842e13f367c14942815a50c4aafc9b02e0716cf02c7a785eedebba40177c165a2850357eff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698088297, "uuid": "8e405607-0413-406b-b0ba-99fc1ef57a67", "value": "T129E4231A26F54BBEC479ABF57C416E0B27B0F45E3D07F3480F9220CA9D15F128A45AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698088297, "uuid": "a4427af3-d339-42ab-9e3b-9b5896f86072", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698088297, "uuid": "60c3647a-5447-45fb-8b54-c8dd8299f065", "value": "12288:OhNh6sxTA6qNhQZv5Kr2pPjzXYqqZq5Ugmv9mroRFxEIPw0I4FdegwJh:ODDxs6gssojzXYq/roRFxTQ4Fd2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698088297, "uuid": "ace960fa-0c98-41b4-8467-890914d98d9a", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698088297, "uuid": "1df583f1-d152-441a-ba12-7e5b21159be0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698088297, "uuid": "dec739d9-0b58-437d-abf0-ca15fea3c2fe", "value": "http___107.172.31.18_580_audiodgse.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd729a3-7177-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698046930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046930, "uuid": "2f0293b8-9d27-43b5-8757-49df067541ca", "comment": "Malware payload (Formbook)", "value": "fa5a65a6860ec9a4b3e8037085db1789", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046930, "uuid": "05fe81ed-a91c-4057-b9fd-3b1d28c033c0", "comment": "Malware payload (Formbook)", "value": "2e81a792e3a548b421c04e70684881888c7c97fa1ef74dfc5d297b4f46e24517", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046930, "uuid": "e956a8ea-96fd-4c4b-b895-b7d59f4f3804", "comment": "Malware payload (Formbook)", "value": "13b05d69fe79c7a7e0d6f96036abb5df69954bc1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046930, "uuid": "71ccf57f-d1d2-4907-9ba4-f1ed9aee9d49", "comment": "Malware payload (Formbook)", "value": "088fe1a71aede7c26a0fcbe12beee98df4d43dc5916b1e32a423752e51666147b2fc253b00081a413d63c4a7536a427c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046930, "uuid": "4623fc3f-95c9-4751-83ca-b9dac69f6fa4", "value": "T165B3672DD38F02A98F5223369B1B0E9441BDBA6EF38552B1346C837533EEC39512627D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046930, "uuid": "5937838d-51d9-4acc-bc22-b691a6ab2546", "value": "768:3wAbZSibMX9gRWjXd8+O6I146eotzcDK00xvF3/rhuTMg1Ga:3wAlRK8+zI1461qDKlxvFSMVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698046930, "uuid": "38c2003b-bea0-46f2-83ac-29b647d073f7", "value": 116333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698046930, "uuid": "e12ad3ca-57f4-4c0e-8689-365fcb2ea044", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046930, "uuid": "e1a84a3e-14ff-4bc1-a3a5-547bbdcae334", "value": "AWB #191023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ebbcd1f-71cf-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698084622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084622, "uuid": "a3f93a12-8985-4c71-8c02-5183f81771b3", "comment": "Malware payload (Formbook)", "value": "dc1967c4e2c8b75e8ad21a52ddb5fecc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084622, "uuid": "ede726b8-0318-4ae6-b5e8-55307072d2ef", "comment": "Malware payload (Formbook)", "value": "2ecf378d6ddd2fd422f68a3a66a7d0e9ab707d898ca605777257f2818e62c4c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084622, "uuid": "b77c96bb-80b7-4dd8-b048-753c6f2b85c7", "comment": "Malware payload (Formbook)", "value": "464f55683bc0713ce45c2982218708fed7b63931", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084622, "uuid": "b4900bd9-bf0d-4ce7-b23e-af343e9b9484", "comment": "Malware payload (Formbook)", "value": "b64985c3c21e16b9e9778118fa47a25ffe8a073ec3e9a483158daf395cdad1316bc5b19e74b121f07ea449a1a7700dac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084622, "uuid": "6b72c4f5-5368-493d-be7e-374112e96e31", "value": "T17685FA1176F95B59F9F30FB85ABAA611487AFC6ACF11C2DF1250908E0D21BD09970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084622, "uuid": "f6608f77-66fc-4f06-878c-6ec37d71f764", "value": "a23cbfa58d4baffb298f8e637aac34ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084622, "uuid": "5ef9f73a-021f-41ed-9220-86d2783c8ae8", "value": "12288:jTh7jMAfS5S8a1TxCZG09fEGjQSHC6bELuzzc9X6a9DhvhhujHIRsI2:jKAfS5S8a1TyzEGdxE6a9DhvhU0aI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698084622, "uuid": "b32fb158-e928-479a-ade9-6d954d13902c", "value": 1724928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698084622, "uuid": "55c30cf4-4ff5-48a1-a0bc-6c453652eae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084622, "uuid": "1a342ee4-595e-4edc-8b24-ab7f0ea89ce8", "value": "dc1967c4e2c8b75e8ad21a52ddb5fecc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6729f9d-7178-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698047349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047349, "uuid": "c7dcbe0d-6dcb-4592-944e-43ae2ac12fb7", "comment": "Malware payload", "value": "61795d1f7a399fd0ef2a6a2f6b2d60ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047349, "uuid": "aac8a69c-7ab4-403e-9f32-f0656a1a5c44", "comment": "Malware payload", "value": "2ff331f4ff3b17c8b13ee68cedd84597c0c279fb4d65dc5677797fbbb52bad20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047349, "uuid": "27c9407c-e63a-4613-bc93-c5e665ea6c73", "comment": "Malware payload", "value": "f1f13dde66084f689179994118075ee7a73492ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047349, "uuid": "6a91ab02-08c0-4ca4-a463-8e5b0c0c39fe", "comment": "Malware payload", "value": "5f637aabc560ec39b0f9b80266f8a2719ea9a8467fd2cd80d05b8892a179f7b4d3026d6180b6e7d9723eee32dfc41f1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047349, "uuid": "f8688034-2545-4fa3-9191-f56e7eb831bf", "value": "T16963590CA38CE912C65C1D7E94E2902143FDE1772602F35B5EC996A96D437E14A2AFF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047349, "uuid": "80b2f43d-82fa-4f77-96aa-dc8165832ae9", "value": "1536:4Uf+7Mj6nekE0+Pj/Ravdn5nxQsX5nWTz8tcvvYl:4UfgMu3D+LWTlpnWXIcXYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047349, "uuid": "f1e45e7b-f33d-485e-b428-e4a028a3604d", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047349, "uuid": "d844c621-e7f3-4efd-9862-ff48d6dccaac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047349, "uuid": "46f25286-6333-4e71-897f-7af5fed0a897", "value": "PurchaseXOrder.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11fdfa1e-7166-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698039369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039369, "uuid": "2936d0e5-8a80-471b-a879-9d902ffea460", "comment": "Malware payload (RedLineStealer)", "value": "7d994f45c9e6a89921a7c83e7bae2c30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039369, "uuid": "ae9357cd-d155-40bd-806b-3812b6e8c217", "comment": "Malware payload (RedLineStealer)", "value": "3149863855e7996faceab6f072aa7f568859fdc81e1ce2838ad465d858eef6ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039369, "uuid": "f633beef-224a-4fbd-902f-5cf357b6ff1d", "comment": "Malware payload (RedLineStealer)", "value": "cf7760f8219c1acdfeed8bd8d53d503347e6aa88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039369, "uuid": "2d38fdee-816d-4702-8440-bca19b4a987f", "comment": "Malware payload (RedLineStealer)", "value": "159e105d409e3747ceaa811ecb9c387bed665c802cd9c648a328f94e2c78fc152de0a8b4f8336227579119dec6cbf5de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039369, "uuid": "f0a632e3-17cd-4891-ae77-0d3d60b5db2c", "value": "T17AB47DAEF5D0F831C077C572C81F6B28D4939A788B0617E77EA1C56D17882E2BA764C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039369, "uuid": "1a081d86-a306-4f16-a1f3-54ffba1d3bce", "value": "d52ccff4f325ce6b295038c3a3f9150f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039369, "uuid": "2a820c62-db9c-491d-a8e3-15af80df4d9b", "value": "12288:2bQMMsXCvpUOXia60C3O5R2sdLu4uBPSL:RsXCdC3O5RnLu4lL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698039369, "uuid": "38595670-628e-4e07-ab37-88d229b0967a", "value": 509512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698039369, "uuid": "9da0ca15-6089-41f4-aa7a-e3c28ca4af08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039369, "uuid": "6373f38d-2e5d-49aa-9325-ebea3c00ae20", "value": "SecuriteInfo.com.Win32.PWSX-gen.26828.24749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e8d7f2-71a2-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698065152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065152, "uuid": "69b64c6a-a94e-4a08-b021-59c9d1ee55d0", "comment": "Malware payload (AgentTesla)", "value": "54d7b299477ca09c7409473e0ebab0db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065152, "uuid": "95bf8373-5486-4e2b-8e05-a82986acd400", "comment": "Malware payload (AgentTesla)", "value": "32362bed1bcda85a394d05cfcbb4cf93292138c1c98e6bedcdcd6a322d33a5ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065152, "uuid": "3123abfb-37a9-4d3d-bb21-b43454d80519", "comment": "Malware payload (AgentTesla)", "value": "4c93e117ed19f9d0edeb3de59d810fed9e0ed8a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065152, "uuid": "0540f350-ee93-4ad1-bb37-0175ebb01783", "comment": "Malware payload (AgentTesla)", "value": "344280a22efdfdd541b3c177c304d55e188919dd639e75748f8cbb9776f6263996ef440f01459c33cf74e733467be10d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065152, "uuid": "b17c8d02-ddd1-4d58-8c0e-33e09bdc9b59", "value": "T1B7D42316BDA6331BA189B0F6391B0D2E46A87C16C21C8186FF3672AAD307DC6D75C316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065152, "uuid": "5b10bf84-e624-4efe-a68a-964e166c5c30", "value": "12288:ORcuSLOwK2MvUDkGOnCMjjppvv5UNwGLEKoJpRX1WQVLolxB:TuSqsM4kVnv/plxkFE9lXEQ1wB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698065152, "uuid": "a2335d65-0f4d-40f3-b2ba-86aa18a263ef", "value": 628142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698065152, "uuid": "4f50cee1-f9b9-4dd3-83a1-5be8c54b3ae5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065152, "uuid": "4a87d54d-e8e3-458e-9766-f68efd430a8b", "value": "overdue invioce.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96be4c9c-71b5-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1698073522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073522, "uuid": "b32c9ed2-90b3-41ee-b783-cb6b18ad3706", "comment": "Malware payload (NanoCore)", "value": "a974ba2381279891bbb4b89e7b81329b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073522, "uuid": "d3e67191-e377-4d41-8def-87773ee907a4", "comment": "Malware payload (NanoCore)", "value": "326a8d2e4bd83f5cfdd1a2750a37d6b2530aea512961130ad3ed1c5b8def518f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073522, "uuid": "5ab1ec6e-f4f5-42f8-835b-bb1187ac2a94", "comment": "Malware payload (NanoCore)", "value": "90405c89e49bc83756e62cd81649951d1e263a4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073522, "uuid": "451af73d-9aec-4e03-a64b-9bb64e4ca014", "comment": "Malware payload (NanoCore)", "value": "33919736c5e86c5e16cfe2771a68a3bf379625080d39634ec23f2b1e218905a8e49b610dd0f43fb2081a352a61b2760f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073522, "uuid": "5cd2d2f6-2237-47f9-8ef4-23d3b49d1d9c", "value": "T18A14CF5637A94A2FE2CE8679612252038379C2E3E8C3F7DF29D454B34B667E44A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073522, "uuid": "eeed7af0-4bee-4bda-999f-82fda9caa3d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073522, "uuid": "c54eeca4-08c9-4780-967d-cdead954001e", "value": "6144:ULV6Bta6dtJmakIM5TS+rzuJj975JWYGc:ULV6Btpmk6S+uV9LWY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698073522, "uuid": "8fe68fb7-0796-4806-93c1-59d12ae31173", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698073522, "uuid": "eaebc03e-3d41-4607-8886-f37f4eb64696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073522, "uuid": "21a339e8-0ddf-4a45-8c2d-4ce3943a5ca5", "value": "a974ba2381279891bbb4b89e7b81329b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8be711-719d-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1698063095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063095, "uuid": "6936620c-6030-4637-b597-cd94d79e282b", "comment": "Malware payload (MysticStealer)", "value": "354aee23414eea4e38d041b45b5cb7ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063095, "uuid": "7b1ae689-26d8-4318-97d9-8540b011c32e", "comment": "Malware payload (MysticStealer)", "value": "32fc4939b1ccdd7f7ea0feecb05df65bb4f677961c2f70f5ed7fe26ff081b7d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063095, "uuid": "b243a2c3-d99e-449f-8f66-bdec92ec40a5", "comment": "Malware payload (MysticStealer)", "value": "0cd8ab83d4cbc7e1ec8968d51507ddd35376badb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063095, "uuid": "b33f3690-a4a2-41b2-894b-47a514e3ace9", "comment": "Malware payload (MysticStealer)", "value": "287c243870705e7a221f37cd3f153310faf43f78405247dfa8b4999053013d0f669ab03bf7fc726f421c051cf2d8dcbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063095, "uuid": "99fb2a76-58b4-43f2-8656-5a2e587d3d39", "value": "T168952C1176F94B59FAF31BB85BBA6611087AFC699F11C3DF1250508E0E31AD0A970B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063095, "uuid": "4b310c6b-0bcb-4ba9-a968-d918b2b83f23", "value": "037522269f8348aa17add864631a3f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063095, "uuid": "c3a4dcc2-07cc-4568-803a-a45a3f66b699", "value": "24576:frYAfSYqe7E9kzd+WNO6a9Dhvh2bakbUI:fxqe7E9DW06a3v6akY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698063095, "uuid": "2458bffc-1934-4004-8f94-a7051502af3b", "value": 1909248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698063095, "uuid": "418c8f93-9c9f-461c-ac6f-66569d9a3bd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063095, "uuid": "5d7c7924-db6b-4d6d-a17e-5cb7619cf20c", "value": "354aee23414eea4e38d041b45b5cb7ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c8b640-7190-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698057762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057762, "uuid": "29ee9df4-3907-4f90-9516-445c0d43d158", "comment": "Malware payload", "value": "3680b099b022508a0ac16a483eb47084", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057762, "uuid": "e5ad8396-41a2-4068-93ef-830ede4d7bae", "comment": "Malware payload", "value": "3408f6e06492ac8b7d1e72329f1eb00b4cd2998f7ae8a07ae2040c2798306e52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057762, "uuid": "38b577bd-e77d-4582-9ac7-bf1f11403a20", "comment": "Malware payload", "value": "901c47acaacacc85d2f0a6cb31b2f97418cf587a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057762, "uuid": "4e317b15-7209-4f84-a0bb-07095d3f250a", "comment": "Malware payload", "value": "15b6000bbbffe11c18d6cbbb9008a613d9b5395d8c29cc19e81a1779e45c66552dab5c4e5d636b83749485ca51f11e60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057762, "uuid": "aad7563c-f741-48c9-b191-8e63f32f3793", "value": "T1A3347386F68452ADCC18A3B07532DE7007167EABE974645E5ADD3E273FB78F20066843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057762, "uuid": "616667ce-ff6a-483a-8412-f671b7150261", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057762, "uuid": "24eaa3e0-76aa-4374-9471-c8c4c1490743", "value": "3072:wtO+t8fPl67SQzNMbu3zbxSY7KZnS/KzJBLY:wtO+Ol67SQzNMbu3zbL7qS/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057762, "uuid": "19ae1053-b53e-41e9-8c78-d3e9e4baba93", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057762, "uuid": "5f2528a0-769a-4d61-b8ff-caceb1cb47d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057762, "uuid": "5567d039-171b-4aae-ba43-c49a21bbf731", "value": "Orden de compra___doc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80e750a-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042708, "uuid": "32b81940-6ed4-4e8f-8f54-5f5fcb44cc19", "comment": "Malware payload", "value": "798efab80ba6bbcc6b99548e023f46f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042708, "uuid": "9e86294a-8cb2-45de-a9d1-e009f91f6f1f", "comment": "Malware payload", "value": "344525d445130d88cbc1eeebd74ea2d94b2664c4d3aa8cd2f09a0e178f7d3909", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042708, "uuid": "e7f3ecd7-27b0-42eb-9344-4833da70b412", "comment": "Malware payload", "value": "7c5a683218228649504d3499cbcf84dd9421d63b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042708, "uuid": "a5ddc7e8-61d0-4034-8187-9f3c4bc71103", "comment": "Malware payload", "value": "f8ae63dfb11ffd08f4bb7332be9ec4e12415d4a1f55e949f2fbefd205c21834baa1a3d617759a605f573c6ad8fbd3c0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042708, "uuid": "29ca47fc-f463-4ed8-bca5-fb436a484605", "value": "T1CE853366ECEB843BD7600D3678953866A7757E0461BEC603B2D8C84E3AB935623513CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042708, "uuid": "d90cc983-d13d-4f8b-b172-fdb4fced4533", "value": "c8524b988a6eed67d46af1d01d295cd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042708, "uuid": "767232c3-dead-42a3-b692-a30f6343e161", "value": "49152:jJ3LIDTWEMNVg0+QRJ/gep7TNECAcqkX02KPxb6P:jJ3ICbNVz+ov3ECPRK5ba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042708, "uuid": "384a8dec-52ca-46ed-9aec-6e8f3408add2", "value": 1814425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042708, "uuid": "90275c95-7aab-467e-a686-70ae2f1ec71b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042708, "uuid": "fa72d0d1-c66b-4e5c-b72e-51aeff709b6a", "value": "SecuriteInfo.com.Trojan.DownLoader.19570.15185.23413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d54238b-7179-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698047737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047737, "uuid": "5581b0b8-cadf-4498-8498-0ffc3a1d5275", "comment": "Malware payload (RemcosRAT)", "value": "a073ed441e89bff0d0534b28f7e441d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047737, "uuid": "d2506092-0dad-47b9-96a4-08ff82367313", "comment": "Malware payload (RemcosRAT)", "value": "355052d38e47eeec50fd9217602b17e0227ad864dbbcc8e8c0f0156b7243addf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047737, "uuid": "2223e8d9-a09b-4cc8-8d7d-dbc3a632136d", "comment": "Malware payload (RemcosRAT)", "value": "0da969f06db5470501edc8c02b383d9f7a287135", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047737, "uuid": "08d681c6-38ad-4808-858a-8ec6f4ef25a8", "comment": "Malware payload (RemcosRAT)", "value": "bb48cd4c2b3ee8602b02b79ea041f5e8b67e0e371bd8573b4565f77ffaf1459753af5192161d040f7d5ec7cf088e90c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047737, "uuid": "7b6816a8-460f-4616-98ac-3ced87d6bf22", "value": "T10253F803F69E40A2C39457BAD5D7008C4775E58AAE13D60AB94E33FA18037FE9DA1627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047737, "uuid": "c0a8201d-90ce-409b-b885-6277ef6497ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047737, "uuid": "c4ba9925-a2bf-48fa-9b69-4622c130d94c", "value": "1536:EUEhQFr4v16jcRyFtMWSCgIeNqSsOvPsRYB:zd4SyZfI3eP0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047737, "uuid": "2082fed1-de2b-46ed-877b-032a98af9ed1", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047737, "uuid": "688f11b6-519c-4224-9cd9-c64b00aad1c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047737, "uuid": "6bedc5e8-b794-4f50-8869-a075d9128ba6", "value": "payment for inv # I-2203300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4fc8caa-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042730, "uuid": "4acfb4a2-ffa7-4115-8714-4583adc5b3c3", "comment": "Malware payload", "value": "47bc7f5ef73ea196a7e90d1139e7c163", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042730, "uuid": "33ec9401-fcfd-4731-a395-2b1519cb46fd", "comment": "Malware payload", "value": "36656c2ec88146f83a9989e254d2ecf07b391d34fd53339e9fd13c4f4a7e63b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042730, "uuid": "e3a4e6c2-a363-4a11-9406-70a0c4767627", "comment": "Malware payload", "value": "68765ebc7cd07f457bcc5080abc37f57c89e35ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042730, "uuid": "7a324946-a35f-4d70-bc1b-187e90ab7c64", "comment": "Malware payload", "value": "f6bc28a272afa1e9c1f43047178c5f0d42a8b46a91e0d978d0a1fe69c9807842fae8ca710a84dd785d5c1d40510b2818", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042730, "uuid": "23c53d1c-22e4-465f-afe7-af44b0161046", "value": "T138E533F371FB4DB0F01D14B57709DCB8D87AB72A1AD87EA605CA8838547810A15DEF8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042730, "uuid": "d76d7356-75fa-4a3e-a285-6c0e47522a2e", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042730, "uuid": "26955059-95b5-4eb1-bb91-1b45f226ab80", "value": "98304:yhh8y39OX2BTB9PDKb1Z0naLzwtIm/uJXQoGbW2g:yhPs2BTBaaaLzwOLJXQoGbW2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042730, "uuid": "2dc92492-0b74-4b72-975b-cbe9cf6d0504", "value": 3166164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042730, "uuid": "1c3b60d8-e69b-41b3-bf3e-243aedeaa67e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042730, "uuid": "2ae66ad2-130f-47ef-8807-2e382e0b1bbf", "value": "SecuriteInfo.com.BScope.TrojanDownloader.Upatre.21009.3419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc87e36c-715e-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698036327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698036327, "uuid": "0959e174-d517-45f2-8b16-ddbb0a07df4c", "comment": "Malware payload (Amadey)", "value": "9e179b6d1c67dfc2345406d9a569423e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698036327, "uuid": "fdf8a557-1767-41ca-b06b-0401e728093a", "comment": "Malware payload (Amadey)", "value": "36821e69f9e1eb270bb017ff106493054dbb9729eac971490243724c39dbc813", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698036327, "uuid": "8bedcef3-2fbc-430e-aa98-8d8132c9cbd0", "comment": "Malware payload (Amadey)", "value": "eed359a0ee5ee5e1780ffad6a17d3e545abed70a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698036327, "uuid": "6edb93c6-2feb-4144-8048-128e00179d72", "comment": "Malware payload (Amadey)", "value": "799a840ef3bd83043cd7fee184ddf40d5d7d02cfe011550feb8c2cd87214922ae7fbbf8a8a43e425f1bf4732d8521cc3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698036327, "uuid": "db6e1438-8df9-4164-91cf-a4daacff4a8a", "value": "T13D7523556BDC0473EAB103B05EFB12431A397CB65934939F1719C96E0C32AC4C4BABAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698036327, "uuid": "6a14f8c5-0b4b-4709-9174-924819165c37", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698036327, "uuid": "3980880b-a1ca-4829-9ea9-50a69b6d3141", "value": "24576:5yxKnTa64zq5TdbExiDg9tb4zEIiPlLSWUXrKC4pdcTfbNHCYb925GLYwXeY:sAaDuS0kwzEnQWU7KC4OfpiYbnLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698036327, "uuid": "8657e787-6dff-4055-9bd7-6ddbfdfc476e", "value": 1592320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698036327, "uuid": "5e640e28-0658-49ce-824f-4027ebc30cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698036327, "uuid": "0b55d6e6-072b-42e3-8c85-aeafa6a0782d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b4eb6b-7180-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698050670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050670, "uuid": "634cecd9-21a6-4b22-8590-6a4b2d07e224", "comment": "Malware payload", "value": "c217491105157dc82c3f6cd0117cee61", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050670, "uuid": "f0390371-7ab2-421e-b093-e63c141a0843", "comment": "Malware payload", "value": "37d9c204b5a67a0503884dfccda73f2d6d347b9bcc0a5834725912603e6abc3d", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050670, "uuid": "af824925-e5c9-4aba-ad47-bee69d1ff529", "comment": "Malware payload", "value": "e315fc96c85a22bc797c77234818e42c9d4b3144", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050670, "uuid": "49241a8b-937c-47c9-b622-bf65933f44f1", "comment": "Malware payload", "value": "447820c99f31babf13bcd30dba2aa613dbe60fac16faa557ac3d2a6331e84b2a833156ac419fb5d6e38dbc3f4dc3661a", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050670, "uuid": "b10ceada-a4f3-48cf-ba64-d76777d15985", "value": "T1A5513B459F247091E19FC3F7B2B94C1E9CAE0F8C2062BEEE9D7E081091CCB65B974654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050670, "uuid": "201c976b-fb85-4f29-95a2-a54702b28647", "value": "48:9nmlSysgf/7Pb7CD16xJWdOCtvN1tlSxBk+7pegDjH:0Qysi7Tm8JW1ILwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698050670, "uuid": "621744ef-9a0a-42c2-be97-a4f5e7561850", "value": 2497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698050670, "uuid": "f03c1900-5407-4c76-95f2-dc848f1c244f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050670, "uuid": "3d95dc46-554d-4d71-b649-cb8f57d87897", "value": "02-Final Payment-INVOICE-8901983.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f96e30-71ce-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698084102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084102, "uuid": "58ba74ef-780c-473a-befa-5b2b886903bd", "comment": "Malware payload (AgentTesla)", "value": "e0275229ea7119c2122ca52fe1180e8b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084102, "uuid": "3e49adc4-823d-4012-970c-2b4602f23748", "comment": "Malware payload (AgentTesla)", "value": "37e1622691e65950718efdf6cdd691d2f096f7d8366cec92c5dfdddd22c52d8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084102, "uuid": "bdb69a80-91b1-409a-994b-ac1acae29ba0", "comment": "Malware payload (AgentTesla)", "value": "719fa8aaf5ae3bbff6d189c2f5177d5909550c55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084102, "uuid": "d982e06d-3932-4757-9ef3-e86b18f84a7a", "comment": "Malware payload (AgentTesla)", "value": "99c76de290ae5100d4b1cc4bf56643901a36fba8d7d18b29a4c6eccec46ee3a60081b548e1e27e283014f05bb228a075", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084102, "uuid": "098968b3-35ef-468a-9347-2f68449c61e2", "value": "T1F4D4232B21644EFBE5B4BDFA1463C54023908D2BAC55FF8E5FA134EE4CAAB109911377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084102, "uuid": "481baab8-c4b3-4dce-8939-463756e51cfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084102, "uuid": "bb0d53d9-e12b-4272-98f4-8036ca67577a", "value": "12288:tsxTA6qowahzbqfRkUYiIM6YrfoJy2QLG44yopLSjW8mxP+:yxs6PzbqJEXYrwIdjdopLMOP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698084102, "uuid": "fc927d95-6142-472b-b1e4-7e6175f9f845", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698084102, "uuid": "e5a8b563-b3fe-4f5a-8e09-7a7826482281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084102, "uuid": "9cc5534a-c969-4cac-82bc-c97d108f7849", "value": "COTIZACION 7996542.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e3b96d-7178-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1698047320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047320, "uuid": "24256130-6ae7-407d-b249-c629f55193fa", "comment": "Malware payload (DBatLoader)", "value": "254ad54f2287e16b112f0b8ed4b43661", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047320, "uuid": "595fe6c2-d81e-4cda-9ce4-d1f87f5ac6e5", "comment": "Malware payload (DBatLoader)", "value": "3833fa9ea9aaeeaf913952a5444970cfec915384490e3a689f4dd8b393b5d0bc", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047320, "uuid": "7921e80c-a892-4578-a532-dc1590fc44de", "comment": "Malware payload (DBatLoader)", "value": "c4b7d00b14abb3b7c98cdcd50e95332959909784", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047320, "uuid": "257d2dc4-8140-423b-92fa-7979ad58865f", "comment": "Malware payload (DBatLoader)", "value": "59c79de6251c9189c3ea91f4ac52d4f78e161202ec7cf1d28e6f8c3a7ead7ddaf54b81397beae65ddafecede64b5be50", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047320, "uuid": "67c451f7-3dd5-4147-8d71-ca168bdfbef5", "value": "T13AE4335CE0706B059C6E94A351B13B9CA53F60D36AE386FB1F79F38038A562190FD398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047320, "uuid": "098f9c31-3b21-4622-9e14-7f9cb609697c", "value": "12288:oZoCjlONdW9tNdD9LS+NE02iYPy+Fu6N6Gd+x7A8T1PwYqle0nrQHTFneQfFygAx:oxROLWX/9ekE02iY6+FEGd+WMPwYqlEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047320, "uuid": "f7200dca-5d99-4080-93a6-83748b30c606", "value": 667941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047320, "uuid": "e2ca9105-b80d-4c1c-a088-e8321d2d9b1a", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047320, "uuid": "1bd015a7-2bef-4bb9-a6a5-451af4363038", "value": "PO9823.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2fb0aa-718b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698055578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055578, "uuid": "4a3c956f-8a89-4384-9966-c30a8f6803e9", "comment": "Malware payload (AgentTesla)", "value": "ff48adbb4c1244336754434d3ff213f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055578, "uuid": "4b08a9bd-07a5-43cb-986e-ff6c6649d5ff", "comment": "Malware payload (AgentTesla)", "value": "38468ab187452cb5bb9572bfe5b111449b8daa66678cd67396f8d5ccaaa382a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055578, "uuid": "bfe8d530-7d05-49b9-a89b-956a7e6b61ad", "comment": "Malware payload (AgentTesla)", "value": "b6cc6e33087cf2c9a2472cc5f82d521025fcf5d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055578, "uuid": "a2ec7326-5d7d-4f4d-89a4-5bacff15acee", "comment": "Malware payload (AgentTesla)", "value": "f562ce3c0c8b8f44df3180d53cee2d8213665a0d7a39a4719167944f4a37df31d0dc45e4ca72e0e871fd6f06b712a3fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055578, "uuid": "7e7414d6-d695-40ed-bc0d-07c72e4d2b48", "value": "T1E3D4F10472B68B17EEB943F54614162087F52A6F393BE3899DC2A0EF6876F414E41F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055578, "uuid": "98908e63-c1d9-464e-8c59-e88991f59254", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055578, "uuid": "ed423e9e-a845-47eb-8c83-f94b3292375a", "value": "12288:RCiNX9KEprvFOIryQOGrRykhKfBLGApUrqDeb:ZtfOZgYU4BLGSUrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698055578, "uuid": "115be339-38b2-477d-89c3-4dc10a23d268", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698055578, "uuid": "b07c9d9f-b916-4f60-a828-210c4cd2d6fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055578, "uuid": "28094997-36c3-44fe-8568-ca41737e469b", "value": "PAYMENT SLIP.pdf___________________________________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18cf1cd2-71b8-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1698074599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074599, "uuid": "4aefc652-2d98-41d3-b83c-30ab00a2b964", "comment": "Malware payload (CoinMiner)", "value": "37e2a5228f176b349ebe811633e1df47", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074599, "uuid": "dbb129e0-550e-48ff-b8af-a1527e334b38", "comment": "Malware payload (CoinMiner)", "value": "3869f42deb7d3c0937324b64d2ee0ef4b684f780845a1fb5324f9e498076c594", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074599, "uuid": "640effc8-aa0a-4f09-91b0-e14d23e9cb00", "comment": "Malware payload (CoinMiner)", "value": "8202c5d964d2c60440aa0aa648e26c61130b8b62", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074599, "uuid": "939483d9-56eb-464a-9d08-ba58dfbac16a", "comment": "Malware payload (CoinMiner)", "value": "5729fafb324e83f79387165e6cccbf33fa86b765338c8ca3a6aadc94298dd83e877ed2941eb2edbde9c9f521ec6f3a1c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074599, "uuid": "ec856622-9f04-45c7-af90-d04891508d95", "value": "T154858D09F39405E9D85FC730C9199F32D3B4B85A0722DBAF1B66C6462E73AD19F3A211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074599, "uuid": "3fd7db8b-8d25-4777-9ca0-58837313d60a", "value": "8a73a83fdced3fd9c55fbc1b70e551ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074599, "uuid": "1015082b-457c-4589-8470-1f2eff801470", "value": "24576:WOMOMrt51qVLwTb+FUaDnRtrXf5NZ3eUsKhr:0OMrfcwee+vZOUpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698074599, "uuid": "995504ec-963b-404a-89a1-df53ab6b5a12", "value": 1797856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698074599, "uuid": "24b002f1-8705-4abc-a1a6-b442fb9e6432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074599, "uuid": "3c26694c-803c-48ac-9d95-1a416f5e087c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f23bdbb-7199-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698061376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698061376, "uuid": "6639d167-fe7b-436c-b86e-8add9942ac91", "comment": "Malware payload (AgentTesla)", "value": "b2fc27e20fc01089056df0b0751e8694", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698061376, "uuid": "decc777e-c341-4620-a454-68766b35cb48", "comment": "Malware payload (AgentTesla)", "value": "38f03fd1a4f001df84def0205e1f58538ae3e6d08ee86ba2d90e3f203e82ebdf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698061376, "uuid": "d159a8ba-5ee4-4552-94f3-4c6ace0093dc", "comment": "Malware payload (AgentTesla)", "value": "59ed22415137de50063a4620f64cd16e25de91d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698061376, "uuid": "ebd599bf-356a-47a1-a00c-74735e299c2a", "comment": "Malware payload (AgentTesla)", "value": "ba1cd46cfc792f9279b22411f6ccdbfc53b43c4c4068c5e34bb5eb371178784d0e62adeece00063c3c64963d508e0d74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698061376, "uuid": "c7238011-b8b1-4639-b13b-9b7ac76032fb", "value": "T1DD35132C0CF809124161E19EDFD8EA57B2C08CD6664C9DA687C68F995A1393BF09FD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698061376, "uuid": "443c6967-d2bc-4c5c-9b0b-ae090764d0ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698061376, "uuid": "7ee2ad31-b431-44cd-a789-ae8264ab6a57", "value": "12288:CkvNfrPolXZuClWJKq8yP+O5hu4q79rPET3a+Yo7KTiR:N7WApE0hrqRYea+eR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698061376, "uuid": "0efb7dce-a3fb-4dcb-a6dc-58ac8d3ae5af", "value": 1091584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698061376, "uuid": "6fd9441d-002a-4834-94a7-22696763b0a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698061376, "uuid": "5bde4d7d-7a00-4511-85b8-b79fcd943faa", "value": "Purchase Order,doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57461cc-71c9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698082271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082271, "uuid": "757d5b88-7470-4585-b600-ab9b614513fc", "comment": "Malware payload", "value": "4ad624b9fc3f4942c5a4c1ccd627feeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082271, "uuid": "4823f1ed-e432-48f4-8f8f-98f8c6c3141b", "comment": "Malware payload", "value": "39dddd636a957cdd98a61e86e0f66f61a7312296fa00607956529be5ca45b838", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082271, "uuid": "a4d37693-1c6d-4c18-a0fd-dfdd1536592d", "comment": "Malware payload", "value": "90d43ec3eefddf84ecd5ee70648c1349cbfcc725", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082271, "uuid": "440be6f5-a629-45cb-aa33-b1c63c1cfe38", "comment": "Malware payload", "value": "0dc560f0f0bbc590a4602c1ffde64cbf460f588fc54d3285a31b716d3ff7bf11d5743e89451e1265b1e12eca3b7edf58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082271, "uuid": "6205191d-a90b-49ab-8942-1f0c222fa214", "value": "T11D1302D0122127C89361EA3938BE702B8534666F32F92D403D97A14EF54B71698B7EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082271, "uuid": "a86b2398-3942-474b-9d96-2210a8d5e5f0", "value": "768:/kAKuobq1rduMGAXSEYEYv6DjbChaAUKvNvy0OQT23MTGU1Dkr:87vbq1lGAXSEYQjbChaAU2yU23M51D0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698082271, "uuid": "70f7b465-a391-4d4e-9fd8-369aada029b8", "value": 45184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698082271, "uuid": "a59e4968-3fed-48f5-81b1-320fdb069796", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082271, "uuid": "f8a8bb83-bf91-4617-8493-0f49c2c6278a", "value": "SecuriteInfo.com.Linux.Mirai.4338.9953.4114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a1fe98-71a4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698066187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066187, "uuid": "71a8d425-74ab-4233-9e89-793f7e435285", "comment": "Malware payload (AgentTesla)", "value": "fbbde71303cff77773d9b5f500f75446", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066187, "uuid": "689597fc-5a56-48a3-b164-b1a0ee100c7f", "comment": "Malware payload (AgentTesla)", "value": "3ad9cd54c43b2b57abb7bec9d8fba2cc132af136c96ba7bfe09cce1e8b5cee30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066187, "uuid": "aa9dc662-8744-457f-9df5-d7456b27ed3d", "comment": "Malware payload (AgentTesla)", "value": "cccc39992a3b701f026f3d6caec026c8237cdf4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066187, "uuid": "0fe7d637-58b3-43f6-9073-42a84a28fff5", "comment": "Malware payload (AgentTesla)", "value": "1696c8098e0a7848e33f16d8080940625bfb472aa6417e4151892181387909f7d0d5d128618e615548204576cc28dcf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066187, "uuid": "489554bb-5dd2-468b-84af-ded5d421377c", "value": "T1A6D423ACED01808C0938A4AFA5DAFC39C0C4A12E55E75445D2CF60DB0E25BF14BDBEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066187, "uuid": "58c48de4-c073-4cfb-85e2-8e147e304b59", "value": "12288:cxm5qwAcHX6PAkTw511+QSDHtylyRi1P35meLR7Gbvi8kfVlW0eS5X:cYIwAI6Ip+QEUee3iiJVQ0ew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698066187, "uuid": "a4714e08-f563-41c4-9dd6-58c793ed29a9", "value": 631546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698066187, "uuid": "eacaff72-f850-4ff6-a8ed-8e5bfe617441", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066187, "uuid": "26443007-f4a1-4cb6-9e0a-a48d3de26cab", "value": "ADVANCE PAYMENT FOR ORDER #249390.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b785091c-717f-11ee-8907-42010a9c0042", "comment": "Malware payload (SystemBC)", "timestamp": 1698050384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050384, "uuid": "bdce29c7-7fa0-4ab9-8523-0c9fbbfab236", "comment": "Malware payload (SystemBC)", "value": "158affdb2a85c2c74a6978d7c9f8a600", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050384, "uuid": "e7df193b-1c3b-479f-acb2-7e74e94df8cd", "comment": "Malware payload (SystemBC)", "value": "3ae62bc5ec965577dbb25a3065edc53c2d779641ac985de0b822a5debac44d92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050384, "uuid": "a9f422eb-cc8d-4928-abdb-b53a2165f384", "comment": "Malware payload (SystemBC)", "value": "cbc88a79f365607e998cac233c086696a7eaa8bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050384, "uuid": "0215aa82-8387-4bab-a5eb-4615ec3679f8", "comment": "Malware payload (SystemBC)", "value": "5e7d21fed5952c3c76e2659e520d0730bee8d0614be86774e19ed83eca3e408707f182668fd971dce07051c8b82b7edf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050384, "uuid": "0c129f98-2b3b-4eeb-90f8-26148f7c24e7", "value": "T1F594D1AFE745AE22C13D5A739123312853F4E187C952E36B98D493F2FA272CA35211F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050384, "uuid": "6a2acd92-c38d-4896-a881-0c73622789c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050384, "uuid": "cedda155-834e-4001-8867-757076da7941", "value": "6144:qfjwiuBOwL8qlyO1sccMNQzS4c7+QdlnFL/Jsh2fePxFgm8WtrgFVA:EjwnBOwQ0sHrzS4pQzFa4mgm8WqFVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698050384, "uuid": "5ce5c9ce-2c3d-43a1-8c1e-3c1b216cdf7c", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698050384, "uuid": "75c4835c-7a58-4495-808b-805cd40e773f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050384, "uuid": "04a0677d-8b72-4e82-a335-2eddd4f9477b", "value": "158affdb2a85c2c74a6978d7c9f8a600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb2c046-71bb-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1698076220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076220, "uuid": "7998a454-78a5-4971-ad85-baff12972e09", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "277a40695913e1f78661c3c75a7616f1", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076220, "uuid": "ca3a19a1-b604-4513-9754-af78ce97f63c", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "3b65813f3d3735aafe026cf0a2993db4e1da3dce321a638c56350fbffdc0c0e9", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076220, "uuid": "d83bdca8-8ae9-4ac1-bb7d-09ddf9595be5", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "72099b944137f88709780ec3e1f155cc4f45ce91", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076220, "uuid": "1b96d67a-967e-4cc5-80ef-57bca969c22f", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "1bc030226bc4a854fb3fd0683f23894a5956ddbd2e35479d5d4db7dcf40851e2d88eed51c0ee01426ec6e3f3d18c54dc", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076220, "uuid": "96758c24-927d-4814-aaa6-daad7e9bf733", "value": "T19D752312B1F99972E4B83BB02AFB03D3113B3C72197A87236692981E1D73794C835767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076220, "uuid": "e8c45aaa-6e6f-4b8e-8d21-50dc942d1c64", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076220, "uuid": "7c8dd9f8-b998-4a16-b5db-2b91a5238270", "value": "49152:3I2qQY9em2fjeFqE6QCPaEbbdWxwzLgaV+1:4T9YaF6QCiEH2e8a4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698076220, "uuid": "8584ae92-b6ff-49fe-bfec-1b741e45cbd9", "value": 1584128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698076220, "uuid": "fccebe86-6732-48b4-b082-b021e9c82eac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076220, "uuid": "ae81779f-fa9b-43a6-a4b7-915e0c258521", "value": "277a40695913e1f78661c3c75a7616f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8707c13f-718d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698056316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056316, "uuid": "3f110a76-5238-4481-adf9-dc093507f53a", "comment": "Malware payload (AgentTesla)", "value": "1c9a632d64ad963a00ae0af4ccff7d88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056316, "uuid": "63f1d3c9-41dd-4988-bfa7-0b367009231a", "comment": "Malware payload (AgentTesla)", "value": "3cec52e32216e804423f755600d820e50cfde4469d7ee67c80f62d7aa2570870", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056316, "uuid": "310cdc8f-e97b-48cb-9791-0ef857db54b6", "comment": "Malware payload (AgentTesla)", "value": "9d531bc3d4a60eae81de7e50d2fa2f37c8efd16f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056316, "uuid": "b55a2d47-ee27-4d58-9f68-609e851bf1fa", "comment": "Malware payload (AgentTesla)", "value": "91fe47649bd38b24337c8973a4a6ee7f361bdc1e391f28d74ba98a67b7a94753acb472b4b0968066f6df29443b6a5ba1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056316, "uuid": "9521d136-cb4d-4c45-bf2e-fc1559e5728d", "value": "T149F423690DD59370E336A476B13C526902B33A7829B250CCBD1524BB78D435FEE2DB72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056316, "uuid": "6be7006a-f649-4e5e-baca-2e5549209997", "value": "12288:/8nW6vQ4dY0AT6+ZJfQIff/FYgzIY7FWRTotPACNEYJB2S8k2kZsAGcpW/ji+525:UxQ4dY0A5JrfXFYZvotYCNEYmlkYAGc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698056316, "uuid": "ed8ff70d-b35d-4486-ba98-38932c2b2692", "value": 752117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698056316, "uuid": "c8fba457-754f-40ee-8119-f88922648861", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056316, "uuid": "81f51cdf-88fe-4edf-8945-4021c9a5997e", "value": "RFQ_231023.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8485b450-71bf-11ee-8907-42010a9c0042", "comment": "Malware payload (Healer)", "timestamp": 1698077787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077787, "uuid": "ad1b8658-64f3-4b85-a9f8-f38a1cbb0671", "comment": "Malware payload (Healer)", "value": "ce40fcc1f95b0c6d4f7a21c08d49a17c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077787, "uuid": "2528a799-e1f8-4e9f-ad1a-623475f8ea3f", "comment": "Malware payload (Healer)", "value": "3dddb80ed9de80b4d7c31ecd952500294af3f235a6a0c52a5adfcb35a07a8a7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077787, "uuid": "63f74248-7aa9-4c03-adc9-9a486d46e430", "comment": "Malware payload (Healer)", "value": "703099eee297196e642eba4781f9542ba8fbfed8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077787, "uuid": "5d098ae1-b993-471f-8efe-9f05e62b9021", "comment": "Malware payload (Healer)", "value": "ec7adb07345fb582523964c5d8996e207f75546a9a763d10f7a862b45d0b63d344aa28b8ccf0e34e79341fb122f60faf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077787, "uuid": "eaa1835b-a859-430c-9876-157e23fefdcc", "value": "T1827523579AE490F2F8BA17B116F613C31B323CB36D3503A76649D82A0DF37588836766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077787, "uuid": "815e1eb1-054b-4433-a95f-7a213c19a0f0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077787, "uuid": "79f013a5-fcd5-48e8-af8c-90f585e472e5", "value": "49152:ncNhZC2U+qtQFaQmk+YP4RHugqtrW+P2Zf:AC2URaas+YP4RHdqtrv2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698077787, "uuid": "2073a1be-ea63-48ab-96f7-1102ca833c3a", "value": 1582592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698077787, "uuid": "6b9b851e-6c23-4414-b215-c77d70a65437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077787, "uuid": "f5b7644c-dded-4896-84d9-a5f7b839b385", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f224c607-71c8-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698081836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081836, "uuid": "96b854bd-9d0c-4dcb-b18b-dbc8ace91e24", "comment": "Malware payload", "value": "184738cbab0c755c33cd37b238b89820", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081836, "uuid": "97459c4c-ad7c-4d70-b9cd-f6e3a23f74e8", "comment": "Malware payload", "value": "3e6f8eb296ca225d3e1a4f955b0da16615cf891ed0d175903f6f180ed92725c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081836, "uuid": "df412732-d9d0-494b-a590-690031d9ce26", "comment": "Malware payload", "value": "e5da6f9c6e98540e828793a0a426ebfce0bac15d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081836, "uuid": "478b1e1b-928d-4e31-ba22-c91e19f07e3f", "comment": "Malware payload", "value": "98dbd9cbf66b042e33f3d3474a985984a79fc8e67bb778b992d64e90e3cf29746350e9480e7214e5f7b99315f22264f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081836, "uuid": "335c52d0-5eac-4530-848b-3e04d9f334cd", "value": "T10CD4236763245B7FC67C69B65CD0A90407E0818F8C5AFE9C0EB461CF9B23B54CA5278B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081836, "uuid": "85b609db-c8d5-4be1-9e80-7674fb446ceb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081836, "uuid": "bf564e6a-1a2d-40a6-9dc9-88407230fcb2", "value": "12288:JsxTA6qL1/JS0GFp4as54d58+qGSLHZW1qE5K7f1b:2xs6Gv4F2T54d59SbZWqEU7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698081836, "uuid": "57fbad52-9a58-4210-9306-6bf3880c4cfb", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698081836, "uuid": "a68410a2-068d-4bee-b328-85ec18639ffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081836, "uuid": "0a78eafe-32c5-4e5d-b3ee-7b8a5ca17988", "value": "PO-HET230283.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2312846-7191-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698058133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698058133, "uuid": "086cc733-d04e-4dfa-822e-8591f4240733", "comment": "Malware payload", "value": "cf540ad824c5843c86fa6eee0f43d6a4", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698058133, "uuid": "1e88bed5-7ee9-4741-b436-3c81efe3bde2", "comment": "Malware payload", "value": "3f3554de76f134896fd9e0092aa3c992e0550e01e661d0b7128a2a6e82ea5d6a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698058133, "uuid": "8f06e33a-a215-4e56-b34b-0e7753b6e816", "comment": "Malware payload", "value": "32fa232405106692a7f777342898fa8a08e38e3d", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698058133, "uuid": "651ea93f-c6f9-46b3-8201-95d57ce2dfff", "comment": "Malware payload", "value": "0ad0a50a7e701d549a57623bf2319c004f0525ba7ac774c9a98f35465eac2bbe8c394e79b57b6728a3b317fc277ba1d8", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698058133, "uuid": "0e1c31ca-66f6-4218-a310-0b2c46ef6982", "value": "T19FB312FD714A0291689035A3B14763D06AA42F323BEAB615F1F01357EF46BB9F039907", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698058133, "uuid": "fcba4c6d-a354-43a7-8c97-9ebed882bf31", "value": "3072:gX1CAd7Qe64WVc+PHtXaGt+xzNzrZp/mYe2+XCcqfFAujg:E1CM7Qe6VasYzNzTZe2+ycqfF5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698058133, "uuid": "035f45a4-430a-46d3-ba6e-9e5b5284399e", "value": 116139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698058133, "uuid": "dbdde133-1dc1-430d-ac5e-f7c5575aa307", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698058133, "uuid": "b2ada494-2379-4527-ab30-8521ed97e756", "value": "PK2023-0071.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c8fbf3-7138-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698019703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698019703, "uuid": "2d560375-aad9-4628-8f1f-f46898cbaea2", "comment": "Malware payload (RedLineStealer)", "value": "8f7e164185dde53a0ea51c5e312b91a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698019703, "uuid": "79678d1f-2d10-4b64-8da9-ab5060c37c7a", "comment": "Malware payload (RedLineStealer)", "value": "3f9c5c35a9b26d717aaebefd7b8eb13cea876b7f561c247a49715307faa47ca4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698019703, "uuid": "6bb0c9b5-5a4a-4a7a-9be0-81c21ef57fea", "comment": "Malware payload (RedLineStealer)", "value": "b2e2ecf390febfcb986666fee417c7d95b8341de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698019703, "uuid": "725da567-8778-4d63-94ad-bb39231d1a5c", "comment": "Malware payload (RedLineStealer)", "value": "0beb57fb96d7884e2c91846a56920f81b2669a4e84dc75a9944966ff69bc8161d0cd836c3ee343ddd6e337ecabeee119", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698019703, "uuid": "a4f6e82a-cc31-43be-b1c9-8f347a3a1538", "value": "T103B48DAEF5C0F831C077C572C81F6B28D4939E788B0617E77EA1C56D16982E2BA764C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698019703, "uuid": "1bf3e2cc-04b3-43ef-8c68-d49386c1f2c0", "value": "d52ccff4f325ce6b295038c3a3f9150f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698019703, "uuid": "86a1ed93-a805-460d-8017-dee95baf2db5", "value": "6144:TnWQryku88f2/vpUOXia60CoOO5R2ZnxQdLTJFb246eQB8ApxwNh:zWQh8YvpUOXia60C3O5R2sdLu4uBPyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698019703, "uuid": "cfb2abe3-92ba-4b20-a5c6-30aa95dc1694", "value": 509512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698019703, "uuid": "260d82ee-cce8-4b63-912e-b198c07a9cec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698019703, "uuid": "1201d0ff-e017-456a-96b0-9805eec64b34", "value": "SecuriteInfo.com.Win32.PWSX-gen.10285.1599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4db82f-7163-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698038237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038237, "uuid": "1cda0ac8-8bd5-4676-afea-2b5f2090141c", "comment": "Malware payload (Smoke Loader)", "value": "052fa894c309bdc16028a439964979fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038237, "uuid": "f9419a82-1891-49be-b482-222d36ccd096", "comment": "Malware payload (Smoke Loader)", "value": "3fb4ba5109a74f7180d4f6219dfd40d8a7dd04ddc8017dcf3a2eee59082f0b59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038237, "uuid": "c5d7c016-4e2f-4bbf-abcd-5fd80f81584f", "comment": "Malware payload (Smoke Loader)", "value": "50bce0d046dbb46e2d6ca0d2fe1be78c21a41c39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038237, "uuid": "d4e110f1-06fb-40f5-99f5-40a68ea13216", "comment": "Malware payload (Smoke Loader)", "value": "90a5faabc4438640b0a63d94bb33eb5c3196eb7b44c5abad8a53e023ed04d2906352891d580192a89297907d2087a92a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698038237, "uuid": "c5ce202b-3f2b-41d5-9d63-a19bc1fb6584", "value": "T113448E13A5A2EC60D91685718D2DF6E8772EF8718E59E7573318AF2F38703A1D263390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698038237, "uuid": "af4d5ce9-4747-479c-ab88-a4dc7adf58f9", "value": "3dc5fd248fcafa52ac5c2283ccf28cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698038237, "uuid": "e09a941e-1920-432c-96f0-b6445524a65b", "value": "3072:rwX2+caIkLK1O6nurZJ3mal8g6lXepZx9i93jUtgHPQf5Ucurbfrvr:4HcaIkLOlnurS28HOXx9gOqxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698038237, "uuid": "b811f759-220c-4faf-953b-e7042775865b", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698038237, "uuid": "2d8fff51-1a96-429a-863e-acfb81698eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698038237, "uuid": "024fc252-d638-4da4-b9b6-e2a2688283fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d75ee42-71c0-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1698078124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698078124, "uuid": "03bc1604-5362-402b-b26e-1482217160a9", "comment": "Malware payload (Tofsee)", "value": "127450d6d27fe7279152ee41f2000e84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698078124, "uuid": "8ec5ffc0-d97e-41cc-8044-d71cac5f282b", "comment": "Malware payload (Tofsee)", "value": "4086a65a6f05acad63c7c0bfe30805912a17e560ac8817af73717ef9fdc8ce71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698078124, "uuid": "002e8619-fcbc-4d79-bfdf-bee5b235f498", "comment": "Malware payload (Tofsee)", "value": "364c48ec0e18867e64dd1b2e55c11f40952fe8fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698078124, "uuid": "c096953b-e4ea-4acb-9cc0-705e375851fc", "comment": "Malware payload (Tofsee)", "value": "f210232ebfd994dd16ee7566d27883921aac26a9cb4b75e064a58ba48be56ddccd495ed56d2598e8462a0ac9a8fa905f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698078124, "uuid": "e67da8d7-aace-48b8-8c62-e7277b324caa", "value": "T173448E03A2F1EC60D9164A718D2DF6E83A6EB870AF59EA5732187F1F18705B1D2633D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698078124, "uuid": "107bf1b4-5457-4ce7-a8f7-434d7446aef1", "value": "8c07249af3e9a51b651a1c99624861e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698078124, "uuid": "8a6dfae4-0ce2-488c-bc7e-eb8888769b46", "value": "3072:hwXAGaRVLR6OGOyfDYYX2oREGsmA0gi7R5d8p1GpufrAV:e1aRVL8bOCDYY+Gs7i961U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698078124, "uuid": "2d64f8e2-b6f7-4d50-a237-a67187cf3ea9", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698078124, "uuid": "53872060-f631-4006-a23a-27e7c7697ecc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698078124, "uuid": "2c4b99a9-4329-4dba-8d9c-4bf3fb478d67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a9bef5-71e1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698092546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698092546, "uuid": "b23268c3-6e5a-45cf-82e2-ab1b1f108420", "comment": "Malware payload", "value": "fb3e2b414a9bc57864d40007c7706847", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698092546, "uuid": "b3b1a649-3de2-4338-b40e-5562547c2296", "comment": "Malware payload", "value": "40a9645bda60d02110386f884b8c7e3637e418a04f211949eb883af6d3414845", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698092546, "uuid": "df9e0911-fb9b-405b-b187-a16f540897ac", "comment": "Malware payload", "value": "86184ef8d9269c247bcdfb7e77e792d7a0632e71", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698092546, "uuid": "86330ad1-8417-4a9f-b18b-a87646379ed2", "comment": "Malware payload", "value": "479c135c740aa5e7d85110ce6f879aab29c34dbfeaa37b7fd8d61546f140c0f0a93d6a30bc3885ffd094d7c679889800", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698092546, "uuid": "18402907-1520-4442-956f-8778951471b9", "value": "T18755CA38397A7C2443EBDA1334F14B961CE9564FD1703A3B199AD8139A352C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698092546, "uuid": "a842dd2a-26ba-446c-853b-5809876af479", "value": "6144:++slmEIFibiDokd29aD3GTf4j0F+la9UGEm:Jicm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698092546, "uuid": "3eae0b0d-2104-413d-8c1a-2f804760bf31", "value": 1288911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698092546, "uuid": "349e7848-00d8-4af0-a43d-1d15994a06b3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698092546, "uuid": "aa096855-e6b5-4e0a-965d-30989db436ed", "value": "e75e3876351e06de61f8e29b66519492c005830395b464236af98b35.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532f0554-7156-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698032607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032607, "uuid": "32b16c31-89c8-4de6-9a97-583564da8276", "comment": "Malware payload (AgentTesla)", "value": "709ec3fb8ef86c14875523526851e709", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032607, "uuid": "3fb2b5dd-9422-437b-b9e7-e5097bf20ef2", "comment": "Malware payload (AgentTesla)", "value": "41ce21307d23c24f931acaedf675b008f9b91277b166c0e301b19a54b29b62c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032607, "uuid": "fc0e15d4-7f16-4baa-9f98-e285bd59222d", "comment": "Malware payload (AgentTesla)", "value": "3f74baca899772a3a7da32041ad0c78d8a171dd5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032607, "uuid": "ff6d707b-a1cb-4404-ba5d-248c52c9dce4", "comment": "Malware payload (AgentTesla)", "value": "a2ae5544089a38bc49f22c642a802eef4b6ac61138b86177317bf12c4fbdeae50faca983c01bb79454e52121356cad12", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698032607, "uuid": "6d7ded06-82e6-4144-a469-903a2de2480d", "value": "T1A0C2945857CF81F5CB54B1330259894C06FDF73FB20251E1B4ACA2B137BEA0D99A99B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698032607, "uuid": "9f238b27-458c-4c8c-a9fe-025aaf814e81", "value": "384:hRG40zMalHmdLDdu8JUl1Ehlk/QjY7oeiIByPnxifNInMin:hRGh6LDQbE4/QjYdhByPxKN8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698032607, "uuid": "c5163370-8227-419b-8a56-e9375ca5a493", "value": 26805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698032607, "uuid": "456a0351-3a05-449f-94fc-45611a5dbbce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698032607, "uuid": "ac08123d-7aa4-44be-a1fc-d0c51981a303", "value": "58e081544a0feb37e9c8debd3120f300225d137d56e7c06f18ebee63.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd271e5e-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042717, "uuid": "c5e96b7f-a643-4a45-81bd-83f8d375e022", "comment": "Malware payload", "value": "9564e3916d9a1131503c50f36e6b3e8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042717, "uuid": "8ff72b21-fd19-41c3-8507-ea291e42d2c0", "comment": "Malware payload", "value": "41e458defd1b1fbe9f6e407fdec3db57b673428fbaba945df9da950c4b1d677a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042717, "uuid": "0a275d1f-a0a1-4f3e-b303-eb754788ecf2", "comment": "Malware payload", "value": "10dc2f7a7660a061987858773a9b00939acfa5e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042717, "uuid": "470e144c-b025-4f9f-bf93-ac192fab94f8", "comment": "Malware payload", "value": "5f965c3c3d539aee28ba79e50cab1dc700b0c7e647447d10c982c9bfdf1307517098d7392ab78aba3375da48e6a2fe2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042717, "uuid": "78a6a2ca-b836-4351-848b-1a40a47a88c1", "value": "T17FE38C21AB212914FA4581B16294A7FBB9946C353808DC0BFF46BF9DB4741C7B4F8B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042717, "uuid": "6213b30a-b4c6-4d67-b9a4-7ac70e9a9e3d", "value": "e16b7c1005e1cbcbaf5e2ccb8a499f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042717, "uuid": "5c0546d3-3e47-4f50-ba38-f11bb256cb61", "value": "3072:PLBLPq3TxyZuVmbeXptTVSA6goJp/mvm77AYB08I9T+LlVY3uVi3:PLBLPq3TxsuVAeZtTVSJp+vm77AYB08O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042717, "uuid": "2e39f5fe-b6b3-4bab-80e2-8abe495e289c", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042717, "uuid": "61cfa888-8f9c-4a95-8078-66f860818ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042717, "uuid": "c8104161-01a5-4883-bed9-0d2e5de573a9", "value": "SecuriteInfo.com.Trojan.Siggen8.46837.12346.4794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6e431b-7197-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698060751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060751, "uuid": "1e6adae9-464b-43f9-822f-d12e1b247dce", "comment": "Malware payload (RemcosRAT)", "value": "6c282d10c8d1afb8e33f9eae997b8c91", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060751, "uuid": "24157121-33c4-4285-988d-fad80ea2c9c2", "comment": "Malware payload (RemcosRAT)", "value": "43686af2d912f9b8d6d892a38ec481c1802b7964c6318df967081e97b8245d86", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060751, "uuid": "7d3fbe7a-fefd-486d-ba72-625794bd6039", "comment": "Malware payload (RemcosRAT)", "value": "74a9ca59f6ff4736fb9cd807b7ca7f1b2a037797", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060751, "uuid": "700c87b1-8e97-46b5-a524-6e16373f0487", "comment": "Malware payload (RemcosRAT)", "value": "754af7dc281979aafa3ad35deae1529f0869ef26cd62154390e8b4cfd429893bab2fb4deb7b34d64863a616158c820ad", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060751, "uuid": "45dcefd2-8d67-4d79-96ed-3f9df9740989", "value": "T1D232B0A5EEE91CD18C6D0E058542E2F47D7E4FF77B52DAE5B3A08883FA0911E801E964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060751, "uuid": "711af0f3-88c3-4bb9-b0e0-0f8ec47736ec", "value": "192:Pvkxe4vJbrUvnOoBDESwwPqn6P6WNqbMK2E4vXaV/j27DterTbfcnMLP5SMIapgS:34ZUPOWD7wF6P52MJE4vKV/fTjPNIEgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060751, "uuid": "0533feec-aba4-4f65-9f91-dc9a1b7c6bfc", "value": 11335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060751, "uuid": "3e49fc73-a976-4174-b396-da9de2ea29fe", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060751, "uuid": "edd0ba65-1b66-469a-b4ff-ccbafadd35a5", "value": "Draft BL, CI & PL.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f709eb8-71bd-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1698076892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076892, "uuid": "a3549a1e-d062-41a7-a3ee-facad110d924", "comment": "Malware payload (MysticStealer)", "value": "a1052894bf074bb2c7346f361d983c38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076892, "uuid": "413d7124-f336-471b-abb3-c2f7ebd6d4f8", "comment": "Malware payload (MysticStealer)", "value": "43d771bfcf58d1eaf565a7ec414dc5bd8bb43199afd9507e9471a9451a694140", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076892, "uuid": "6e1117b3-df56-4492-b41f-032bd60f254f", "comment": "Malware payload (MysticStealer)", "value": "d018cf8879175b0434fabcd02787f3099d7142d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076892, "uuid": "d169658d-56e1-4c05-b24b-90c39461cc1d", "comment": "Malware payload (MysticStealer)", "value": "afd690936122e3d2941da90fcd58cf9cc48f73f14e27e50468fc0d72e8f69e688f3191fbcddd5f1275a6a254b770afbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076892, "uuid": "f4408b62-b9a0-4b46-8920-438b74e25d7c", "value": "T111358D21388C94F6EEE310B743BCB929825DA0B4231505DF36D827EED764AD17E32697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076892, "uuid": "6e22aab9-a7f5-48bf-a6e5-46513308f891", "value": "440e77e14aa712e0e687ae6e10b63f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076892, "uuid": "3f321131-dfca-4fc2-b595-b8fb273c6d06", "value": "24576:Pgmtwc+VoLIeNwHHHHHHHHHHHmGVvlrjsvYgYNWWzBxy:Pb+VoLIeyHHHHHHHHHHHxlMY8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698076892, "uuid": "87794142-5dac-4ba8-b7de-55248fd7205d", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698076892, "uuid": "f149165d-55de-48c0-b5cb-227b414cdff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076892, "uuid": "af1cb52c-43eb-4111-9473-02ffd68bbc35", "value": "a1052894bf074bb2c7346f361d983c38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d55ea4ba-71cc-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698083506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083506, "uuid": "6a03cf57-bc55-48e5-be86-ba124c178849", "comment": "Malware payload (Formbook)", "value": "278600f3488711651a23efe0cb49287f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083506, "uuid": "e2398bdf-a4b7-48de-80b9-8b0a77d752fb", "comment": "Malware payload (Formbook)", "value": "444d01e19affa64151c503decd2a6ec23a193dccc8524fc63e7ee2b00cf2c9de", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083506, "uuid": "34369fe3-326a-42a4-b72e-77242ce7b4a7", "comment": "Malware payload (Formbook)", "value": "0418e9d877e357b97992304a4de2b45757735b86", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083506, "uuid": "87ff2a1d-b355-42f9-87a0-9e9ee5e02132", "comment": "Malware payload (Formbook)", "value": "af41915c9adfbd073d03ac7588208981f0fd4d366481a69279d45e8d8f7721ed2f8b408abbdbea8d78ad868b2c9704d8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083506, "uuid": "fb8af2ce-101a-44cc-a5b1-0f68156cf09a", "value": "T19DC423782C3D7FB4015A4DBAE80B23086F51A3A9AE4744BFAB107DD16396624F2BD534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083506, "uuid": "9b55c385-e888-4598-a5b8-1cf1ab700bf6", "value": "12288:bPj1ce/U8w1xcd1X3ZEBQvGJgaT1ae7J9xpmSB6In8G:bjw8tdd3ZEBZke7TxFB98G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698083506, "uuid": "0b9214fa-6fc0-49b1-9a06-af26ba48bffc", "value": 566201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698083506, "uuid": "214b6b50-99ee-4c45-8712-761cf4a61cbb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083506, "uuid": "0de34479-91fe-4489-bd7b-d3cb5adff966", "value": "IMG.00HJEIY PRICE-QUOTE SSG.R01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429afadc-7173-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698045034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698045034, "uuid": "9c8fdba8-6729-4b40-bc8a-1d1a088dcc12", "comment": "Malware payload (RedLineStealer)", "value": "7c956f7f0f122488ada6506023e4ad6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698045034, "uuid": "181e259c-71ff-4909-b68c-02866f0ce6a9", "comment": "Malware payload (RedLineStealer)", "value": "44c0618244fe13d64a9e4834097eab230155a32bbb001f5b0cbc7b98bf7ce095", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698045034, "uuid": "3f65e77a-2626-448d-8399-c1c89d91a265", "comment": "Malware payload (RedLineStealer)", "value": "c0a01bcea028ec4ed4a4250f5d8f74d1cedf9f49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698045034, "uuid": "80562419-bc95-4eeb-9d4d-44d1d63a14e0", "comment": "Malware payload (RedLineStealer)", "value": "1afb8bd53fa8564c3f0b124c981f0139b050a40c9ea0e52b7beba9ffecebdd813e1b1b057e4feb6a3dd3f4c0e290f4b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698045034, "uuid": "4fe91f9a-9c92-4753-9243-0314862bd30c", "value": "T1DE652311D2F491B3D8721B3814F702932635BCB199A8586E3B85E50F1EF2EC99931B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698045034, "uuid": "b4edce9c-358a-477c-a2a0-4653b6914a6b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698045034, "uuid": "90c88f18-f8cd-4129-af4d-bbdc6718ffea", "value": "24576:ayj791LdzSnLZ9iKxfYm2z1e8QSQvLWLsCqhZlng/LJ+bba9M:hj7zL9SLLvw1e9isCq2Ibba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698045034, "uuid": "05b64fc0-8911-4388-9b48-7302c79eb133", "value": 1532416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698045034, "uuid": "43295cd2-db9e-48f7-95b0-4ebd327d54c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698045034, "uuid": "9f8d918c-45cc-41a4-bdbb-b7bb79b31bf2", "value": "7c956f7f0f122488ada6506023e4ad6e.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b2d41b-719f-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698063937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063937, "uuid": "977e0627-e507-4d52-8208-7ac5c3aa73d3", "comment": "Malware payload (MarsStealer)", "value": "85668d16d9f14ead0ffff7bbe81cfa1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063937, "uuid": "cbe1e263-70f6-49ec-8eb7-5d5c338d18c1", "comment": "Malware payload (MarsStealer)", "value": "45231592f88f6fcd76e1694ff137925e7dc2892da859012fe0ba43be2f9846e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063937, "uuid": "b5003249-684b-4c51-8cca-6efea73840cb", "comment": "Malware payload (MarsStealer)", "value": "90c2321b83f636e6b79326d6dc4153f560d00b5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063937, "uuid": "6bad9fac-feda-44d6-8b4e-bcdc496e4e0f", "comment": "Malware payload (MarsStealer)", "value": "238fd1f567b907a6814b883876279c3ddfaf081af819d7c4093134babef3fe973f7f94f3c21111d0777976171bc2c354", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063937, "uuid": "5ff6e133-0b13-4910-acae-5e9972d99c2b", "value": "T16B449E12A1D1EC60D91645F1CD2EFAE83A6EB8708E19E76F33197F1F18721A1D2632D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063937, "uuid": "87eb4e82-85a2-4f9c-9e0f-6c3c290382cb", "value": "780437e8c81fd22a5669fb9201842564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063937, "uuid": "ff50c4a4-fc0f-405e-83b5-4374b72ea6a1", "value": "3072:owXlqX6TFLFtOA1PflUvODpGOonYJ2oN1n2HJZYS8T5kZx4frA:FkX6TFLPB1PflUGNGOzNVWZl8SZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698063937, "uuid": "474e8cb0-a676-443b-8f76-bece238ebe2c", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698063937, "uuid": "a7ef09ba-d10f-4cbb-adbb-b79288fe13e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063937, "uuid": "ec8329d3-5985-4bfe-9985-3828f55a33ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7092a61e-718c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698055849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055849, "uuid": "01a580e7-7e98-45ef-ad2d-b73312588e01", "comment": "Malware payload", "value": "918a4ca19ee19b6df3277720e811d770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055849, "uuid": "37c65dcf-415d-4e48-9501-c9d41ff0acc5", "comment": "Malware payload", "value": "4578e6280f2c8e0925d94f8f89b44e204b66258eb9e842795b35b0db93d8e084", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055849, "uuid": "1b605f4e-b2cc-4edc-8b6f-363dad4486a6", "comment": "Malware payload", "value": "67568af7b39312424d131ae5fe3988274cdbb55e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055849, "uuid": "b28542de-4abd-41d4-a127-219050fefc0c", "comment": "Malware payload", "value": "eb4efbd322bc6beb085e3c536a3389486bbd438e985cd54dbfe8e6f9807a11f51fca439d43c3a12f4e9ce63149e5b16a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055849, "uuid": "965b0062-9aa5-4d33-bbe4-954aef2d0928", "value": "T1C454F103E746E961E23427B7D0A6608882E2F78067EBC5166D0AB2F757127D5FDF0287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055849, "uuid": "ef7c8277-49a8-4f32-ba5b-deb25e99757a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055849, "uuid": "718dbb04-c532-408c-8ac0-0313033ce34d", "value": "3072:MEbEC0GHLMAR18POIyFABgNN3XRQSY9KAQl6qx:MEvbLMAj8P6RB2KAQlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698055849, "uuid": "77d26f14-ba11-4448-85a0-aa481a96c069", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698055849, "uuid": "7de34df7-b324-44aa-9d57-80d672fadce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055849, "uuid": "14b88710-be46-4dd9-973b-1c3861dbc6e5", "value": "shipping document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eccf351d-718c-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1698056057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056057, "uuid": "3beb6683-b0c8-47a7-9e93-db8a741348d3", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "b8a26d9c386ec312fd8470f0b728873d", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056057, "uuid": "7957e786-9a89-42c7-a51e-278891aeb841", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "457c1c09953a40ae6f672b1f59c3850869b22e5dcc5932fee87986b64310236e", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056057, "uuid": "fb894f96-6023-4bd9-ace6-851e9923d0d4", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "7fa5f682d9366c13c1ebfccd8b6c4ab4335ecc88", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056057, "uuid": "19372dc2-4e9e-40be-8cd3-e208cfa13c3e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "1b6bf79870399561b43372aab3bbb26be723b1b9676560b6fa74de461d638c1080e81ff7e1dece3064fbc2905d6c90bb", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056057, "uuid": "b44c4c69-e8fb-4b15-b4da-46217c012947", "value": "T150752362E3E84231CDA76BB0A9FA04C31B357DB26874422B23919A111DE37C4F975B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056057, "uuid": "d4bfd5b0-6d81-4776-bfdc-fc1772f920bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056057, "uuid": "e1d2d9c5-7859-4346-88df-d7e66d255285", "value": "24576:myab630MZL5fUEHJspwjRtFwMccpgrCp0tu69yL0FnhVQyNZQ:1abEdZ9fnp44TfcLAevQyNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698056057, "uuid": "a79c0e78-f7ee-4a3d-b9a0-f7844682c6f5", "value": 1590784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698056057, "uuid": "405f297b-1485-4649-9b39-e71824b9335e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056057, "uuid": "757e7723-cc42-4740-a268-f766ce67d631", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772f610a-713d-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1698021930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698021930, "uuid": "dfef67f5-2699-4ba2-b32c-cfe425a36417", "comment": "Malware payload (NanoCore)", "value": "05ab85f340bb2100c86ddd5abc3e2859", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698021930, "uuid": "812297a4-965f-4b27-8060-5380109fce48", "comment": "Malware payload (NanoCore)", "value": "46304b04bb16705686be07f4349446f6a226989be6b00b4066aa4543d96f3dfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698021930, "uuid": "454bcd0a-e8cd-4b33-b96a-0e1d896d9ec7", "comment": "Malware payload (NanoCore)", "value": "e3ae6559c871934722ca441ac961d726896821df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698021930, "uuid": "ba5a2e15-53c7-4de0-9fb2-d17c4a5d459d", "comment": "Malware payload (NanoCore)", "value": "2d6f8ba64003cb242536101f48a75798865842692531e179d008f70f1a2f52842cc54fc0db6482e02c9069b2bf9c545f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698021930, "uuid": "a424e9a5-0bc7-4c6f-9000-c1a0f33312e6", "value": "T12A14CF1677A84A2FE2DE867D61120216977CC2E398C3F3DE24E415F75B263E40A4B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698021930, "uuid": "caa7582b-bf45-4e85-a1f9-bcdcf4dd1661", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698021930, "uuid": "eb8a64f5-471d-47ec-aa8f-e33af77d36af", "value": "3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIgarY+b43qULQXto3b6v8Ep1vo:wLV6Bta6dtJmakIM5G/ULB3gFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698021930, "uuid": "8030c587-f455-4f39-824e-951c26e2441b", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698021930, "uuid": "47609653-b77a-4045-85af-1d22da29aca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698021930, "uuid": "b9f403f2-3a83-47d4-ac17-580849ced391", "value": "05ab85f340bb2100c86ddd5abc3e2859.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7523dd6b-71bd-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1698076902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076902, "uuid": "e1273720-eabc-4516-b244-c46537698e83", "comment": "Malware payload (MysticStealer)", "value": "b0c650f8a795eff7beec3030cad9310d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076902, "uuid": "a06c65c2-4041-4ebe-8c28-dd56bc4b0055", "comment": "Malware payload (MysticStealer)", "value": "4644d80f1f36d4677df85dd2a19fe52cf7b3281e20d0dc2baa8744671382862c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076902, "uuid": "7bc7cf99-2540-4b7e-b8aa-d4740cd752f7", "comment": "Malware payload (MysticStealer)", "value": "9da045a4836f42bdc3a67adb08cc60d5872d0f1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076902, "uuid": "8cb34aa8-3d97-4652-81d1-47b001aa501c", "comment": "Malware payload (MysticStealer)", "value": "fabfc59781c83ee82a5e29eeb637d8a90316fb89af6184d4736a098882625208f67fed08c7f9898ed9d37a2db668ac19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076902, "uuid": "3b88d885-a887-4b53-a960-4aa18bbd8907", "value": "T10135AE60788091F2DEF220B787FCB92582ED94B0071516CF16D81AEED770AD17E3E696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076902, "uuid": "61252d4c-c3d1-4251-820a-fcd72f4e27a9", "value": "440e77e14aa712e0e687ae6e10b63f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076902, "uuid": "6bc22fde-e768-4826-b514-9d17bdddc162", "value": "24576:16mtwQOC4b6SJHHHHHHHHHHHEsy58VrZqwQLjJ6/:7OC4b6OHHHHHHHHHHHG8bSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698076902, "uuid": "e0aba394-38fa-48db-9525-3e3e1d1ebadf", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698076902, "uuid": "c0e5338d-536c-46bd-829b-880014cd996e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076902, "uuid": "438f5c84-9088-4473-bb2d-d72178f63a8e", "value": "b0c650f8a795eff7beec3030cad9310d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269b507f-7178-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698047135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047135, "uuid": "2e598eab-2793-4768-8995-59b7b8171823", "comment": "Malware payload", "value": "bc0e10ca4723910e4873b2bf1d3b5568", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047135, "uuid": "fff9649c-408a-4e76-9942-b8b6760aa2a3", "comment": "Malware payload", "value": "4684b8747bbfba6860cf67f473b418cc2b149aef01af36cb468d5cc308b689b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047135, "uuid": "17dadf14-7f5e-4fbc-ba29-06210b81df9c", "comment": "Malware payload", "value": "be377f761ccd1b2b988460446565e583c4ab904d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047135, "uuid": "de235dc5-6a20-4390-8aef-4c3e4cddc4af", "comment": "Malware payload", "value": "e8a9f9954a325628035721708c8cf3c7d339ccfc1f63dbc531ca300370e2e92ab637f95a9ceda16330b62e1ebb9992d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047135, "uuid": "87cf7734-1cd2-49f8-b0af-60152abfe6a2", "value": "T164256ED1F15088DAEC6B05F1BD2BA53024A7BE9D94A4810C569E7B1B76F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047135, "uuid": "faab32b8-0f1f-45bd-a7cc-e3724941e287", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047135, "uuid": "7e88d829-3579-4c97-abb6-b8ec37117546", "value": "12288:9gR/mZRM+kmaq0E4LqGSLo3xhlk27Hq5GGtPC+ZU9f5mtkm0fiE:9gkZR5kJEoqahh2cHQGGtP3u9Uj0fiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047135, "uuid": "bd983052-c7c1-4eff-bae9-295c16edec5b", "value": 995328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047135, "uuid": "2fe132a7-c2e9-4a47-a8b4-f09692f128b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047135, "uuid": "f86a2aa4-235d-4769-b018-a9c5c056b41e", "value": "Halkbank_Ekstre_20230426_075819_154055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c7a548-719d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698063243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063243, "uuid": "470da61f-0c19-4e15-bcee-b30255fdeff4", "comment": "Malware payload (AgentTesla)", "value": "b8b0535ec6d031a39f12d7cef8c2604d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063243, "uuid": "a0e6a4e8-e34a-4e9a-a85a-bbe83bd0917c", "comment": "Malware payload (AgentTesla)", "value": "4719d495e55362424d7f325cd190b32b9d0a1ce1130ee890a7f41a1885d5a1d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063243, "uuid": "b582e8c2-e124-42e0-97b5-9c44b4233d43", "comment": "Malware payload (AgentTesla)", "value": "b806885afaa6fac81c653f6464bd1528588a4b61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063243, "uuid": "a8527f0d-debb-4b94-ac0f-fe5d11b4bd8f", "comment": "Malware payload (AgentTesla)", "value": "24db22ed7342692759fabd0e2f006ef7961cfe44ab0b686091e04452d8aff91ed68fcbca0acfbca7f587dbb1fc8897fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063243, "uuid": "5c2a978e-8add-43f0-b948-e27752402ec2", "value": "T1CCE433C2D539807FF4CDDEAC462ED76CAB0F70EE0521585C9AF8827F92BCA24644534A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063243, "uuid": "6b4a4b7b-21a2-4e95-b53a-f3de8699963c", "value": "12288:8lQnraxcttKer89EH6k2rLacuU0R6J5RVCCdknBTsZFTahmgcWLbbxsT/vi:sAaxcttPr89EHH8LaVU0U5RICdkhszIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698063243, "uuid": "4d05845b-6147-4f20-8f88-db02038a5e59", "value": 665726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698063243, "uuid": "ffbab7b0-ac4e-4ae6-bf3b-17cf2a021de1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063243, "uuid": "55601cfa-3eaf-41df-8edd-19f5d8544a37", "value": "RFQ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3233662e-7161-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698037276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037276, "uuid": "7eb8062c-97b0-4e7a-8466-5a2540ddbe90", "comment": "Malware payload (Mirai)", "value": "28da1dbed3012fbe9232c8d6d58f8465", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037276, "uuid": "4f269030-e487-4d78-8031-fb70735c7306", "comment": "Malware payload (Mirai)", "value": "4806d3bb1896cefe947ada86a07893b20c5455221989a04b7fe5218bad6299dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037276, "uuid": "40c81a20-ab95-4f0d-bdde-90d8be955c1b", "comment": "Malware payload (Mirai)", "value": "dbe1a6273235e8950f03b05a1027c3461d9f50ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037276, "uuid": "621d7df7-b5bf-423c-b557-00ab84b6d893", "comment": "Malware payload (Mirai)", "value": "37e1eef1aa8346cdaaa91935da612202f5f7c025ebb2d7b81b545841194c4275c76863f2ebc956a3732c0f50836e50c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037276, "uuid": "5085572f-6711-4bd4-98fe-a6542cb689a4", "value": "T18AA2D025D345AEF4DFEF9D9452C1C2C277F543C6268AC8E240EFAF016906046F789D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037276, "uuid": "35fb5de8-0374-4db1-a283-4b42d454238c", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5SHxM4uVcqgw05VxJp:mRxsSVsMD6xiJJE5zRWNw+4uVcqgw09z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698037276, "uuid": "c1103027-cb7f-4a4d-b4a1-65633510eec2", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698037276, "uuid": "f62c04a7-619b-4691-95c0-9c7c165c296d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037276, "uuid": "4080bc85-12e7-4763-ade7-226ef027b125", "value": "28da1dbed3012fbe9232c8d6d58f8465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b02485-717f-11ee-8907-42010a9c0042", "comment": "Malware payload (SpiritLoader)", "timestamp": 1698050376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050376, "uuid": "c42e8973-6c6f-4f45-a05f-34730dd0252d", "comment": "Malware payload (SpiritLoader)", "value": "6e9d46fee375fe612d14c61c0e667222", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpiritLoader", "colour": "#641E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050376, "uuid": "5f151cb9-eeb2-4327-9083-063b6ac72e0f", "comment": "Malware payload (SpiritLoader)", "value": "482eb1a9d5983a14f159591cfa4edc0431491217b970474de0521715850d764f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpiritLoader", "colour": "#641E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050376, "uuid": "685d9ba4-e940-4e67-bf78-b6944b4f1f6b", "comment": "Malware payload (SpiritLoader)", "value": "2e1c9a99189b44a6a50ab1360c00d76a9e5bf9fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpiritLoader", "colour": "#641E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050376, "uuid": "26aae4f9-b022-49b6-bc39-d215a6f2a118", "comment": "Malware payload (SpiritLoader)", "value": "71dab8ef06c451c6907bd7e43b9030cc2810da667ba5c3f0ca3dc6cedec0fb702d839cd8547bf016ca82f727e50e3344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpiritLoader", "colour": "#641E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050376, "uuid": "1bfecc9e-f1b5-4511-af44-7c4f31a9c3e4", "value": "T169C2949CB25072EEC86BC0729DA51D78EB20756B530BC50B745B02ADAF5E697CF021F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050376, "uuid": "e53d9477-c64c-437f-821b-d150fcd6ee21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050376, "uuid": "5976b566-a7f0-4705-b318-0ddc3b7797e9", "value": "768:6y+pxyQu3LYvoPi31CFjvg8rMSP4Eb+tYcFwVc6KF:MpUQucoPilmbVgQCwVclF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698050376, "uuid": "13d32a80-8295-44cc-8b18-cd2c16c9d114", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698050376, "uuid": "e355489f-8411-4891-bf74-b4fb9084d0a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050376, "uuid": "f67a5ad8-24e0-4535-902f-61e3c7cb2fbf", "value": "6e9d46fee375fe612d14c61c0e667222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d382b3-71b0-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1698071353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071353, "uuid": "56e25a53-c9d9-4a2b-994a-4e7b65f8e745", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "7f5f4a01766ce8e3a62e2500295b4f62", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071353, "uuid": "f5f80838-7976-4520-8bbf-b982406279f8", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "48a3fbcc0f4c9649eeb3e94e532de3b50f11e0221a4e1089758ae2cca1348ffa", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071353, "uuid": "b5e36d62-ea00-40ec-8509-3554e0310a65", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "207274b60050750baf6acf9ed6ccc0f5190060eb", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071353, "uuid": "148f42b4-a8a9-48be-8f14-eec89ea80504", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "1a4164f281acf3270ee39008e03c9360ed06d97003a583bd0271fed515fb870536ebb553c2cb07a7a6c841b0444f5d47", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071353, "uuid": "06da26d3-425a-4d52-881a-b3fbb183bd77", "value": "T166752302FBD60071D879637056FE62930E3238B39B7993363661A95A1EF3A45C93077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071353, "uuid": "0044e9c2-40b0-46e8-bd93-29e546d0505d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071353, "uuid": "a17aae8b-9522-46d0-aa0e-15d67c292caf", "value": "49152:6jh3gXlMsVdcsGlohngjhJflpaywgGxWIQ72:e3+lMsVdTG6ngdPpaywNxW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698071353, "uuid": "4baaee08-3252-438e-98ba-437381845a57", "value": 1582592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698071353, "uuid": "dd9c0372-632b-4d5d-9e99-f2923df47739", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071353, "uuid": "6eecdd80-ef01-49d6-94f1-53259563fa05", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cbf5e94-7189-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698054634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054634, "uuid": "e19da792-b123-4124-afa0-97ec60678af7", "comment": "Malware payload (RedLineStealer)", "value": "ddc4adf21abf328f5965c9ba1db67208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054634, "uuid": "9d7ba337-13e6-4854-b85b-d168f6d06175", "comment": "Malware payload (RedLineStealer)", "value": "4afd7308263d4a7f92e63f0457a03335f9d117d68d2b212493ce956f6ff8629d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054634, "uuid": "95ae8ca8-510c-43fa-b61f-3edc57d3a2ec", "comment": "Malware payload (RedLineStealer)", "value": "605c316599fa2c0ad646d69f4955395b5b6f1eca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054634, "uuid": "2a7cd044-63a4-42a6-95c6-83751ef3c493", "comment": "Malware payload (RedLineStealer)", "value": "2351497b2696094c3c29403729ca20d4ac3c73b268ba8e7721588151f2d7f0c382ac8ef1efd42dcee0344159931db2bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054634, "uuid": "5051db2e-9df9-4b97-99dd-297438ebd4ba", "value": "T19C652343BAE54C73D8752B3018FB43C70B363CA25EB462A92A116DDB0DA29C5653376F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054634, "uuid": "5176f277-465f-4c6a-a51f-77f0fe956276", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054634, "uuid": "96da410b-1ddf-48cd-bb3e-5732955e7a84", "value": "24576:ryTFC4LrQZCkYvO0azCW2xHJ+oHtxr8Z1WWEKVHyTbinPUHH2mFwlEyp:eJNrQ6czCfxHtBNK9AcUHWmWlEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698054634, "uuid": "0d6b2969-6f4b-4735-85f6-65b49e9abd7c", "value": 1532416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698054634, "uuid": "c37eaee8-b11f-4d69-b38a-2cede2796ed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054634, "uuid": "024ae89d-8489-4815-8fe3-db2a6565d823", "value": "ddc4adf21abf328f5965c9ba1db67208.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3291fabf-7158-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698033411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033411, "uuid": "71760685-00b4-420e-a241-170d9752a897", "comment": "Malware payload (Smoke Loader)", "value": "59e3ea395270fc60d10cb96afb842d41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033411, "uuid": "9c877c9d-e252-4ead-a660-706b9a2356b5", "comment": "Malware payload (Smoke Loader)", "value": "4aff8a032797df5974e6f67b7a5e3384a20e4a89edec267bb689f372388dafae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033411, "uuid": "8335399a-0834-4499-9fef-52206708e57c", "comment": "Malware payload (Smoke Loader)", "value": "3f84aefc653ab2d0c24e2465bdcb755245b1f3b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033411, "uuid": "26bf0d50-d644-4600-a016-90492117ea5b", "comment": "Malware payload (Smoke Loader)", "value": "76aaba30e00d4cb611564f31e01a2b0c5de4a20b80a078f460bf33c9e2ed793384e6cdc8840480958588251d89efe4d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033411, "uuid": "f22c8a18-ad10-4831-bb47-7117ab89dee1", "value": "T10E752396A3E96076DAB4177069FA025306357D96DC38562F268EBD0A09F2390FC3533F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033411, "uuid": "e86e6fa5-69c6-46d2-9cb2-c5924d9eab82", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033411, "uuid": "4c2e7cd2-8af9-46e7-a627-64500a648812", "value": "24576:yyZTR1YeYDgwFpEpf/WpMePgSqAlmV+cwf6sIfOIhFcW/uC:ZxtYDgwFq1e5PgzG4+cYVIWIhFcW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698033411, "uuid": "d491c164-2aa8-40f0-9846-2300a88f5162", "value": 1591296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698033411, "uuid": "4f4f7a8b-3832-4e33-883e-bf23523ae8b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033411, "uuid": "23b7838c-0037-4102-b669-5fd54c4b5453", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66697fb2-7178-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1698047242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047242, "uuid": "f49a0c7c-5b3d-4114-b95a-6e5c571d5a28", "comment": "Malware payload (DBatLoader)", "value": "366030c1bd7e8fc1aa8c5bb3e2248a25", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047242, "uuid": "9f3eeb8c-27fd-4d07-9e35-1e35f78cb26a", "comment": "Malware payload (DBatLoader)", "value": "4b45c80c13d9143811cacdda64ac2e4cab04fe6262e16cb813836fd244ff5b9c", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047242, "uuid": "0a68d28d-8218-43e9-b8dc-8b0b1d262b2c", "comment": "Malware payload (DBatLoader)", "value": "081fddbf62f8291b416905fc8057c0198ca4ba0f", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047242, "uuid": "6032156a-a59c-4d64-9cda-f00d800c450b", "comment": "Malware payload (DBatLoader)", "value": "61d7b55bded4b46517fec9dd7141977aeaf7da6db61ca62f89affda9fa4ca9ae5b92fc62885fc31e0d70782e23ca49ad", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047242, "uuid": "b94f5118-898b-42b3-8fa8-50c0e737b340", "value": "T116459E22BED29C32C4F3493C9F47EFB9AC1D39F5192465A9BED9294C4E713403D6818A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047242, "uuid": "4255a0f8-25fb-4bfa-8614-46a4a269ef42", "value": "4df0e13d93cb581937cac481e3c87c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047242, "uuid": "f7354259-0555-4cc5-8564-08dcaac9018e", "value": "24576:qeA4Puy3YeOyFbcA3l0xdapY2bwplPYlLQZlo/:q5cZ3BmdaG26TE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047242, "uuid": "05f03bfd-6a95-48ae-8311-86c24a054f8d", "value": 1262592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047242, "uuid": "4920ba05-d1d2-44bb-b972-80ba258b30fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047242, "uuid": "013f147d-1c3e-4aca-9082-9922b23709c1", "value": "RFQ 080323(MECH)NBI OCTOBER-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5a4f24-7197-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698060487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060487, "uuid": "fb87786a-762c-407e-bf5f-8f923c4f3323", "comment": "Malware payload (AgentTesla)", "value": "7938d5d2a40adfcda64c8d5e570082bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060487, "uuid": "62d56afb-cf4f-4573-9867-5b8b757789be", "comment": "Malware payload (AgentTesla)", "value": "4bc7979e8e63f880e9f4d7be6e59e55c059f5de3377837fcac7d167e3d4fc19f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060487, "uuid": "32ef914e-14d9-4cb6-bec8-75a9812252c8", "comment": "Malware payload (AgentTesla)", "value": "66c45c9d9896908d5ea2b4a1725b1366b0a7d045", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060487, "uuid": "576cb0b9-a7a1-4a49-b2e0-989aff7cc321", "comment": "Malware payload (AgentTesla)", "value": "945f80c0550a8f8733b7ce5a208533690c23853557bec58b046537299fed03735cc9cce22ec56b7cc1d496cc934b9f64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060487, "uuid": "54083825-2819-4516-a8ab-21e5cb3d4e20", "value": "T10B85124936749032DE14CA7910E29E15C6F3ADA82BE1D21F29D4BAAD1F326FD4F035C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060487, "uuid": "2e11e520-14df-4045-b054-fe56ca240af9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060487, "uuid": "1af820b5-d87c-4aca-ac4c-8d00fe212c0c", "value": "24576:YahZEDPxrXXM3Z/QVhCO+KL5LueozFgmxnadvtlrN0i38pOnqjH57HIoSz7713Uw:QDpXXe+Vh5NSe0zxnkV0BpOqjZ7ez78y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060487, "uuid": "352d4619-c18f-47a1-958b-9670bb6753b8", "value": 1808624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060487, "uuid": "9007f89c-cbad-417e-a3fb-29be4b46d173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060487, "uuid": "f50c7515-407a-4a5c-9b20-66059d8c04c9", "value": "ORDER LIST_OCTQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96f9dbe-7193-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698059004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059004, "uuid": "b776da1a-99a7-4214-bb68-3e5dd5f35681", "comment": "Malware payload (AgentTesla)", "value": "3506c76cdfe9d9107e1292b7112a1438", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059004, "uuid": "97891705-96d7-46cc-8ca3-9d351f646f37", "comment": "Malware payload (AgentTesla)", "value": "4d46918f59e97db3b29855954a4988d36a84978872b68748b0dc9ee1b8e0464f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059004, "uuid": "df6d70df-5241-4d58-bb01-93d46d3c0a5b", "comment": "Malware payload (AgentTesla)", "value": "83e1095f2fb51e38d368052d8862f749f438201d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059004, "uuid": "63fd7832-09c3-4971-a23e-5fd634665e70", "comment": "Malware payload (AgentTesla)", "value": "b3767b3926eb7aab6021e8075df5b259c8ccffe65edb16e1fe93b54a50ee4b17b8c790247d458ef20d656a1566a2e140", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059004, "uuid": "2ace7a1d-0708-463d-b979-b6cc0e94d213", "value": "T1F4D423AD17003ED1F8B42D373E255FD7A5402D5E572B7AA5A3CDC6DB8C130BA0EA8980", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059004, "uuid": "c9c232e3-03e6-4f1b-9d3a-8812c15cdffa", "value": "12288:z0MZmJfOFzwUpucBjul4nHffhP8GEL1e6vqGqO66QgKP96wE51PrW:z0WcSbny4Hffx8GjQqcVkPkwkPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698059004, "uuid": "015c1282-94bc-4600-8d5c-c454c50c64f9", "value": 609905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698059004, "uuid": "7d99a490-16fb-4aa7-b650-086543705088", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059004, "uuid": "6930172a-2973-4554-9d71-1a865854a000", "value": "New Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b604da1-718b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698055491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055491, "uuid": "4e77ecab-4906-4a67-be4e-ab2bcd665a82", "comment": "Malware payload (AgentTesla)", "value": "4ee983f38680508448960f58c33914ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055491, "uuid": "9f2bf675-762d-4ee5-b3e5-f60ecfa28541", "comment": "Malware payload (AgentTesla)", "value": "4d4b2b31829b54d3bd07e43acf905e6dab9b872948a4e6df5509549089a99823", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055491, "uuid": "e2bac08d-6c8d-462f-a566-ccaf5b9c7da3", "comment": "Malware payload (AgentTesla)", "value": "89b57dcff582300a0db3aa0d8ef8993eed6b603d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055491, "uuid": "33ca362b-d91d-4c0e-8ab2-c750f39f57c7", "comment": "Malware payload (AgentTesla)", "value": "3f9d9dc0d535b073dcfcf644282e9c7da6570d315151f6754b1b8c9eed672ec8a6bf5d3ba60472c69dc597810a3ef041", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055491, "uuid": "d9eac457-ec65-4e04-926b-e23f1531b6e4", "value": "T18715287C11299A8CF3A482BEB1724CFF57963C1F80B7B5F7A12CB4970EA97D21402661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055491, "uuid": "41081804-b28c-4541-932c-155aa8d795a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055491, "uuid": "2691c916-4515-4051-8d64-0d3370235978", "value": "12288:PVX9K7fZM/O6SVVU3LyBcl96VLowgZIdDFIy75s1dtqbPFvtpEL:PVtUyNk8GPVkwgZIdDhqdiFvtpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698055491, "uuid": "82c25766-85e8-40ee-99db-92c2a1b9f513", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698055491, "uuid": "445d59ae-982e-4fcc-9410-c39f22dc3934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055491, "uuid": "2a12aa50-cc2b-42fe-b707-6b4f77a0b27d", "value": "swift_876423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9488565-717f-11ee-8907-42010a9c0042", "comment": "Malware payload (Phobos)", "timestamp": 1698050387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050387, "uuid": "e0d132e1-942b-47a5-b113-1d901ba17641", "comment": "Malware payload (Phobos)", "value": "5322dc793dc514fd4a82d96388aaaf02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050387, "uuid": "bebbdf0d-99da-4af9-8616-29884995f2b9", "comment": "Malware payload (Phobos)", "value": "4e4c154f0500990e897ca9650eafd3c6255ba4df3b4bc620c6ba27b718278392", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050387, "uuid": "13b1fb46-7e53-4ca7-b883-9d6f647f0b93", "comment": "Malware payload (Phobos)", "value": "b003d8ee93a36a453b337d17069ae1f779917800", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050387, "uuid": "67609123-7781-4a36-98ed-2ba65d96dd49", "comment": "Malware payload (Phobos)", "value": "1be2d1658fdf71bdc7ebf4a1494da14b2105c25f858ca093988f445b50504d80570c3330dba0d8245a6f9684dbd621da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050387, "uuid": "b202c765-a015-46a8-9464-f1d804682d73", "value": "T13B456A495F4ADA13CE5442709067C6F72A49DE8F9606E3335BEDBDB3308738856883E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050387, "uuid": "9a7de1a1-74d0-4965-9902-e4bcc92f9a7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050387, "uuid": "c9bba738-d591-48be-aaee-354673a40204", "value": "24576:5HOlaHILUR9X/oGhmE5EApGfZAuBQfm+t:Mywk53mE5EA8fZ52++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698050387, "uuid": "c142d15e-2919-4edd-a693-2bedab74620c", "value": 1199104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698050387, "uuid": "a88ba7a7-8c4d-4dfe-81aa-5cd0890e60e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050387, "uuid": "ca010e06-992a-4370-9118-b09298f2a53e", "value": "5322dc793dc514fd4a82d96388aaaf02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fed788-71fb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698103509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103509, "uuid": "4c3d6aee-b93c-4768-aec3-92d40e977768", "comment": "Malware payload", "value": "c56105126a596ecadcd1dc16e135934b", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103509, "uuid": "7693f3bc-69bc-4d0e-9d8c-3f42ac106fa0", "comment": "Malware payload", "value": "4ee429af6b21b65e4f0a876053deb8370c9cf505081f1b14aa4c92b4dc2ecb83", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103509, "uuid": "4ba27e88-002e-4320-bc50-c7fd674dd60b", "comment": "Malware payload", "value": "7a38b2cdaed737c3efb86f9539aaeb660940bc26", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103509, "uuid": "d89213ad-76a9-4285-9632-5262e70f30f1", "comment": "Malware payload", "value": "c4f460f442c70e71e3f1fb915718c0b87407d5e202beae2e2d70dd496398e2c37c2d11354ad7f82b2f72216fc55a84a0", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103509, "uuid": "87236f89-4066-424d-9cd8-6fcdb2107cff", "value": "T16F33333E1DA6403BAEB6DA11D9D464B7F756625B360E6C1920C3834609E3943FBC13AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103509, "uuid": "8abb1663-1a1f-439b-8c7f-cdfa81836b92", "value": "768:ESRvSRGSRejSRwSR+SRtrSReaSRezSRiSRed9SRK:TMrxpTLGuJP6AY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698103509, "uuid": "cd8cc828-da95-4411-a4e6-b577b50fcf1a", "value": 54642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698103509, "uuid": "f5df2be0-883a-4bc2-bd77-2859e0c4f46d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103509, "uuid": "decf0047-1430-4ce0-9ec3-825cfd47cf19", "value": "rhbi-t.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ec6b03-7177-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698046647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046647, "uuid": "9a5cff1e-23f5-44e1-a498-e9d57de1958e", "comment": "Malware payload (RedLineStealer)", "value": "f97b5b1d1c79eff67f69c66cf9507595", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046647, "uuid": "70acc1db-f876-4a56-80ff-a6108fbcb0e6", "comment": "Malware payload (RedLineStealer)", "value": "5066186c53f71a9bfddbcba3813e209f31a42a2b92d93a2b1dcf0599ef98f357", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046647, "uuid": "143d9589-2538-435c-9b18-cbf7db6b66b4", "comment": "Malware payload (RedLineStealer)", "value": "8e273f19a325eaaae977e54c6459869a80129e73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046647, "uuid": "3ee69278-d234-4b28-ade2-57b62b92405a", "comment": "Malware payload (RedLineStealer)", "value": "312ecd33633205e4901130a4a6141c3e063084e35f62df8c603c84cf963decfd1117d7efd6953a549cdb029aa9274bed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046647, "uuid": "2d2c025e-a845-428d-bc7b-817aa160cb9a", "value": "T172B48DAEF5D0F831C077C572C81F6B28D4939E788B0617E77EA1C56C16982E2BA764C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046647, "uuid": "a51f26aa-710a-4944-b01e-7b4945893298", "value": "d52ccff4f325ce6b295038c3a3f9150f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046647, "uuid": "f78c4991-95f4-4841-8841-3f0d9e96ec7d", "value": "6144:sn2Qrsb2mB2/vpUOXia60CoOO5R2ZnxQdLTJFb246eQB8ApxQNh:o2QnmivpUOXia60C3O5R2sdLu4uBPSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698046647, "uuid": "ae7d1090-4e26-4810-9dcf-01de2c257c8e", "value": 509512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698046647, "uuid": "fdd4a4f1-60b8-4b14-aa3b-62cd2e55bd36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046647, "uuid": "a4b0631e-897b-40c2-8d95-db9630c56bcd", "value": "SecuriteInfo.com.Win32.PWSX-gen.7305.5615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7ba097-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (PredatorStealer)", "timestamp": 1698057535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057535, "uuid": "dc23d3fd-d6b3-4767-a931-dfe7fc9a4d85", "comment": "Malware payload (PredatorStealer)", "value": "2e450823db1430464efb84f8074cc84f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PredatorStealer", "colour": "#904552", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057535, "uuid": "ffbd2760-71b1-4558-9073-d52ad6d13978", "comment": "Malware payload (PredatorStealer)", "value": "50e8e741266264cb161b567f8dbcd65bf8cdcfea296c9807dc00a9cae853b8fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PredatorStealer", "colour": "#904552", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057535, "uuid": "4fc7967a-2444-4051-a334-fb9918e02e5a", "comment": "Malware payload (PredatorStealer)", "value": "88c86734e5de9f22154ca8c55cd141b2068e922f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PredatorStealer", "colour": "#904552", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057535, "uuid": "3043fd95-1bde-446f-87a2-7688d87f1a56", "comment": "Malware payload (PredatorStealer)", "value": "51f0a11942bb041d4488d2ff67182bff17b0051e7a1f6494eaa4b16d9891e9fe7c90f454716147a84ba4724ac7479b75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PredatorStealer", "colour": "#904552", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057535, "uuid": "9b11eaf9-b036-47d2-8f8c-9ba7557f06bf", "value": "T1DB152302B76D83B7C53709F95A1960A70BF01741381DEEEACCA660F93E83B62C5C6957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057535, "uuid": "110f393c-2468-4a1c-97be-7879ae49cd1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057535, "uuid": "11c165e7-a21a-47af-aa60-9d9541e978bf", "value": "24576:UpCvo/Sfhf/+5SxYn89JnMKFpn/9IUI7ighRKA2E4jKk:iX2f/LxYnonMKHn/9K71hRjrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057535, "uuid": "dddc5d6d-329c-4393-af14-84a56f2bd022", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057535, "uuid": "a53ba56e-2932-4878-8836-f6a14eddb6c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057535, "uuid": "997dc154-dfb3-4d53-9e8f-4c33ed6b1f12", "value": "DRMS Tender No. P500-2023-102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e64b69-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042731, "uuid": "394e60c0-2927-4c98-b005-6795387b8d41", "comment": "Malware payload", "value": "5600d23eabe8fce9fd036d27e918a82d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042731, "uuid": "709268f4-0cab-47cc-b53b-ed200abf3e60", "comment": "Malware payload", "value": "514d95a1eae490596306d99ada1e5249f793eff6f66248729845651f257ae46e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042731, "uuid": "ce38b990-d002-44de-a7df-4f04e831c9c9", "comment": "Malware payload", "value": "b8b2c6d3156251f7799ba365f6281877c1fc3253", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042731, "uuid": "4a15263e-9dff-4ccb-a9e7-11caa43bed78", "comment": "Malware payload", "value": "17401e1d59017fd6c399028a6ddf65299393ccf187e668f8bb34913453edc58290af9150bf5527e82fa02b12ea349c49", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042731, "uuid": "0ae99bd1-fd67-4761-b75c-db6d03dba806", "value": "T15E16F113F65284F0E22D227215765B3C797A63164D318F63EF90DDA92D32A31EA3362D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042731, "uuid": "992bc4d5-81e2-429a-8e23-21a05e95fd4b", "value": "0db1824b4ecf78a76ad78a999b1713ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042731, "uuid": "c1b405d6-d7b4-4f42-940e-23c48e9f18b5", "value": "49152:ubl0NCge5/sRpLahDMX48R9diXKgpd6tdpEpOTNUj92nTQy6WREJoFPPIoTcJUR:vYge5kpLo+48/deKcktQpd2MqTTUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042731, "uuid": "6c089536-d8a5-42f5-a34b-cb7fa77dda72", "value": 4178559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042731, "uuid": "e7e88c76-05e2-4b3b-9368-ed80f88a254c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042731, "uuid": "4a0d5930-f032-4171-b5ad-15a56a6ba724", "value": "SecuriteInfo.com.Win32.Trojan.Kryptik.HK@susp.32544.32464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a63d66-71b2-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1698072017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698072017, "uuid": "5792f6e7-3ebe-4951-aea2-92b34d08b288", "comment": "Malware payload (LummaStealer)", "value": "d6467d0080480bcde6f487d27cc633ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698072017, "uuid": "fbea2587-5d27-4e1b-b085-ac0332885897", "comment": "Malware payload (LummaStealer)", "value": "5166ceab3f686fb1b3ea8291429cc9b86fb42041108c08ab2237d7fd3877fe19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698072017, "uuid": "e437a2e9-48bb-4f23-9656-bc064f547e47", "comment": "Malware payload (LummaStealer)", "value": "723f15c38e63b090716d209adcbd5bb1d1e4855c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698072017, "uuid": "5431dae8-bd2c-4b56-9b00-3e0607d9b74c", "comment": "Malware payload (LummaStealer)", "value": "a8956e9db5d0f83c1d53baa4a3293953bfd6b0506c275e1147ef6630d76ae34f749294c2a1c0f17fa06243753ed5515f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698072017, "uuid": "770cf86e-959a-4daf-860d-1d16226a3c00", "value": "T19A752302ABF604F6DCB527305DFE234316367C52AA664227175ADA9A0DF38A0D93173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698072017, "uuid": "e561d0ea-701b-415b-a2eb-034149b0958c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698072017, "uuid": "9c32406b-6b75-4181-aeba-96bf9b278b90", "value": "24576:ryfY8ZJBEF2K4wysW5beXsU9XRAxyg9uVW+zhVS2oy2/to28nSCm:efgusWlqXRnGuVW4hVsyxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698072017, "uuid": "d0e59d1a-2933-49eb-9b2e-82c7a8bbf17b", "value": 1581056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698072017, "uuid": "44b8f7f1-4e43-4325-99dd-accda8dda613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698072017, "uuid": "0fd465e2-4084-4aac-939e-5faa5daf3b42", "value": "d6467d0080480bcde6f487d27cc633ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae42dd2b-71ea-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698096325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698096325, "uuid": "6d0849f5-acfe-446e-a250-45c0241eb78f", "comment": "Malware payload (Amadey)", "value": "ab88e0666ec1c855661c0e275973aa8b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698096325, "uuid": "95670aa6-8547-4247-9901-ee0d2d31a5d6", "comment": "Malware payload (Amadey)", "value": "5191e03edc83597065e88405942aef9096a69a0582f04fabae88dc1cd88cede5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698096325, "uuid": "d9d7f411-249a-4f09-9a5c-8ba1d62a5c91", "comment": "Malware payload (Amadey)", "value": "f566fd6f70e1bb5f83e8ad0efb94a6ba2c1d38fb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698096325, "uuid": "ae83bc79-6315-4270-9340-62e7d355a876", "comment": "Malware payload (Amadey)", "value": "ab6501c28f5ff955662fdebe6012935402d20aad250cc00b02cc767bba57e66c4741aa92329bdd36ae34c705ec6a3009", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698096325, "uuid": "b5f53a18-b04c-48b9-9654-183703b82312", "value": "T100752363EFE8046AD8F617B14CF943634F32BD62A875938E63918A0B5833B516231777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698096325, "uuid": "13778a6b-4756-4116-b20f-e6f972ca794a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698096325, "uuid": "823550d2-c71e-408b-aa83-40391d5a1485", "value": "49152:cmfiNuMhvOXvTc4yZfT4yHuqucxjFbOa9+jB:ukskw4Mf5NuMZ6Xd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698096325, "uuid": "3b854cff-d0eb-40ce-bd57-8d790c0df1d0", "value": 1582080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698096325, "uuid": "a81befe4-1612-40e4-892e-8d5411d497ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698096325, "uuid": "e78868f6-05b2-40d8-9f69-5a59574a78a8", "value": "ab88e0666ec1c855661c0e275973aa8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df272325-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042720, "uuid": "4ef1c3e3-4f17-4ae1-a817-932c36bbd42c", "comment": "Malware payload", "value": "0949b4c40e0bc27d3d6cd54e709b9771", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042720, "uuid": "88414e7f-b0a6-498c-9cc9-efb019d416c9", "comment": "Malware payload", "value": "5241b7988deede1cacd5b204feeaf4caefa71767f846d5c634123bec2fbaf97f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042720, "uuid": "d32c5aba-1bea-41e6-8767-d5df7118861d", "comment": "Malware payload", "value": "b4723ddb2e6b43bbd44cccca14833627c0189aa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042720, "uuid": "7f4197e0-a799-4019-9840-a53f883e9bae", "comment": "Malware payload", "value": "fc6f6812543bd74b3a7ff8d73452e86d29a931cb1579b09908070eebfeaf56ae03821c2d5f55770e42e2a5e42a4e1f46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042720, "uuid": "47078793-57cb-44f2-b51a-336a009b80d0", "value": "T1773512577E41E464EC2A69398C57FC9C8920FD18EA4BC68A3782FF0D7BB3F241A51449", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042720, "uuid": "9304ce8c-9c27-44e4-b204-e77cac2d72e2", "value": "1a5d94f944fb41898e4206d5f3c70ec4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042720, "uuid": "2f0cca5d-bfc2-426c-877f-934fee9b29ef", "value": "24576:aa5I7A4jlaHvCyLJcYL6ZoWzwmTeQ0XlmNfP4jrc:aa5Ik4jZ2GjiWzwmYXlmJsrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042720, "uuid": "e73ce3a3-9629-4d0d-86df-ef28202e3a8c", "value": 1070680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042720, "uuid": "11392d29-f3cb-47ee-bd8b-1e45116dc049", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042720, "uuid": "f315fe98-75ee-4a69-97c4-849c6b227c18", "value": "SecuriteInfo.com.Trojan.MulDrop6.38104.20346.24404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8048a511-71a6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698067042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067042, "uuid": "5fcb9822-3363-4a15-9a04-f62772959d60", "comment": "Malware payload (AgentTesla)", "value": "383a4421c10382e8d3eeb807dd641e37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067042, "uuid": "752d43f8-3929-45af-9831-ede659946889", "comment": "Malware payload (AgentTesla)", "value": "52adf0eb111ee83ddb7481220a76a9e0726141d80d5b079261053c974b10ac83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067042, "uuid": "61cef468-1887-42b8-bce2-d4a3f8c155b5", "comment": "Malware payload (AgentTesla)", "value": "6e34a4c5b3f725cbe900681fb80bb20e1cc9172e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067042, "uuid": "00acbb84-184f-4b27-bd5e-187914362efd", "comment": "Malware payload (AgentTesla)", "value": "7c959601fb57a0b968fe9e9f501c27f177d624cd4cf3adafed5d0a1bf253601db0fcc16557b0b4f60c46fd80aa344b5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067042, "uuid": "e930f50a-4390-44ec-b1d6-39f64cca8cb6", "value": "T1AC25334D7E250C9440B8A17D643A3F0D5AA3DFE0846DE19B4394F2F6D23DB84569F8AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067042, "uuid": "d001b6ef-33ae-4a39-9e27-09ca59d51150", "value": "24576:yJJ4qmTiej2V3+sbJzH6otACr4Qt9Dfg2DYGAukAE97:V2dtxaoyli86Zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698067042, "uuid": "48b9c7d8-1116-4f78-a440-6c26e5a91ca5", "value": 1041093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698067042, "uuid": "73d80f21-c439-4f2a-9462-306abfa4881f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067042, "uuid": "d328a9da-5143-46ea-9b6c-41f78d0faab7", "value": "DOCUMENTS.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0115d4ab-71a0-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1698064252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698064252, "uuid": "af3f6360-f650-427e-bd99-c20fe4afa2f1", "comment": "Malware payload (LummaStealer)", "value": "5b430ee39ff0a6c3fdc187f7d36b0c50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698064252, "uuid": "70095105-498d-4120-a3a3-19999588e6c9", "comment": "Malware payload (LummaStealer)", "value": "539f99fb1e68a82bc04d5b7e27d37e6ea420e1a6c8cd03b5d2a6943dfde2c8da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698064252, "uuid": "76230daa-89ae-44fb-ac6a-24360b32e7b7", "comment": "Malware payload (LummaStealer)", "value": "b2ce6320b9ca40cb2fe40dc245e09e3f3fd25ac2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698064252, "uuid": "270ee3e3-b9fb-4d4c-9489-81e9f5f138e4", "comment": "Malware payload (LummaStealer)", "value": "acc6a5110080bdd5bad8185143346c4a4f24d8c3d95c6e8264c8acc8f719420038b8cc66140e531c95867b928f315c04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698064252, "uuid": "ea9e0663-d6ed-45ed-892c-028208d8b6d1", "value": "T1C9448E13A2D2FCA0D91646718D2DF7E83A2EB9718E59EA5733187F1F18B01A1D2633D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698064252, "uuid": "25d8e33b-4a3d-49b3-9212-fc40ef943a98", "value": "780437e8c81fd22a5669fb9201842564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698064252, "uuid": "264de66d-4700-4bd6-9fc1-71714029ae54", "value": "3072:SwXYqSbgdLFCOg1i7vkT8t0Q8XpfdO6rUgvIX3C5rqls7x5kLwGfrA:/xSbgdLgZ1io46Q8XpZriXS55c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698064252, "uuid": "86428b58-3a57-49a9-9b90-1794db13aadb", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698064252, "uuid": "6b6c9ee4-e6e3-4e02-933b-829dbae52143", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698064252, "uuid": "3b9372d1-4026-41ea-8afa-7169e6d6c73a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7007ac6-71ec-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698097225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698097225, "uuid": "7c9f00d5-8668-4c87-8646-acfd82f10a0c", "comment": "Malware payload (Smoke Loader)", "value": "eb6fffc4f1fc4c7ad2f2887d86f4f1fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698097225, "uuid": "3cec7a0a-b903-4afc-b7b4-16d12f9419cf", "comment": "Malware payload (Smoke Loader)", "value": "5447ba93991d4360f85ed4c00e5d366f4c0d97f2a95b9e8b322e72d47c9035dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698097225, "uuid": "c9c16149-a666-4785-bd26-321563025e52", "comment": "Malware payload (Smoke Loader)", "value": "e461a5bddbcbbe525127d249ac604f1deb94a3e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698097225, "uuid": "a4dcfe35-4742-46a8-b5d6-9f82c22bca18", "comment": "Malware payload (Smoke Loader)", "value": "2af7cac901b4717e8873acd5e0ab86ee0630debcc6780ff1b3075357c71327ea93ad7cbac9ee731b67ca5e0a7eccf4a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698097225, "uuid": "c55d13ca-6d76-4cb9-b9ac-fdb28d621d7a", "value": "T1E3448D02A692FCE0E91745798D29D6EC3A2EF8606F59EE5B23187F6F1470173D263213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698097225, "uuid": "f2603cc5-800e-4040-876b-0933f7bc640a", "value": "8476da44cd20575d5795ed699abb22f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698097225, "uuid": "e2cadf5e-11b7-44fc-b03b-faf315400c31", "value": "3072:zwXfqGkBJLRiOuv2sdZ6regoOWUwOc2ZEDGKaDYzwjgAw/y34xSa5dvrB7Sj:QbkBJLsbvRlgoOWUw/6KaDYz//vjjBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698097225, "uuid": "cf6073fc-0837-449a-a132-032728b00c2e", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698097225, "uuid": "55e4bf6f-2f61-4ec1-91cc-8eea6a8d8158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698097225, "uuid": "301a7c5c-19c5-448a-84f2-4ffae97a8e4c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4dba26-7186-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698053322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053322, "uuid": "c78e5a6a-e21c-43d4-a8d0-07f32554f086", "comment": "Malware payload (AgentTesla)", "value": "4436f6ac8d34472eaec8927708803284", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053322, "uuid": "ff554bcc-8ef1-4ec1-bbfe-37df48eb45ce", "comment": "Malware payload (AgentTesla)", "value": "54db17ade0a2cbc7da9c766c46a96e9a1277870871ee30242df236b02338bd18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053322, "uuid": "1b13cca1-150a-4693-8bea-8814fa901c00", "comment": "Malware payload (AgentTesla)", "value": "d073005d62c95c26a5d598633ef42bd3529f827b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053322, "uuid": "94088fdb-070f-41ff-95c0-a157ebb3c793", "comment": "Malware payload (AgentTesla)", "value": "1ee7bb8d613f4bc98e38f46c860d6b0b83b8cb498b9e1f8551aa14572e1343c2ab6b5f56bd67029fb70e8a0ff74f6099", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053322, "uuid": "c5ec2347-d20a-4cda-aa18-05ab0a812e53", "value": "T10202AEB68F5CA85DD2526DFB7BAF30D5E5E3C581DB009E2001F712293B332B64BA4045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053322, "uuid": "e9d8ac39-cfa2-49d8-b88b-7f5880554769", "value": "96:2yrEDghO7Q+7fQcLnH630xrsyNEnqzO0XEr496T9qtr7aqhYiLyvnCJT7JPVRmkU:ZLoQ+zQ2PKcIgFLyCJvZ732/d4IQMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698053322, "uuid": "efee2420-d229-43d4-9820-60a2b03dfa52", "value": 8271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698053322, "uuid": "8d0e2c9f-d932-4f75-a00d-5e43e935ad85", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053322, "uuid": "d206f02b-b7a5-4086-91b9-66b994c3f6fc", "value": "SOA UPDATED SEPT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a78096-7156-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698032641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032641, "uuid": "91ad5d50-43d3-4f0e-8fa0-eff8854f2b0d", "comment": "Malware payload (AgentTesla)", "value": "b6d5ed7a9d2451d126be1898c769e5d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032641, "uuid": "2617f4de-6f53-4a6d-a560-c9468d5768a5", "comment": "Malware payload (AgentTesla)", "value": "5596b857c000607a2a2d05b7e3e77f10ba29fb71ec578a5b3b4465eed069bd9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032641, "uuid": "100056e9-37b9-42fb-b0dd-62b7c23dcb31", "comment": "Malware payload (AgentTesla)", "value": "e122da85fc12cb206ca73b5f145f5c38b656031f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032641, "uuid": "15c4ead5-747e-4835-b218-80b9833679cc", "comment": "Malware payload (AgentTesla)", "value": "c79506acf258b07fca48429b64f574fd4ba412a0b90e5e397a1303d84ea13ee528da84aca0878f1e1b87f4702e180f0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698032641, "uuid": "984a05d4-e8a0-40bb-93ac-75acf4d008ed", "value": "T1B7F40A322AEFA00C3161BE539BD8BD9E8E5FF7D15B2964DE6024634B4701E46CE94732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698032641, "uuid": "6d598009-81ba-4ee5-94dc-1431805f206d", "value": "3072:KyMrLqdNVoCzPrwJbMvYFBaHqpsPGvEBz+:KyALqdNVoCz0bjLeqaGvCz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698032641, "uuid": "bae7b6bd-165d-4bc8-b124-e88257a067b1", "value": 744658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698032641, "uuid": "74421d52-34cc-40f6-af82-4a825d793eba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698032641, "uuid": "45a66434-b44c-468e-9566-b8d7cbffbb70", "value": "0d5f0a253bb658eb5b976745ea2a1715cd0b99103d2194bd69ccca3f.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b56afa6-71e6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698094414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698094414, "uuid": "8ecd0461-4a85-49ae-8882-eb47abfb8072", "comment": "Malware payload", "value": "f90e30df61aec134fba71d66a87326c1", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698094414, "uuid": "63baa8f2-64f8-4610-bb81-b1f6447dd542", "comment": "Malware payload", "value": "567d828dab1022eda84f90592d6d95e331e0f2696e79ed7d86ddc095bb2efdc8", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698094414, "uuid": "bf6a1ac4-b6e7-4d47-8cb2-ef288350978a", "comment": "Malware payload", "value": "593efb526ecc12d7020c35645cce6ad3a1774e6a", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698094414, "uuid": "99ddb68d-cb0d-4a52-a701-799f77f64aa7", "comment": "Malware payload", "value": "d68229df140453204ac5e793c9ab8a2263452b3c943a338c11c1cc3b9903ceb78a539d3d9fd298755f3a03e7699eeb2c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698094414, "uuid": "48429eef-b10e-4fd7-8603-0ee20737b25a", "value": "T13AA633317994853AE68E0132D2F6CB246A39ED641B10D0CF7F94B6FC99703E27939366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698094414, "uuid": "35e70c45-e272-4e2c-a8f1-323f385da411", "value": "196608:BhbWzPMCeNrs0rczeuNr/QnMOsaB9QVuHSzdUupBqbHSDjs6cvUOzZx:XbWzPM5HCZNrgMVw6wyZUupkjSPcvXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698094414, "uuid": "66591a05-902e-4858-8a36-212aa619361f", "value": 9510912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698094414, "uuid": "15cc0ab0-0f99-4db6-b7c0-caf8f7398bd0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698094414, "uuid": "c40cba12-132a-452b-ac19-66d8a5735a51", "value": "c7f6d2a32838360c58b450ae3e45ccc7f22feda329d205e31eaa15e6.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a912f2b5-7197-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698060668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060668, "uuid": "7e454ad2-d84b-495c-bc67-a5d5333c6f16", "comment": "Malware payload (AgentTesla)", "value": "42da70e65c9ee6223e5a15c32961965b", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060668, "uuid": "e0fc3ca5-5aac-452e-b686-97f372aae609", "comment": "Malware payload (AgentTesla)", "value": "567f3da150eea2e14addc16b8ed53b140b380422741f7ae02f72cafaf3d99d0d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060668, "uuid": "a3206bef-dbcd-4033-b67f-7f720d5f42ab", "comment": "Malware payload (AgentTesla)", "value": "546f753032a8c17a23da79c0be778bfa96d524bd", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060668, "uuid": "97ec1b86-b403-4bc1-b3f0-242aeadfc82b", "comment": "Malware payload (AgentTesla)", "value": "44586fd97e9af9c01803692fcfbdea7463b944ed74893c5553b094d4e4c1500f1c153e3c2978c792ebbc6003b676f84a", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060668, "uuid": "a35ea76d-8a7b-4262-9a8b-927c5d22eb11", "value": "T17FA423E73CE1D41D22CBDE281672D5618A7DB49D2C6FFC311742C41A8AAF9AC1BD2D09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060668, "uuid": "c9fd4b0a-da98-4821-92ea-13c0b5d4009f", "value": "12288:Zdak4bno6yTY9yRsMCsh6JVSqlmrQ1x87Nqk/Q3EjLuP1ZJr:b1Cn99yRsMhcrSq9rc/MEc5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060668, "uuid": "614aafc3-52f3-4b73-adbb-841bd32cd2ff", "value": 489305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060668, "uuid": "fc5d7de4-15a5-4dbc-824b-f498be4e81b3", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060668, "uuid": "fc715857-e27f-45ac-a994-144da4f73d31", "value": "CI.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a557fd50-71a9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698068393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068393, "uuid": "45a4f435-c862-4078-af45-c994e84da973", "comment": "Malware payload (AgentTesla)", "value": "9fd67ceaaea887e72543e752f0efb61d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068393, "uuid": "1d15a847-e82b-4d9b-afac-37a0dbf9ecc2", "comment": "Malware payload (AgentTesla)", "value": "5817b321cb33d25f0b6b94e1b05da048c60cb9a24c1604684d994896a98a254b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068393, "uuid": "30fa5a5c-fe21-4100-80dc-ce1222fd5421", "comment": "Malware payload (AgentTesla)", "value": "76550921a0ec19ae98b316b9b892f7f36e0e1c50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068393, "uuid": "1eb8c90b-919d-4d53-ac49-b0f7753920a7", "comment": "Malware payload (AgentTesla)", "value": "25cf588114f45009af6cf4b660edca08256898984e0e9861141e1f2ed282a4c467fb4ca13b88513de53460c5f272a319", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068393, "uuid": "9880a3bd-522f-41f4-bcaa-2b10060265a4", "value": "T187C433CBD0EF2C96AFBC38887D735A8E06B904A5060A040DDD34478E45D90D7AED9B7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068393, "uuid": "ab9645cf-f9f9-4ca4-bcc1-484aa22ae7a5", "value": "12288:BtidniG9Nnr8aANHupJC9C3uRzSJhFCUhwoi8DhJiy7IJbh:BtE3NmNHupM9IukhBhxi+DiVJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698068393, "uuid": "c6778452-40d2-4e2a-802e-31333a3d3124", "value": 554563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698068393, "uuid": "2822b6b0-d014-4bcb-b2af-a8803e94b2c1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068393, "uuid": "76096959-820f-4c2c-adcc-bec465231cfb", "value": "Statement.pdf______________________________________________________________.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1604a6f3-71c9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698081896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081896, "uuid": "8a082ad4-33d6-4f95-a1fc-f66ba98b8657", "comment": "Malware payload", "value": "62a52efd18598cd9cd0c0ea56dc3b9f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081896, "uuid": "457633b4-319a-45b0-bdef-833499301d6c", "comment": "Malware payload", "value": "582cf4bb7c3f703cb6bbacd2bfa8a1d2f098ca11e0d0fddb8c1d8e812ddc2d69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081896, "uuid": "c6e9d8df-0945-4966-87b4-07891b86e2da", "comment": "Malware payload", "value": "3901c4f4846075ed8be78d608b7f4d3be4846f0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081896, "uuid": "82572e8e-0ce5-433f-a1ba-2982c6e42259", "comment": "Malware payload", "value": "43b9e68b03436bc0fb2263272062d3dd41ec89b80c7944e5dd58b97cb4458d42b417f583dd6e3c997f26b1d635f7fa25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081896, "uuid": "72e937fe-090a-47c4-964c-fc9f9371181e", "value": "T19625AF66E2920537D073D634AD0BD37A6B257E20263C788E6BE87C1C9F396463C16367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081896, "uuid": "bc43f326-4b80-4c12-895e-d7a0ff729160", "value": "003d3d12d28525a81de6bbbfc27b008c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081896, "uuid": "a0458f46-973f-4c79-a5af-bb878df969eb", "value": "24576:PKEbMgZ1x1BaPhO/TvtcY6Rs7bvteS+BfKZ5puZP:iEogpU6T+Yoo5puZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698081896, "uuid": "d0610fd0-ba00-40d1-9c4c-d38fed4d8556", "value": 1010688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698081896, "uuid": "c1491361-25a3-4cc7-820f-19b274a68562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081896, "uuid": "487c2d50-23c9-4034-b90d-b505c9075869", "value": "Telex Release Confirmation B_L #2722610400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054bd326-717a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698047938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047938, "uuid": "a13070a8-5541-440e-b92f-97797113ec84", "comment": "Malware payload (AgentTesla)", "value": "d735e965bab8be2ffa05d1f4ab939241", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047938, "uuid": "db687981-1183-4d18-a8da-beb295c5bb49", "comment": "Malware payload (AgentTesla)", "value": "58396282b82c310c5a96591909aa395ab5432788928491e5272d731eede5e5c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047938, "uuid": "648a056c-37c8-47c7-9109-667b4e74e3a2", "comment": "Malware payload (AgentTesla)", "value": "156a5fa847a3fa710137ba476c27426f1f3b6021", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047938, "uuid": "d0ca3216-118c-493a-bbfa-325a41519c0a", "comment": "Malware payload (AgentTesla)", "value": "77bf6c1473d3ff6bffa258363f1065ccb9f9eb3ad03e91018988db6f56d423b7edc16a6b5dfed2a54a803a4b808769c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047938, "uuid": "89d5b56e-0e0f-49f2-ac3f-91fc40b5b12b", "value": "T19925221571C1C273C5AB047486DA9B365E7671220BB996D77B8C1FBA6F203F2A3321C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047938, "uuid": "57611af7-1872-4ba5-8a41-3a99a3073a21", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047938, "uuid": "b0591ad8-1a70-4b0d-a423-07b46fb2f955", "value": "24576:zk70TrcIG9PXTYP7Ky42JgHbdz0B0VvjGF:zkQTAThD2AiWjGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047938, "uuid": "f80a0953-6b74-44e5-bc2a-aca68871bdf7", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047938, "uuid": "b32c32dd-8ae2-4cbc-a67c-71151ff6ce3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047938, "uuid": "e43fd6f9-c57b-450d-858d-dee8fa7c68eb", "value": "PLOoM877.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0d017b-71a4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698066065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066065, "uuid": "82ab1c09-971e-4fde-9022-e5923ac207a8", "comment": "Malware payload (AgentTesla)", "value": "f28684d56bbf5afffa5ee0ad6c0240dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066065, "uuid": "96e3f64c-a651-4938-9dc7-5ac375205742", "comment": "Malware payload (AgentTesla)", "value": "586e262a6907044261752f0f8f9a5b418d10620b229d364c251ff20557bd1f3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066065, "uuid": "fa9365ed-f234-419f-9c09-cd3e1745130a", "comment": "Malware payload (AgentTesla)", "value": "33c0829a6edf2664bfeb95bb1d6c657442767205", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066065, "uuid": "547215d1-66e1-4a27-ab42-1f3586c19136", "comment": "Malware payload (AgentTesla)", "value": "4491d2e072f3ed8ca69bf6127a427cdfffb9ddeaf81bf1e63b4d3e381882793524b81d4f147c491786489e8e36b39378", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066065, "uuid": "3f72c8b8-f790-4df6-9635-868a445eaed5", "value": "T118D423ACED01808C0538A4AFA5DAFC39C0C4A12E55E75445D2DF60DB0E25BF54BDBEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066065, "uuid": "bf3cb2a9-5452-4089-9d33-9d91d93f1019", "value": "12288:Yxm5qwAcHX6PAkTw511+QSDHtylyRi1P35meLR7Gbvi8kfVlW0eS5t:YYIwAI6Ip+QEUee3iiJVQ0ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698066065, "uuid": "9cb9677c-0ee4-44da-8085-503cef03fbca", "value": 631518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698066065, "uuid": "91bfe6f0-c536-41bb-a8de-bb4b5d5c42d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066065, "uuid": "3f32d727-479d-476a-ac31-5c292cf5ecdf", "value": "TT application copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d7a37e-7179-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698047529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047529, "uuid": "e88e5271-aac1-48d0-8788-865df30d1f99", "comment": "Malware payload (AgentTesla)", "value": "28e83826bf8fc3082ef9b7db647dbb3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047529, "uuid": "35eeb3c5-1a2b-43ca-9615-ca677e0f02e6", "comment": "Malware payload (AgentTesla)", "value": "590e94620bae0906e448336a19dd18354c27002c697b69d9c60e22aa18c2abc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047529, "uuid": "aacf595b-cc52-417d-baaf-13eef64e4cb6", "comment": "Malware payload (AgentTesla)", "value": "eda5f8e6dafb5dd910082ec68ca8e330dad95a87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047529, "uuid": "625d3e29-18d4-4223-8e83-1c40e6d74f13", "comment": "Malware payload (AgentTesla)", "value": "00b2af07219b8d30cd5c27c9152c49cf961fbd70f7ed465faed893d4e0f2b939897295013e1c49fcbbbb68fac910cdf8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047529, "uuid": "6c4bc7bf-30d3-4cd4-b7be-dcaa24c7b828", "value": "T1BD25E1E4162E3AB4CBA62735C2174F07DF16573B6623899CBCEBBD6A0475C5260C683C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047529, "uuid": "1ba2c352-390f-4576-9182-cd2b4b1e93db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047529, "uuid": "609b1a42-84d9-4778-ae9b-3919e03c360e", "value": "24576:xg/8vcS9eaARdbCK/1W60TxHs0LzjxdnsQ1Q:xK8vcICVNYLzjDp1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047529, "uuid": "35b0afba-02c4-4ca3-8c8d-23030112038e", "value": 977296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047529, "uuid": "98be73a8-d341-46a5-9f73-4f4de118d8c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047529, "uuid": "bca33dec-7f7a-4954-a6f9-c1af6bcc064a", "value": "GUIYUPO231019-2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef7d71d-71a7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698067389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067389, "uuid": "ddacd4f4-6fb7-476b-9ec7-6531ba24a847", "comment": "Malware payload (AgentTesla)", "value": "899f230bcf71d17b8d4b1fe86e29e524", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067389, "uuid": "418caaae-92b6-4e22-a25b-e28f2771b105", "comment": "Malware payload (AgentTesla)", "value": "599b057032b8e99d9d2a303864311b3f715c2c0a94634a39d4ea1c7141e2a90e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067389, "uuid": "d02638c1-5d48-4f80-9edc-7b1b4523ee7c", "comment": "Malware payload (AgentTesla)", "value": "0f7198e53008ea0842b7e3c67f4612398bb63c60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067389, "uuid": "30b03617-ed57-4895-83ab-f47d179076c0", "comment": "Malware payload (AgentTesla)", "value": "f866ad9c3ce56a06daf91ea97951abcea60862540ed9472c00c8c27ae0556c6afd6ce3a2e471259f97083b55b80f1d26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067389, "uuid": "f60412db-5831-41b0-aea6-263145c1af00", "value": "T163535B097B8C9A57C7FC48BEC5E261054BBAD1B32243E357EEC0B1E81953BF94942687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067389, "uuid": "713b699c-2d46-45f5-8eaa-31bce79e33ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067389, "uuid": "9db4b077-d188-413b-a2d6-82dc7e59bc39", "value": "1536:xS+RSO3K6OHjZqXxbeakXo79jzXY/UTpTAY2PX9qSf2d6RyHqNt:xNRSO3qtqBzkXo79jzXY/EGYu9qSud6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698067389, "uuid": "8b62c25b-3296-4f29-8fd0-4551b84a0c3f", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698067389, "uuid": "ed214ea7-a9b2-4dae-bd9a-42de912fdc12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067389, "uuid": "0affbf4a-6e1b-4dbe-8a7d-2698d9bd1398", "value": "EACTS sample product requirement 23rd october 2023 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83f5c95-7190-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698057768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057768, "uuid": "12f2fa77-0aeb-4b0a-8c23-b89f8b000802", "comment": "Malware payload", "value": "7f2fea3b1ee1733766eeb65f9deb4271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057768, "uuid": "aa297a48-5ebc-43a1-9d88-17986f561d65", "comment": "Malware payload", "value": "5c436d3c989254f9dbc916d77ab876b81ad71bd761a14db1853c99bf470fd168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057768, "uuid": "b525255a-fdf1-4af2-b0ae-f2c2bf1094b3", "comment": "Malware payload", "value": "1fd3c4295811a84edec6057c2edf8b9d7752350d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057768, "uuid": "cdfbba32-ece6-4237-b2b3-3833a96cbdb4", "comment": "Malware payload", "value": "f4a2945b0938a346c789ba5e0cc77c96123a128d6b120165494ce4c419f1b8e2b0c14ddf064c2a7e1ece33cfdcbaf3d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057768, "uuid": "c75a7aa1-c1c5-4a1f-972c-ac279a7a4117", "value": "T1D6247346F68492A9CC18A3B07932DA7007167EABED74645E5ADD3E273FB74F20076843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057768, "uuid": "b6634040-d523-4c4e-9169-784a60222945", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057768, "uuid": "4fa2b08e-198c-4a31-83cb-98f3f75faa34", "value": "3072:Yt8fPl67SQzNMbu3zbxSY7KZnS/KzJBLY:YOl67SQzNMbu3zbL7qS/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057768, "uuid": "1e174baf-fbf7-42e6-bb46-4e98de633ba7", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057768, "uuid": "f44fc428-f865-4070-941d-a59d368c4956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057768, "uuid": "e8d06c69-fc16-492a-bcc5-b6277cb54bfd", "value": "INVOICE 2215 & 2248.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dea479a-7173-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698044946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698044946, "uuid": "c885b54e-b331-4df9-bde9-44ae13fdc9da", "comment": "Malware payload (RemcosRAT)", "value": "002b5b4dc69a87e58c8cfd17c3e8a942", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698044946, "uuid": "a2674f99-2cc5-4e14-adbe-449d36ecd6da", "comment": "Malware payload (RemcosRAT)", "value": "5caabf39bc8f07554b249ff09f23b3551644485172384cd1215cfe967582d9ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698044946, "uuid": "ea0369fb-ea73-4f8c-ba26-ca2ae3e50928", "comment": "Malware payload (RemcosRAT)", "value": "d2e27a221356918b75569cd9e36184f7d8880604", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698044946, "uuid": "bc88c853-0aba-4d3d-8656-b405a86c6df3", "comment": "Malware payload (RemcosRAT)", "value": "09723c42dd09483f393de5b8c603c9c89c74b8f011a0be3a59286dcabd3ea005373f824faa7e66fa8b5ef44eb004fe30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698044946, "uuid": "d58f4791-ebb6-49a7-adec-39010df72f5a", "value": "T12B35332BB6A0202BD33635315FFEE1F26EB4E905B5324937DFBD640A3167242960D3A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698044946, "uuid": "755fba66-9495-45f6-9a11-d46a857fadd0", "value": "7192d3773f389d45ebac3cc67d054a8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698044946, "uuid": "537f1b8f-2354-40ad-a517-cad2ce92071c", "value": "24576:w2mvDENPmTMDi/eUPdToG/xpzWEGgsjzAaAbWuUV04e:+vDEpAveUZTzhG3sa+3UO4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698044946, "uuid": "c4c3a14f-3594-4fcc-ab48-01ba08419846", "value": 1068896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698044946, "uuid": "41a690ce-9565-412b-9928-6025d3115e60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698044946, "uuid": "53f91ed8-38f2-4a70-9288-31ad3c556486", "value": "PSID CA 0338-2023-24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cbf3bc7-719d-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698063090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063090, "uuid": "9dddd1a0-bd01-4030-84da-0d124a8f7735", "comment": "Malware payload (Amadey)", "value": "7d57007ab42ab413813181770e3d38f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063090, "uuid": "f3b1c311-1adc-4b8d-b880-f676798c4599", "comment": "Malware payload (Amadey)", "value": "5daa9d2d50d75fe0d91f2330e679aad02de3a841cceec9fcff74a55aa0b835a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063090, "uuid": "054b935f-358f-46a3-8827-1a9cf5a4c5e3", "comment": "Malware payload (Amadey)", "value": "667bdbdb1b30f4364c8e57d9c09203a81d7a87b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063090, "uuid": "23262263-7d95-4165-b2b3-e0fa4bc3e192", "comment": "Malware payload (Amadey)", "value": "6c300f74465e63d9f330a447900c24fddb364eb4e34fe6b09ea31a2ab1b7771f997af0b9c8d0eac9c82b6f1d8010d148", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063090, "uuid": "54879189-3d23-436f-a535-45c60491e9c9", "value": "T14D8523639BDC99E2F8AB1B7040F901530B3A7D729869CB7F23579C160C332DA647536A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063090, "uuid": "ec7e3bab-c270-4f33-88a7-c11d80fc2bbc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063090, "uuid": "14521638-6593-486f-8eba-d61431d9566f", "value": "49152:PTHT4TNS/oFD8DL8xIShxDVGfMHtUM2gsuY4+Xkd:jAGEUUlPVD0gJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698063090, "uuid": "d16f9e6b-d9fd-48b0-99de-cb133bb2a66e", "value": 1772032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698063090, "uuid": "2b6b630d-fd3c-42f2-971c-c7aebc3ebe24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063090, "uuid": "2f2e1012-8c12-4c51-bbf1-a523b724e54e", "value": "7d57007ab42ab413813181770e3d38f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9a4d6d-71b5-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698073691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073691, "uuid": "ea615214-2004-423a-9654-b8a070d1bc13", "comment": "Malware payload (AgentTesla)", "value": "e31df3c54b59d57f01a6740fd94448b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073691, "uuid": "843eecd4-b9f3-43c0-8d6f-7524139f8143", "comment": "Malware payload (AgentTesla)", "value": "5f282e51360d29f2c0a4b8adf49357c28b2a6413fabf5fba3ac89d8e5ebdda79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073691, "uuid": "547376c3-772f-4bb7-b4ee-55fab2983951", "comment": "Malware payload (AgentTesla)", "value": "6c2d8799eab4cfe64b7d51895e6a06bc4dfea76f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073691, "uuid": "5fc7256e-4ecb-49a8-8812-36a6e0d856cc", "comment": "Malware payload (AgentTesla)", "value": "30ece8d679726661b4e0412305cca9fd48a5570452880ca06e139c073db924f006b5e0be276239d685530e22f1ec33b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073691, "uuid": "3f309459-55b3-4bf2-8163-6194787e7c82", "value": "T128E4226A22B447BEC87D6BF56861ACEF23A1E1ADAC17F30C5F9931DE9801F14D00954B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073691, "uuid": "8d1ba7af-b375-4870-b339-0af9a0e0c06c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073691, "uuid": "426cdd42-b842-4453-ad25-714f23595000", "value": "12288:chNh6sxTA6qNhohAC4bM4cVxw28i1YlWHIIJMwdGo++Be0nsr/z6Vi3h:cDDxs6gFNoznw28AYlWHIIIL+B2z6Vi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698073691, "uuid": "d24e15ea-2498-42f6-9ab0-75a929452dc0", "value": 681472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698073691, "uuid": "1ef0c046-3f5b-42b5-b637-9bb7acfae32f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073691, "uuid": "ef7da657-85c6-4534-8dfe-d07323393128", "value": "SHIPPING ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874df58a-71e3-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698093253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698093253, "uuid": "39c34423-9360-4f84-bb0c-31460e405e19", "comment": "Malware payload (AgentTesla)", "value": "56786d47a4e90990210efabd4eea4e51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698093253, "uuid": "decc6862-6230-4174-8da0-fa0f1abeea30", "comment": "Malware payload (AgentTesla)", "value": "5f2d8658d5995ef397df2b732213bc26b55bfb95e9d02a83a339d6590c4ef089", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698093253, "uuid": "a805b96b-44a0-4422-84c2-a4ffe54ec30a", "comment": "Malware payload (AgentTesla)", "value": "37e5a046f70bf23b06268ab20b5a03665e6c3de4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698093253, "uuid": "b596b626-975e-4c1d-9a29-75f730eed9e8", "comment": "Malware payload (AgentTesla)", "value": "2b67b4295620b9eff3adb97a15ca92bcc93676bcebc19ca04db2e23287779d629a1fcfff48b468f1c38266bc93a060b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698093253, "uuid": "b9ce96de-197d-4eb0-b2ee-742fe79501d2", "value": "T1FBF4122033A4BB46D63D63F648C6A4285FB2863F4B17E74C2CC371D625A6B198A51F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698093253, "uuid": "f9b5de0e-f7a1-4d0c-bf22-46a1162ff77e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698093253, "uuid": "6c4cf05f-18ba-4b8c-bca2-9b66acba4f8e", "value": "12288:mMD2M/gR/mZRM+BuOVC4NaQVQ7K/mDGk3bIED94snfFWdloXc+Qq0Ghj4XR4K11E:BgkZR5oB4NaQVQGmh3bIEpzU/osk0GGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698093253, "uuid": "721ceb2c-3100-443e-9de6-e680c12dc4a4", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698093253, "uuid": "65c7c4bf-47fd-4b6d-bff6-845e911fa862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698093253, "uuid": "bf3ebbe0-adcc-424f-b667-cccc8adafec3", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23261eb-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042725, "uuid": "7044362e-d964-41ba-89aa-6d87ea01c6d8", "comment": "Malware payload", "value": "06c8906651b75c8cf2b303d3afba532f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042725, "uuid": "87843593-57b2-440d-80cd-d6ba020246af", "comment": "Malware payload", "value": "617353e761a3daba548cb26aacb6dc393a543b668126be8db2b44c3f4936f375", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042725, "uuid": "e96be6c4-66e0-4ab1-b097-910b7630d931", "comment": "Malware payload", "value": "8ad213011bf489f2e12a7752692b286c898440ac", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042725, "uuid": "a828a9f8-893b-4702-9b16-dc7d9776a5fb", "comment": "Malware payload", "value": "4dc56b403f49c0030adf7721744dda38e03bcb7a85233727450c136a2b4d9a6cf4dc5470d0993afd34885a5268c0b462", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042725, "uuid": "e0ad875d-864b-4aa4-8c1c-5b992ffb4bf7", "value": "T15D46BE69230B92BAE76FC3F97A06C28CA7E6569254D7670BC5E1DDF60F28F047804D48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042725, "uuid": "b2a6da82-32a0-4f71-aa87-4b91af5533b8", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042725, "uuid": "0b863775-3984-48d6-a159-0a6a1f14330b", "value": "49152:VL5NWWM/3xcRqbJTw+LsEO8B5XbJioTE6N//lWWlHJqDfo6XruELlAnCkk:fqxMKiz/r5Xp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042725, "uuid": "2b756834-1e44-408c-b775-596a07cf2ef4", "value": 5700018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042725, "uuid": "88d337e0-869a-43e6-94c7-f71f586e5d26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042725, "uuid": "ea41bbce-a92b-44bc-b8d0-05e73ef86322", "value": "SecuriteInfo.com.W32.Agent.CE13.tr.1268.709", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f0848d-718f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698057193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057193, "uuid": "e1daac72-0fe4-46d7-830f-030e3247c636", "comment": "Malware payload", "value": "42a696ef6f7acf0919fea9748029a966", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057193, "uuid": "8c55eb05-ba18-4f92-bc18-657f02f387c7", "comment": "Malware payload", "value": "61b898f4254d8c6d3d375584a1109367f9e86d221e2d404bf6768fb81b1b48b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057193, "uuid": "b3f6a057-d78e-45df-a729-a01b51d3dbc1", "comment": "Malware payload", "value": "ad3070dfeb982cc3ba90c5ab1468be7650d299b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057193, "uuid": "c898e8ac-c52a-4ba7-8818-13bc150ecd01", "comment": "Malware payload", "value": "c480ee98b3a344f12179bdc676d2dc0d772c4be92921fb9f70ae5729085122375b491b47af65b91cfa2d8041b7cc4518", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057193, "uuid": "4130981e-5be4-4a5c-8c13-1478f0c05866", "value": "T1C3262991FECB14BAD9031E3144ABA22F57316D054F24EB97EA507F6AED376920D3620C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057193, "uuid": "b993d7c8-1021-4fd2-85aa-147348ea7180", "value": "49152:ZyklzHQzSQ+IA5RtmocPw1BErBg4ev/NOcnVo9h56v46adNi8m0B1:/VM3G/mo2sBDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057193, "uuid": "ca89ddc8-fa46-4e33-81e7-fa2797209dfd", "value": 4587520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057193, "uuid": "ffc56fe6-eed3-4fc1-8dea-2f54be38a4e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057193, "uuid": "2c7d2085-0c17-4253-a9ad-30ba7d338d7c", "value": "SecuriteInfo.com.Trojan.Linux.Generic.317778.16364.29792", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89eb47af-71e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698091969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698091969, "uuid": "8b698aec-8413-4736-ae92-36832f732741", "comment": "Malware payload", "value": "1224fd1efaeccea6f385c0ec5016bd4d", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698091969, "uuid": "c9df816f-adf0-47e1-be26-44e72dcf4c07", "comment": "Malware payload", "value": "6476fe91bbb0ed66f80b90b9e519828fc864c22d99e1cd390950840a793b451e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698091969, "uuid": "7eaeeaed-ba41-4114-8728-dedc59d01169", "comment": "Malware payload", "value": "69b5a0877a3bd4601a56ae3b4eb99ba3933d650c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698091969, "uuid": "f73b6d5e-25e8-4444-b9bd-cefd46d58f7d", "comment": "Malware payload", "value": "a6f5c4e4e68ca11cc4b104c44e7faa2348f1183f52190323eb8905b0788434eec611fcb89e2f1fb94d89e05d18268278", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698091969, "uuid": "56e1f1ff-9447-4312-af33-127e43de15ef", "value": "T18935DD347979BC2043EBDA1334F10BA65CD9168FC5703A3B199AD423AA746C165B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698091969, "uuid": "afb811de-7d46-4c4d-a83d-e3b4b155dc98", "value": "1536:/Lbao3DPiojmMThTB3zPdevb0xIm+lIWFRc6k20zi2d8szWNy2suTGK1G8GfP+U+:/LbN3D6ojmMThZdhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698091969, "uuid": "caca3d00-fe24-4648-91bc-1a75971d47a9", "value": 1154482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698091969, "uuid": "f0bcf10f-3a24-4e8e-9b4e-663ad25f9db0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698091969, "uuid": "be2e693f-8e1a-49d4-b0de-f1c7eb5b31f9", "value": "74c5c9e81ce275b8d7ad72c8dd6cffbf398fd5efdd1b83744ef81c56.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2999ae-7198-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698060833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060833, "uuid": "3a30f9d5-a156-481a-8a08-c5602513b3fd", "comment": "Malware payload (AgentTesla)", "value": "6dc05064b814a3f108a74a22da91a8e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060833, "uuid": "4a6bd1e3-e1ba-43f5-8cf2-cdaf20767c1f", "comment": "Malware payload (AgentTesla)", "value": "65233a691cff59ae560719ab3592ca59062a491aa14c126a35e844a7576f2510", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060833, "uuid": "0182a3aa-b683-4244-84f1-a813f03bc8c7", "comment": "Malware payload (AgentTesla)", "value": "5d6fb8b5fca52c80b5702e53e5efd60c0e013d4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060833, "uuid": "9f65a6a5-7e38-43c3-8594-2483efe9cb16", "comment": "Malware payload (AgentTesla)", "value": "1579e1dba7b67862dee13ae312acf8c693f9ac979e2c98b6400121c5e9dccbef28e7d9c895789819af9b1f9f4038cec8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060833, "uuid": "bc5653fd-b455-4e72-b067-280f69caf6df", "value": "T11CD423156E191DF0F148DF33A7E887B3B6E7E81DDE44C6B95771400ECA94CAAC6240B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060833, "uuid": "8bd1ddd6-c99d-43c1-9cbe-b77bc4f3e20a", "value": "12288:KX7QvvBSGukpyZCYcOPOPEcAfeVgfLR8fKN6WQzycLJa:KX7nKuCYDPSoY/fKDOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060833, "uuid": "3d744187-100f-4de0-a3d9-ea8668f926b3", "value": 605565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060833, "uuid": "6a06ace4-88d5-449e-a949-92155acbba15", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060833, "uuid": "fedc5adc-66ed-4ef6-b7fb-811dda8d771b", "value": "materials list.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa6373f-71a6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698067014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067014, "uuid": "3b24e548-9317-4cc9-a3d5-79686c7cc1f2", "comment": "Malware payload (AgentTesla)", "value": "8c7184463be150691489096717df0e38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067014, "uuid": "5e6f56a2-b45d-40db-9705-a1e6d6318ccf", "comment": "Malware payload (AgentTesla)", "value": "657cc831fe3eeaafccde4fe707832b998b699b1e7b525bc2d2fbcb5bbe3c7cd7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067014, "uuid": "ce3b052b-61f5-480e-bf5e-de88bcc4cc84", "comment": "Malware payload (AgentTesla)", "value": "e5247c85b2735cece7b114db445ac7b98739b333", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067014, "uuid": "c7064961-f39f-4209-8cce-af1b781d413b", "comment": "Malware payload (AgentTesla)", "value": "9254e80b1cee4dd4b71c4026319de2e51bdf5484dd1195490d56fdb1f55a643a4485a83f4da66ce0c8c73a2aae1c0197", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067014, "uuid": "0d2baa9f-c0a2-463f-ae20-1fc26f449869", "value": "T1A155442C08F84922C161E07EDFD4EA17F2808CD6668C9D9687C68F595A1397BF09BD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067014, "uuid": "bd172c84-7f5d-4f2d-9f10-d390907876ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067014, "uuid": "5e32f6d2-9551-4e99-8072-f0b8e758a096", "value": "12288:jFSMy5IBGtmQLZ91uk9v7JbGEYQMGhLHnvzxIwvmm2ieWpBxxw:JSMGTbxZQZGhLHvzxImHTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698067014, "uuid": "d39fa827-0708-4e96-8619-b43eaa6265c3", "value": 1299456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698067014, "uuid": "20598353-a8ff-4461-9c3b-8abd42bcd9d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067014, "uuid": "1fcc2bd8-9f0e-4d02-b123-9ff6dc19141e", "value": "Invoice #765400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f49c812-71a7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698067497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067497, "uuid": "b99705ef-b938-44e0-8739-ea018e912069", "comment": "Malware payload (AgentTesla)", "value": "d655d84ffc8ef1ad80359d8c15fba381", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067497, "uuid": "9c5b0791-b570-421f-9fe5-e67da4e4f733", "comment": "Malware payload (AgentTesla)", "value": "65c4d932a71d1f36d1c57b7ed319c20446d3c935b60f8f1262bc047e1c6556ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067497, "uuid": "a2cebfc8-6b14-450b-9964-58cf55417b7e", "comment": "Malware payload (AgentTesla)", "value": "60790b3514ea5085337063390d4c0399073cc109", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067497, "uuid": "b453e0e3-0f73-444e-bad6-dd50e32cf3b0", "comment": "Malware payload (AgentTesla)", "value": "78801e23873a5cd15b516db18390da17f2d036ce080e971144c29f4f326273d0e27f7f9e0cc1fa849a01ba803a883793", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067497, "uuid": "9dcbaaa3-7388-43ca-aec1-de00301c9f9d", "value": "T18653D607B69FD6B2C2645B7ED597D00A037CD281F673E60E398E23CA18537BAC94160B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067497, "uuid": "9d6542ec-0f1e-4c52-89c2-93d70b525779", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067497, "uuid": "446e07ad-6a6a-4ce0-a24a-df57a2ce1a41", "value": "1536:+tItKspQNPpDoW2O6JUuHoIPuJVPj/WsFCntmi2:+OEbpcnOvuYVPj/W6kH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698067497, "uuid": "440624f1-dfb1-4085-9a70-7e1eaeb36098", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698067497, "uuid": "c743adca-9152-430b-b3a5-4ab9fa99d38e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067497, "uuid": "820a4666-a884-442d-901f-e31785c4fb4d", "value": "Euro 36280.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba8b99c-7159-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698033963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033963, "uuid": "7db1993f-4a3a-460f-b19a-7d5df35ddda5", "comment": "Malware payload", "value": "d0f7533d5b69c01f40f00fde4d2a9af8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033963, "uuid": "2a9a79aa-678d-4b68-8722-81bdeedbdb9d", "comment": "Malware payload", "value": "661621147456dc8db54853cd73a0994533d159a2e6366e3128f37b3309feef79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033963, "uuid": "38a56159-e2d6-4c24-ab26-5f711c4b2a0b", "comment": "Malware payload", "value": "6b12aaaad632e4f17187eff6082fc56f0433c2ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033963, "uuid": "28f6048a-3eba-4a16-b6ea-ccb8bce41c23", "comment": "Malware payload", "value": "18775b479a84cb3bd2087f265d3670c54ba340087f5e6f256f9dab6f4feec3aaaa28d7bd0a8313cad0acef8fd011df3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033963, "uuid": "74372396-ef8d-495d-bbb8-eff2f5138c64", "value": "T1EC6475FAA036ED8A87370E40D1043E179C299ECF667887F8B78815D5C19C68C6DE75B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033963, "uuid": "a6dfa1c8-c68e-4c1a-a5c6-875123b8497b", "value": "3072:e6xQGGj0rePuTdvJrlcgsgKiU2iac2/7inPCIleGsCV4uDXZMfdYH4uJ6SeD1pCB:Nep+psgKifDc2mPCIlpsuf+gfx/RxXqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698033963, "uuid": "e78d1cc3-2d1e-4f5c-a84e-8fa9096f751f", "value": 330412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698033963, "uuid": "db061999-1415-4731-9c55-d08a7d5fa0f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033963, "uuid": "9d64fbcd-16f5-4400-a32c-6c1b0b48d6c3", "value": "95c47396e9184f4513b4501b91434f3a1425e42e57a8cfcd30d6fb02.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73b199e-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042733, "uuid": "1fc44aef-ce30-47c7-97a2-55c52f22e457", "comment": "Malware payload", "value": "c13b9ff243f0fadf7dbfc61fdcc6b617", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042733, "uuid": "cfc43b9a-a0a4-44d9-a7e1-1be7124166f3", "comment": "Malware payload", "value": "661f25d4e6319f55d7e9458f1a3cd8d398d18e91da0697ae9cb301c3c1e02c18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042733, "uuid": "59b3f5f7-ffe3-497d-b6ea-eea9699cd1fc", "comment": "Malware payload", "value": "5e14fa28992b69deff4812acb839af30f7321439", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042733, "uuid": "155156e0-7078-4784-af78-f83c679ad0a3", "comment": "Malware payload", "value": "7833aebfd5af912da65a7d2db0603045fbb52fe5a935a8c7b183bd80847667060f3ca656cd71761bef9640c780bd29c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042733, "uuid": "22a04d25-5139-4c36-8b35-6d817a12315f", "value": "T1F4D39D02D69BC1B6DC45CAB0509DFBB6627FEF401A38B293834C1DF97560A01A299DBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042733, "uuid": "8f95eae2-3827-47ec-84f2-fe113702036b", "value": "3072:ZiD0Xu/I/jbl1xbvj3pCDTTptGBBVLmtg:Zi+u/w1xbtS3iBV6tg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042733, "uuid": "205d2959-b5f0-4ad9-a705-908de3aebbd6", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042733, "uuid": "9fa1265d-5a5b-4325-a902-981097fadf02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042733, "uuid": "009f1e4b-8670-432b-9891-c826b71b7ecf", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.21688.20905", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88406447-71b6-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698073927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073927, "uuid": "52fe1eed-d71e-4f1d-8e15-a10a1e272ad8", "comment": "Malware payload (RedLineStealer)", "value": "17c8f5079d00963c47dfc1944bd023e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073927, "uuid": "ce6e03db-6d7d-452b-a280-e94dc5e8c550", "comment": "Malware payload (RedLineStealer)", "value": "663cec85c5c8ab0521b4ee97535d861c18e452a86dc394140af295285efad4b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073927, "uuid": "f2174465-4bfa-4fe0-a9f8-0676cabaff69", "comment": "Malware payload (RedLineStealer)", "value": "3b409d1bec6f12ccaf5d1205e56d60e873f8e227", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073927, "uuid": "9fde8933-e354-47e4-bb6f-99cbd373d9c3", "comment": "Malware payload (RedLineStealer)", "value": "03698f4a92e1aa7ce2cd87bba6fce0f0fab5dcf9c7810e56c53f98186c8545d6387b373128ebc405ab850415a3b8f737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073927, "uuid": "5b33cc5c-b9d7-476e-af74-26551404eea8", "value": "T183752322F7D451A2E8B453B128FB13934B353D634D6482172E9AD91A0EF2BDC6471B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073927, "uuid": "1fc21133-6ac3-4d9e-88ab-16f5a045abb7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073927, "uuid": "780d48cb-d510-4321-a09f-57f52bec4db2", "value": "49152:pArYRmBCMbHfTwdGCryELRfmJMZbgsgaS2n:OcRmBnbHbw4CNLR+JMZbRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698073927, "uuid": "71590c9f-8743-4669-9af0-6a0a9fa3e4c4", "value": 1586688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698073927, "uuid": "2945c5c0-57b2-45c0-a8f3-271af3a0a674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073927, "uuid": "493a0fe6-8d46-4127-9448-5191421c7cde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ece36cc-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698057618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057618, "uuid": "d6e6fd99-0162-4a55-b31d-b8770f957c7a", "comment": "Malware payload (Formbook)", "value": "d8784f1741f6b23b4d54cd3491c6a647", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057618, "uuid": "61160ca4-9c08-4050-8b7c-5ef47e67bf6a", "comment": "Malware payload (Formbook)", "value": "67222bd90963f902c0c643a0e7bcc6f64d5fa4bc203bed774981c03f91168c31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057618, "uuid": "7fd5a9c9-e180-4ecb-b177-da3b9fe99cd7", "comment": "Malware payload (Formbook)", "value": "8ff2a147857e62a852abaaf646f78415faabd768", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057618, "uuid": "f138175d-d5c1-46f1-8b7b-c66f8f78dc2a", "comment": "Malware payload (Formbook)", "value": "775b05d4ae24da3f4e346c5dd2bf5ae53046a09326d7b2fe753471d168faeb7f30532d32900458c9f9b81c86f2bc1229", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057618, "uuid": "80621f0f-2e2e-4007-8a20-83a59fe325a6", "value": "T17415D060AE39DF4EED6B4BB8807EF30D83715C953126C1395DA650C6D2833C906DAB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057618, "uuid": "a4f75636-5d2d-4725-b2f9-32ffd2bf48f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057618, "uuid": "49469f65-2dc2-4747-884e-85aa66776ab8", "value": "12288:d1PDog+IKBUb0M9uoG6x3b8CrP+K7joANj4rIL4DXNa+TMdWlqTj118:8IgMMobx3b8S1HVNMrdXxTCTj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057618, "uuid": "4b33f79b-79d2-418b-b236-e5d2ab930906", "value": 892416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057618, "uuid": "178ed418-b82c-43d9-9826-f86b306e6540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057618, "uuid": "631d165a-7cfe-4bc6-b458-dd929e21aeca", "value": "TCP99001110809.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593c0725-71c6-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698080720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698080720, "uuid": "96790309-65f1-4244-9219-2984c9608ac0", "comment": "Malware payload (RedLineStealer)", "value": "32fefd03ab648e3396634ee7aacd418c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698080720, "uuid": "40582ac9-b0c2-466b-a714-b69a0003ff25", "comment": "Malware payload (RedLineStealer)", "value": "68b57b46c5fa97ebb136c1ed1853a4bc1f762451e9ebffc26e91b46af75e1a1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698080720, "uuid": "a4d702b7-1e9b-4414-a08a-ba923a6140e2", "comment": "Malware payload (RedLineStealer)", "value": "5e7190e2131be01ef81bbdc8fa51aeb1bc131b01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698080720, "uuid": "d24a2547-1615-4b67-aa30-0e8bbbbc914d", "comment": "Malware payload (RedLineStealer)", "value": "c92862e17e5e5d5dfaccda01018bed4df739355a71c3168edb271053f1e5faa59e9b16840d301798ef593503b67bffa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698080720, "uuid": "329b5e1f-b813-4f3a-b4eb-26c1f9f9922b", "value": "T15E853342CAE95423F9B453B006F723530B3A38A1797D82F936429C6B2EB36D4253577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698080720, "uuid": "a83f9e0e-a762-4ab8-a315-5ac2755e7405", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698080720, "uuid": "6ca741b4-c12d-4c61-9738-dcacc663c357", "value": "24576:lyAWMk/wwrPR3isFJUQXm/No9+BpD14gvP2dmtojJL5LTRNqvi1hn8w+YKTS:AAYVP93JlXmloapD1l3Wmu18aX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698080720, "uuid": "deacfc93-5c14-4695-b268-ac499cce31d5", "value": 1766400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698080720, "uuid": "08e1272e-7d69-4743-a2b3-e2a43f201b8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698080720, "uuid": "5587e0d4-5045-4e06-b9b4-fd222c462590", "value": "32fefd03ab648e3396634ee7aacd418c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f345d04b-71c4-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698080120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698080120, "uuid": "aa8fab49-b842-4237-b604-bf3b64d0b1c8", "comment": "Malware payload (RedLineStealer)", "value": "b90afe4f262dd747368504f840dab838", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698080120, "uuid": "52aa50cb-3231-4216-8bd3-422b231de10c", "comment": "Malware payload (RedLineStealer)", "value": "698cdcd9df10c92d9da87a9129cb67026995e5e3150216f35b712807ae4f5817", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698080120, "uuid": "ed128ef1-1057-4781-a7e1-2e272c6684f6", "comment": "Malware payload (RedLineStealer)", "value": "dcb107565f338ea039db9e1b596fedbba9280d90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698080120, "uuid": "49c17224-51a7-4bef-bba3-c219175ebbe0", "comment": "Malware payload (RedLineStealer)", "value": "686d39d5e3efc2418531182278a0baa394a3aaebe711519df47d019777c64d236c0f366bd1eea2e50775c5464d0d33e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698080120, "uuid": "16a16fbd-6e66-40fb-951a-a28cd4355bbe", "value": "T12A752322FCC550BBE8BD2BB055F2138319313C626E649B135695882B1EB3AADD47077F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698080120, "uuid": "fdac1197-fd9f-45ea-9d06-6c5e53c4cd9b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698080120, "uuid": "9c65a33d-d48c-4f30-ab20-13bd979df81d", "value": "49152:TJ9NDchxQG8R7yZiCoq0CWbqADFRl3eMQ:V9S77nokWb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698080120, "uuid": "6dd223d4-c610-4cd1-b628-451d701291c8", "value": 1585664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698080120, "uuid": "ef4d78b9-7d42-4e3f-8cba-eb2a3bf0c6a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698080120, "uuid": "30c695ee-08dd-4dd0-9b10-e9d5942800f6", "value": "b90afe4f262dd747368504f840dab838.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80da6f0f-717c-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698049004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698049004, "uuid": "0e8c497e-363a-4b0e-b3dc-4bcb791a6f45", "comment": "Malware payload (MarsStealer)", "value": "8c3514b8888459087b097dcc70dfbf53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698049004, "uuid": "39f7182f-20f7-43f4-8cef-a49d90667fd3", "comment": "Malware payload (MarsStealer)", "value": "6a37fb22ba4cf331c954a84f31a730bce22d16a8b86833488c0724f50a338fe7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698049004, "uuid": "e322e28f-5985-4e90-b464-94030d2c9649", "comment": "Malware payload (MarsStealer)", "value": "9c72df311ab8830bcb618e82c9fe95a4734db774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698049004, "uuid": "d39ad4da-3efc-4e9b-a18a-259d84cfdcc0", "comment": "Malware payload (MarsStealer)", "value": "ec77a2c96d39f0863623b5d497ce1cce2ba5a0770ad387a85ee9acff2ba7b43b2fa792681a60b83ea0f8f7491dd453c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698049004, "uuid": "c757d10b-a044-4d4e-8579-dbd0fcf4083c", "value": "T114449D13A2D1EC60D91649338D2EF6E4F62EB971EE19EA5733186F6F1870172C2632D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698049004, "uuid": "a2b74e42-ac99-45e7-81f0-2dbd10730c65", "value": "3dc5fd248fcafa52ac5c2283ccf28cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698049004, "uuid": "8059f7d8-ec0c-4b9f-a2d4-e1d946234468", "value": "3072:4wXb+fFSBLKgOy5u6qL8deOJPmqRfBhyYquxZ4tD6N5UcunAfrpr:1yfFSBLjD5u6Tde8mqRfzqu45FnnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698049004, "uuid": "7402fedd-5537-4e3e-aa41-39de3837ceb4", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698049004, "uuid": "1d8e6661-1449-416a-8ece-3f30ac929726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698049004, "uuid": "bee45ce8-9622-4b67-82b6-3cb68af92366", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90375cf-715f-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1698036643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698036643, "uuid": "d1d90889-dea7-4523-8c26-905c697224da", "comment": "Malware payload (CoinMiner)", "value": "abf6188379fdca5b6b3dc6e4ba6f3d25", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698036643, "uuid": "6a724eca-bbaa-4e5a-9f30-7e9205a35490", "comment": "Malware payload (CoinMiner)", "value": "6a994bc1d97e8908995595212386f78ecce70de5b450b7e5e6956a3b08f06063", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698036643, "uuid": "e8daf1d2-9bd3-464a-8e68-fe674780d207", "comment": "Malware payload (CoinMiner)", "value": "8e94f52b18916241c21ce8f4a3bd6019daae704d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698036643, "uuid": "06ebbbce-8163-433e-be35-6db52f9274d9", "comment": "Malware payload (CoinMiner)", "value": "45427bb46a7e9a551c5bb988a710a43a051b08189d386b040d6928450a1c453b2680f2dc388a1400b95a23d332104376", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698036643, "uuid": "3573d828-bb58-4ec1-a009-f0d444c40c8b", "value": "T181448D13A292FCA0D91649718D2EF6E83A6EF970CE59E66733186F1F18701B1D273391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698036643, "uuid": "fa0bb30c-c629-4d82-a403-5f3bc1d88dc2", "value": "3dc5fd248fcafa52ac5c2283ccf28cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698036643, "uuid": "d33dc4e2-6799-4fbd-bf23-3c74cfe9b168", "value": "3072:QwXu+fFSBLKgOy5vwdrTSjE7O858KuiStzwImN5UcOLUfrvK:dPfFSBLjD5od3SHm8KuB0IBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698036643, "uuid": "02812d93-bddf-4bb2-9890-713e20795ba0", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698036643, "uuid": "49647141-6d30-46cc-856b-8328c6d7bfa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698036643, "uuid": "bcf3ec2f-584a-479c-990d-1a8d422c0f78", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22271fdb-71ef-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698098237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698098237, "uuid": "e3289181-c172-4273-a85c-1c89aaea4c73", "comment": "Malware payload", "value": "e05f833eb54c467fcb8de5724a8df9f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698098237, "uuid": "d32c4080-37eb-4054-ab91-4b8544c2ae18", "comment": "Malware payload", "value": "6d6b36bdc0d8a3dcedd526c512aa94299ae8425a66cd77fcc814f1494a254daa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698098237, "uuid": "162fce23-a22f-4eb1-85a0-af0defba5fa3", "comment": "Malware payload", "value": "83f8e9131a96212d48e8ab02332ffdd693826c31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698098237, "uuid": "93c7db96-7f7c-442a-9f8f-b8235b442baf", "comment": "Malware payload", "value": "6774a862f3fb9c722a22d2332c13c9cfff65c40beb4db27ad9c0382d614e3acb91b24ac5bf2971f523659c9925bc5033", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698098237, "uuid": "8765cad5-489e-4ef6-8046-472438378284", "value": "T18245BF21FBC49276DEE200B695EC7E20916FD4B0072D6ADB46E907ED821D5C33FB1686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698098237, "uuid": "a85df567-e18d-4cc5-9a61-0d01b8956cda", "value": "7104476aa32cf4b45f58ce5b636dd82a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698098237, "uuid": "34ec414c-1140-4e32-9240-02cb63c98bc9", "value": "24576:qeZNIaZedFA9iH9+uvSaYoPSPUZTrxik98yVMhcfy9STm:qeZN8FA9iH9BJasWk9wtSTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698098237, "uuid": "a81e4a72-62d1-4d31-999d-122b02194f71", "value": 1275296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698098237, "uuid": "5afd1c55-ba6b-4af8-a75f-4e43ee845af4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698098237, "uuid": "28b7c197-c8b4-4f63-9ffb-19f8d4e691ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5709ca-7161-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698037591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037591, "uuid": "e02d39c3-bbe9-4cc1-89de-0b74705a660e", "comment": "Malware payload (Mirai)", "value": "860b219c8699fb52d0f8f26e518948c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037591, "uuid": "8d6b06d5-75a2-4607-aa28-7cefac31413a", "comment": "Malware payload (Mirai)", "value": "6d86330a8365ebb9040b9c06a58917b9f2b10dedc7028b7464aa70d8d4a93848", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037591, "uuid": "f30e9393-0c26-44f3-abaf-f96a2f81b925", "comment": "Malware payload (Mirai)", "value": "a9c91541ee8a3c4d97c57b48a8343f45bd6a2eec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037591, "uuid": "81005765-4663-4f98-93e2-1de15a416837", "comment": "Malware payload (Mirai)", "value": "f853d37c2cf7f24ded6c73499a132aa68a62a778c79af408d1bf72771c7d5260824badf5847d56124e1f92c4bc15e4d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037591, "uuid": "6ecf5920-2b1c-4467-b44a-6fa1e07e411e", "value": "T1C5B2C0CD55943084CA8D7C7C178D4A664F6C9190FAED8B2AE350CD98B3BEA4B385D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037591, "uuid": "5f80e55d-3118-40db-9e35-ff6f68bde5cb", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpEZqSWvM:4QlS07FUXqIYSXQKqu8qU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698037591, "uuid": "d322d8d2-47a6-44fc-872b-4777a21c4f34", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698037591, "uuid": "c1f7bfae-1293-484b-b037-89c5409fa6ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037591, "uuid": "6558d0ad-234f-4256-8f28-902c10ba26da", "value": "860b219c8699fb52d0f8f26e518948c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9b0711-71c1-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1698078738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698078738, "uuid": "d79d7940-e0ed-47bd-abce-0d0755fbdf1c", "comment": "Malware payload (MysticStealer)", "value": "63a3e200d7f03fa031caaa54bb07d80e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698078738, "uuid": "23773408-15bb-4cf4-a414-25f4e07c24d0", "comment": "Malware payload (MysticStealer)", "value": "6dccb639fc6257fb8ab1c1bef4bb5a3294c399247bfc7607deeb7fc790b5415e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698078738, "uuid": "493b7ebd-dba7-499e-a77b-4b6fa344723d", "comment": "Malware payload (MysticStealer)", "value": "ccf5dfeff4ca4df1b88ef1acda4c4ebceddb75c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698078738, "uuid": "6f7ddfba-4399-4774-abbc-63f14ac98db3", "comment": "Malware payload (MysticStealer)", "value": "e4bfdda866e4fb451df71d7f643196c5bcfdcb42b0a4e0235006fec4984c79f62b82ade4bf98b0eaabc455d044066d4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698078738, "uuid": "9cbd7a2f-9331-4ba7-b6f5-57fb4aeb598c", "value": "T109953C1176F95B49F9F30FB85ABAA719087AFC6A9F11C2DF1250548E0C21BD09970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698078738, "uuid": "25d04d7b-d807-4d43-a7f6-97d8f0a33a24", "value": "037522269f8348aa17add864631a3f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698078738, "uuid": "01d2dade-578f-49f6-a738-24a8b02d6dbd", "value": "24576:ErTAfSYqe7E9ErdW+NG6a9DhvhfKG7aPSI:Ecqe7E9D+06a3vqPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698078738, "uuid": "6d20f05f-0fc0-45ce-8aa0-733d9fdf406f", "value": 1909248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698078738, "uuid": "e38d7610-b128-47b7-973a-079be2658221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698078738, "uuid": "0db0aec2-7aeb-439f-be52-731aa587f520", "value": "SecuriteInfo.com.Win32.PWSX-gen.6403.5373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ccd931-719c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698062730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062730, "uuid": "9fb9f106-47a0-4dbf-bb00-4030517ae547", "comment": "Malware payload", "value": "70437e3e19e5389499e1d702ff29d273", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062730, "uuid": "eb58656d-52bf-4af0-8c16-cf97b33ae837", "comment": "Malware payload", "value": "6e006fa2cf49e2c52add436f266e2f62fb53ec936dd3caf536749d859240d6ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062730, "uuid": "0c42e644-03ba-442d-bc6b-310796e45a77", "comment": "Malware payload", "value": "403c6208b6ee3ba3728e7e45fbf4d211dbb50d23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062730, "uuid": "d673fd9a-6856-4f00-8447-d60846103c96", "comment": "Malware payload", "value": "2aa50de68cd7e88fe58ac7b7808c563922f1e5887006080f0cee4b726d2f7cdbc0dcd31e5aa4cb6c6536f3c40f97d51a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062730, "uuid": "801ef9f5-9f4c-44aa-bd62-6d03b9149877", "value": "T12116335A521A59D3D428523EA8E3202804FA41FA7835FF62548787D438DF7F88E8DDDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062730, "uuid": "02f0c2d8-0058-42c4-976f-4d3047dcd6e1", "value": "98304:SYzvd/RNpqSET9wu44roymRAe5cc9k/b8gS/tD12Q0PPhadnMZ:rdbATWcoyl2kjjS/DsPgdMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698062730, "uuid": "59736ef5-5295-46d7-aa6f-cf0e9606b484", "value": 4419584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698062730, "uuid": "81c2eeda-e71d-49a0-b2a7-65b4fc594635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062730, "uuid": "3d7cae0f-c85d-4f07-badc-67f698e1834b", "value": "rPayment-Swift-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de4756e-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698057428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057428, "uuid": "6e91ae98-1fd8-4b77-8289-e935312ad766", "comment": "Malware payload (SnakeKeylogger)", "value": "607e77f9ca12ba956cb67200c50d4af7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057428, "uuid": "b3ab7fbb-115d-407c-8fb3-f6e25c894619", "comment": "Malware payload (SnakeKeylogger)", "value": "6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057428, "uuid": "b0e96a90-21a8-4940-8985-51a1c5eb1727", "comment": "Malware payload (SnakeKeylogger)", "value": "2ab62a18b91f49aeabbba8d95c6df254b1d8fca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057428, "uuid": "66e2ddd5-23d1-45b0-ba45-59c58064a80b", "comment": "Malware payload (SnakeKeylogger)", "value": "532c2c02579489d4dc3fd12d709134d69e2804746e581659774ab78d040657c3ee7915b746fe334d8947e41b24ec811a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057428, "uuid": "b6e69e4b-7afa-42d2-9616-c27b2c0c6ecc", "value": "T12AD4F02027642B62D07D63B2D486D13497725A290B67CF389CC163C336E531B8E67FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057428, "uuid": "21785570-3ec9-4f05-913d-f9e06fe02bf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057428, "uuid": "66b2e119-bebc-460f-8acc-0b39cc47e854", "value": "12288:7MqkMPgR/mZRM+BN3SscBiUSnYpJLNRPPD4KUQbwEldtpoj:RgkZR533ToBBfPMNQUEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057428, "uuid": "b0b89303-89a6-413b-83ab-630e29fae491", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057428, "uuid": "98a149e7-a188-4e80-890c-20a8a0a265ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057428, "uuid": "bfd3d262-7969-4862-b427-d84df479ebfe", "value": "doc 20230925000101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4ac2bb-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698057613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057613, "uuid": "c959959b-84f0-4f30-86cf-159fa2d6695b", "comment": "Malware payload (Formbook)", "value": "838c7021bcd188591a94d8885e910efb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057613, "uuid": "0c6ace6f-55d5-43bf-8a4f-a20b1b3a86f3", "comment": "Malware payload (Formbook)", "value": "6e3da175f5206be5727c700d9e583cc08d7edf2d975b993cf0d74f4e920acf50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057613, "uuid": "df6af936-7758-433d-a641-74af2bbb3fc0", "comment": "Malware payload (Formbook)", "value": "afb86c6d4a44d0371d0c6a8df24c21df142468e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057613, "uuid": "82c546d9-6aa1-48e0-a708-e266c20fb019", "comment": "Malware payload (Formbook)", "value": "5336ab43880c3821cfb4f8432b6cd5165e7148eaaae29758955e19935023ec7d08d2297307ab0383bbe7975fee451d79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057613, "uuid": "bf5d93f3-9fdd-47a7-a526-d0b0b4139256", "value": "T17CD41311BE745B2ECC2A5BF8C6B431565336212B7A79DB3A3E6A25C9231374C2740F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057613, "uuid": "509e1fbb-32e4-4a95-ba16-82a710f6f734", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057613, "uuid": "f33cb177-a055-4a00-b474-bc4528c60cf9", "value": "12288:U0Dl+C42xjWPt+YyHWaom6/ly+nGZTFJqugWQPH7IJYzr0ovtwWzPQv7s:N+yHWaom6NzGZ3aIOr0o2WDQDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057613, "uuid": "607cb49d-44bd-4896-b10b-eac9709555fc", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057613, "uuid": "dd35b395-d051-4e93-9be1-6e733a2e012e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057613, "uuid": "1e6b059a-f3c0-4415-b98b-8e1438378b78", "value": "16.08.2023_Ekstre.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83bcfb4-713a-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698020723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698020723, "uuid": "8a263810-0972-4cbd-95a5-1df3261ee7ba", "comment": "Malware payload (RedLineStealer)", "value": "a6c5954f1ad70d8c23ac4ea05553a33a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698020723, "uuid": "41876f2d-e7bf-4a4c-8480-9be4477024cc", "comment": "Malware payload (RedLineStealer)", "value": "6eb9d8d68ff263d6713c82f1c38933f8f7fe9c9a29ef7cbc7fa48cc0d2035be1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698020723, "uuid": "825ae8dc-b2fe-483f-ab8c-9be93b7632c5", "comment": "Malware payload (RedLineStealer)", "value": "dcfbc1e630ea81cfdcc1656dbe57d3bdcf3ce450", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698020723, "uuid": "a143c488-d278-434e-a1d1-7d556348e87c", "comment": "Malware payload (RedLineStealer)", "value": "87de855f201975a7fb63d5d1f99c830aadde931ec9ee1ffcc1d4922bb25976e7f35a7aaef697952f297ca672aac73bfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698020723, "uuid": "1cbc3fce-ea2d-4f63-97c1-0f50a158bb03", "value": "T17E852342AAC94671CAE0777089F401D31A38BCD1DC3DCB16236BAD5A8DB3588A975F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698020723, "uuid": "3b847b8c-9bb4-47da-92d4-a2604a472f9f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698020723, "uuid": "933129d3-398b-42e2-a6a4-8a884f741e72", "value": "49152:SiwPA04J3ivKsFCm0EO9wM34YUy0vqKdei1M0Nn7:6A04J3DdmrOaSgvqKdej0N7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698020723, "uuid": "8d1f1ea6-330e-404d-a08e-208a60500d97", "value": 1827328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698020723, "uuid": "a2462998-5088-478f-8cee-f55cf8c0f084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698020723, "uuid": "2aa4346e-71e0-4cc0-9f30-66af58371881", "value": "a6c5954f1ad70d8c23ac4ea05553a33a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2f37a6-7179-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698047840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047840, "uuid": "7b026038-33a2-41f7-9dd1-423ea4078645", "comment": "Malware payload (AgentTesla)", "value": "e01673c4db6035cee8bf3faacd23b805", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047840, "uuid": "dfd6f6fd-3bbf-441a-89a2-44fb06580e32", "comment": "Malware payload (AgentTesla)", "value": "6f1d937b47e5910b8d3ba50bd73c3f52ff06b02325892f09f43a51069657ad0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047840, "uuid": "65f35ce9-a4a4-4c48-bc2b-6df04a9693cd", "comment": "Malware payload (AgentTesla)", "value": "1ae976c196b5a5e42ef78acf85db34d1c250d536", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047840, "uuid": "cd9b062d-e74d-4369-a5d1-b4eb356f1768", "comment": "Malware payload (AgentTesla)", "value": "d244af392f9023f7847b39876cf782864abff4218974f96fb6d89211580de0a202f4b66512d752d5ff65a1dc39051a73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047840, "uuid": "ef22475a-e2f3-4441-a00a-0e9f626e702e", "value": "T1DB55B3AD69B88567F879C6F2DF648430B0A29EEFF4604928C5D77642477360370CB92E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047840, "uuid": "788a4d69-beb2-47f7-8a66-03fe51344fc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047840, "uuid": "eda723b4-a61b-4415-ab35-be6f9208e9f0", "value": "24576:i+yjv9Gap2HbkjYiSJMVexDqz2J4y9afI:qhQPJmsDqlkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047840, "uuid": "9b1a84fe-0de2-468c-a905-8fe834dd7f94", "value": 1389056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047840, "uuid": "e50ebe57-892b-4038-a3ec-6b8050f18a29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047840, "uuid": "1309453b-ebb9-43d3-8994-54bf18d1f62a", "value": "xPOlzeOTDQF15ri.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c8acf4-71b1-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698071902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071902, "uuid": "94829554-156f-41c1-ad65-f4d32722d558", "comment": "Malware payload (PureCrypter)", "value": "dac313a520e16a0aab100ba84cce958e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071902, "uuid": "f7ccc57f-f9d8-476e-91d6-7f5d76af577f", "comment": "Malware payload (PureCrypter)", "value": "6fc7189791af4f2f113700770fc02ccde3e34cdbb2d886ce7e9699a27ddac970", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071902, "uuid": "871533c9-b5b4-40d2-bcfe-61399a396bd0", "comment": "Malware payload (PureCrypter)", "value": "745c953ba9208ea8807228bceeb7d6ad0bc9b502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071902, "uuid": "f95928ee-7cb2-4171-ae08-5614a7e27d5d", "comment": "Malware payload (PureCrypter)", "value": "3ce5c0a5cce1f6affc453e99aa277f6d27b1b331aaf0752ff97803cc71edb97b8b54717b73d9b33343af05c9f7e26cdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071902, "uuid": "8424ae6d-46d4-4dae-bdb4-5e467a56de99", "value": "T1AB63F907BA9BC5A1C245DB7EC5A742840375E992F613E63E39CE334A18437B64E4DE07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071902, "uuid": "a4af98ca-a5ea-492b-b399-951c5e90b973", "value": "1536:5F26XalyKbpHr0lV+8WMjhwrE0flZ+NdFiFkToWsvvT:fbXsPkV+8WihX0flaQlXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698071902, "uuid": "87aa1e60-3a94-40ad-a3dc-f2d6c7ac030d", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698071902, "uuid": "eb78d1f3-9949-4ef3-aa7c-ead6ce0fcb9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071902, "uuid": "cc687efe-68df-41fa-b3cd-041a1cbae631", "value": "0001.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23233ca3-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698057437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057437, "uuid": "5ac52621-80a9-4a1a-8dd1-fc04ab7794a7", "comment": "Malware payload (SnakeKeylogger)", "value": "3e872d74cb692deb202d25859986357d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057437, "uuid": "b788fd5d-e362-43b5-bb8e-e2002f233967", "comment": "Malware payload (SnakeKeylogger)", "value": "701d2231e9b9297450abddc537bfdb90fbb45f679b6da2e1e45b615280bd95c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057437, "uuid": "cf3d04d9-366e-4da7-949f-a13c021b8703", "comment": "Malware payload (SnakeKeylogger)", "value": "9ba324ec9ff4f454409f653da5d4d7b694255d6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057437, "uuid": "c7046231-cf99-495b-96c8-7a1d375077b9", "comment": "Malware payload (SnakeKeylogger)", "value": "06ce198940ed3e79c99403556407e4b4ed0477ddd91cdae4ccad5bb9638b6323f7bd04ce7390642c8faf00815421eb8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057437, "uuid": "50d1bc29-53d3-4aa6-a8fc-20340f20aa77", "value": "T11294F1192B7CEFA7E67BABFED0245410477CBB669000FB8E1D0AB5CA04E17455B82B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057437, "uuid": "28ec48df-1b0b-4ecc-bc91-e07732ff7356", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057437, "uuid": "69c76f3f-45fa-4e00-b9c9-3f3f872070c7", "value": "12288:AD7gUiVaOazGypq9Q/NGbEPAj6JYrOiqot2:daOazTNYE4j6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057437, "uuid": "f0c46daf-580c-4492-bf00-d7834481d9f3", "value": 447488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057437, "uuid": "338491db-ccd9-4fd5-a8d9-75e95d556d48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057437, "uuid": "bc746a0f-dd27-4d5e-aa77-86bfb18b15cf", "value": "New product.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279daa42-7161-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698037258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037258, "uuid": "98a9c981-46c3-41f5-9427-6fa2e10c54eb", "comment": "Malware payload (Mirai)", "value": "ff1d1a3a591095f019e67138f89ce71e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037258, "uuid": "eca40bf3-162c-48ea-bdee-5db44bd6abf3", "comment": "Malware payload (Mirai)", "value": "707afffc4ad5cb84bae46ec3973dc64ba380e495c3d1ff0e2bfdf13488b7109a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037258, "uuid": "9c26b0db-514a-4968-a14d-66070499f71b", "comment": "Malware payload (Mirai)", "value": "7180e84f80bbdc3598abfd99ca8c2ab2f394650d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037258, "uuid": "aabac3d9-d9bd-4cff-a3d1-12313fc82eb1", "comment": "Malware payload (Mirai)", "value": "664cb8865b928649d1a6af4ab25d45cab9bddb12167090436e70938fb55dcb2396911f763626993fc6d15a4617ba2630", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037258, "uuid": "ab3029d9-5296-4dc1-a58a-79a84a8e0545", "value": "T1E5432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037258, "uuid": "9d764f1c-76ae-4c25-9939-c423aaaa13a1", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw/:RqtmZPuutfbltZFBSJsBcfDSTFI+BE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698037258, "uuid": "c274b7ad-7ed4-41bf-b8b0-d0989af93f09", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698037258, "uuid": "89aaaf78-8ee1-408b-9aaf-473e5233b6ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037258, "uuid": "5751348e-9526-4197-94ba-142b0440ec4d", "value": "ff1d1a3a591095f019e67138f89ce71e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0bdf805-7163-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698038454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038454, "uuid": "b9802c44-c09e-4ea7-b0bd-8cf8f71e6f1c", "comment": "Malware payload (AgentTesla)", "value": "afd804c312383cb891f4a7156f692b12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038454, "uuid": "dd782c40-436a-466b-af43-f0f46995d7f4", "comment": "Malware payload (AgentTesla)", "value": "7288664c9fe4142317ca1d56027778acd173473339be7c93876307ff6814c054", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038454, "uuid": "ec1aee63-5a9d-4a78-b535-9b0e16af3c6d", "comment": "Malware payload (AgentTesla)", "value": "bfd9a10b4759beb35d187c6477e89844f8d3dc89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038454, "uuid": "a5e7c494-f46e-48dd-9123-3ef0671f9235", "comment": "Malware payload (AgentTesla)", "value": "9162b1a22f44401bc89e3360148e8df18d875ebdabd7d03bb564a4a755ab811ff55fd9d16c30c7a516130f92c7b792b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698038454, "uuid": "38f26bac-d28e-4952-a4bf-5ce6f2d287eb", "value": "T1DED42309B86DE6DD3B431D1AF61543A3F857C00632CBEBA8751CC60AF83356ADE419DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698038454, "uuid": "122ce73f-7582-430c-8e0e-de654362fcd3", "value": "12288:c75Z0yuY6vpKknB0hQYyrUzfQ94Zvx3dw3BQTP255C7PprCmUOLEN7LrZka0KV6:c3FgxB0XyrU094ZvJdw3BQ72vSBmrNDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698038454, "uuid": "14ec49f2-8179-4388-96cf-3604be11edee", "value": 645140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698038454, "uuid": "f8f3d1c1-d733-4553-b7a4-800163264794", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698038454, "uuid": "01e31809-d271-40be-98fd-20deffa655f1", "value": "Purchase Order pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4fbf1a4-7197-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698060742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060742, "uuid": "6dd05a00-e65c-47a6-a268-773daf249e07", "comment": "Malware payload (AgentTesla)", "value": "dca290563b2d2f9f3c8310d8fbc9a797", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060742, "uuid": "a476a0ef-b7ea-4670-a104-d60f0a2a7c61", "comment": "Malware payload (AgentTesla)", "value": "72e5420f9ce8e361479ffa0959e14c29d10b3112c0cbafbde4554506d1bd665a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060742, "uuid": "410ffb5e-934b-4f81-8c3a-4b8e8b6714e1", "comment": "Malware payload (AgentTesla)", "value": "fd75c1e2c937db485ae1a53ecbcb6fc3bea4f550", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060742, "uuid": "3053439e-cd2a-4c72-b4e1-cd266dde67c1", "comment": "Malware payload (AgentTesla)", "value": "1d584d544cdb597549e96755fb677d3ac75b471cbfc1ff39860ee269b9f2798a451f05b7d6fa494dc94b56acc6642b01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060742, "uuid": "24525126-363f-42ac-8200-ee9eb7466b2f", "value": "T10A6533582BEEC933CA2D957EC1EA09B81675C5E63502F74B5EA4C3A60D123E9D24C3D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060742, "uuid": "7c779d4a-fae7-415a-b245-cf48f1593f0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060742, "uuid": "12e00ce8-3e70-4eae-9732-59241aa91c64", "value": "24576:dr3dbo48sy08lIvtMUHTatA5ov2jKoblr9kANGqykhgR:rZyvlIvrzatAOOpFHh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060742, "uuid": "c173c278-84f1-496b-b2dd-2821baba6ccb", "value": 1412096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060742, "uuid": "572affc6-dc9a-42db-b7ce-2e10ed37e171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060742, "uuid": "cd19bbf5-7899-420e-b74d-821cb7170d78", "value": "Skxcaj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d351def-71d6-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698087626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698087626, "uuid": "edae4509-a3f0-4233-ab5b-f9e7e49276f3", "comment": "Malware payload (RedLineStealer)", "value": "a358f0aea782aa15c8c90b495442809b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698087626, "uuid": "4bfad74c-9716-46be-a063-486fa06b464b", "comment": "Malware payload (RedLineStealer)", "value": "73585aafdaff1676cab8eddf54bf26806a664e5346b8d221634fc17de11360a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698087626, "uuid": "ac01506b-974f-41a9-ba5d-ba3404e6936a", "comment": "Malware payload (RedLineStealer)", "value": "5828e41bd886fb6dd80d368f52e188d47727aeb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698087626, "uuid": "a7ea8fa9-5344-4700-93a4-6cfa0cbc8ed9", "comment": "Malware payload (RedLineStealer)", "value": "663b1696fcce63315d891c1d4af9aaebae9b4b6598379cd8f0bc176b774dfc8c492044ca4d6cf30748c3514e05ec6769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698087626, "uuid": "91339da5-ec5b-4da0-90ad-d92e5c9af6c7", "value": "T1BE852302EBD8A132DA7713B05DFE26931F38BC905B3A11AB93C55C5E0877980E9B5772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698087626, "uuid": "6a103dcc-de2b-4b69-a4ca-4efa928ea716", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698087626, "uuid": "6be17e50-8196-459a-8d8b-4204a393d572", "value": "49152:Yln7r2iFPUtnxDaQSDXu2ANhXnxe0+qnb7EZC:i9FPUfHGe24XxeJqnXEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698087626, "uuid": "1f81d814-ee89-42ec-bb74-7e2b5d18ea8f", "value": 1763840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698087626, "uuid": "b1ac8c44-b028-4c9d-a94f-3c0f12d5928a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698087626, "uuid": "a62cd28a-6184-4519-b43b-0bad23311c86", "value": "a358f0aea782aa15c8c90b495442809b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46430bd0-717f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698050194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050194, "uuid": "ac648e2d-05ca-47c3-b6a3-c44e80ec5db6", "comment": "Malware payload (Formbook)", "value": "f5022a91672eba3c7f3ee2acba6f9de2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050194, "uuid": "5e2fef9d-dde1-4545-a980-0604f2d98106", "comment": "Malware payload (Formbook)", "value": "7454006e42a34d17ed13838d181d32459d39127c1f63fff3575699c68b48ad21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050194, "uuid": "1cdb5434-4116-495a-9b53-58407b30c11d", "comment": "Malware payload (Formbook)", "value": "4a632aae73be2f80f2950fa36849e6f40b8d7c14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050194, "uuid": "7828be00-cc18-4a6a-adc4-10fad4dc655d", "comment": "Malware payload (Formbook)", "value": "26cc2b9678ad830ba4c7faf1701bbc06b55f85f89750428db504db01ece6607e0a80bb4d478f981db7915f246f03aff4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050194, "uuid": "a6e58cb2-6e46-47a3-8529-20b03942eae3", "value": "T18D849D1234C0C035D8B342B28DAAE61946FEBDB11B226AD777DC5E4E5B749D2A732313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050194, "uuid": "232624c7-9a23-480e-a996-b64378cdc9ab", "value": "21b7a3973c0461fa5bbf431036cf24d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050194, "uuid": "836dc832-e003-4229-8b42-868372a6be10", "value": "6144:erOO/Dn88GoNZbx0ISf6uK6qCDctQdWH1BflwcLMY7e/bMMzWB:erO6n88zZWISO5tQYH1BNw47e/bM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698050194, "uuid": "3ac24ed4-a5f7-49ce-80d5-6048a2ea6d02", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698050194, "uuid": "3b446745-ae35-41e2-8bda-84043af3dadc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050194, "uuid": "4b93fc70-b678-45af-a0cc-a926d610d5cb", "value": "SecuriteInfo.com.Win32.InjectorX-gen.14133.18200", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6db221b-71a2-11ee-8907-42010a9c0042", "comment": "Malware payload (Vjw0rm)", "timestamp": 1698065442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065442, "uuid": "623dea6b-0df1-4eef-a5cf-046485642351", "comment": "Malware payload (Vjw0rm)", "value": "7b3d2b6ee0d1b7dcd4848affd8eb41df", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065442, "uuid": "eb0ac090-dc22-4bd3-bb75-7d9647c060f9", "comment": "Malware payload (Vjw0rm)", "value": "7469ed4d59e6580cdeab5182930b2e2d50e662b9d18eefb964118fcf8c7f4f03", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065442, "uuid": "f7512db5-015b-43e7-8d38-4c4e7e7a04d1", "comment": "Malware payload (Vjw0rm)", "value": "5482b40c977ded69e5efd71240e989f03113c95a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065442, "uuid": "19e2e4c8-7a98-443e-acdd-2a393e090621", "comment": "Malware payload (Vjw0rm)", "value": "139a76f57a8cfc835322cc9a4da065fcd96f62e1b6f7a6af771beba020cfecda5fbecff4b9c7b9ced997c922f0f5a50e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065442, "uuid": "0ef447aa-8a0a-4e19-a182-1097ff5d8dd0", "value": "T1A02528CDAB7229C7DB799718CB0C9E22FC2CE417C99511C23E805A0D9EB585C9DDE26C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065442, "uuid": "6635b6d2-67f5-45a9-941e-3f2a02c125c9", "value": "6144:MQcpZc2Deey3T+J5hXbPgkjJeVK1Mkl88Ee9t9k/pol+zRjzPT+AjLvNnfywWleH:X6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698065442, "uuid": "e041c23a-8455-43f2-bb7b-7d7e6fb6d53d", "value": 1051096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698065442, "uuid": "6003538d-43c7-40e1-8211-1ee80c75be38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065442, "uuid": "5f506655-70aa-4efa-8998-1390f5e174cb", "value": "Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77443cb5-71b6-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1698073899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073899, "uuid": "aa0d2412-79aa-4b87-a2d0-6e52c33b33e9", "comment": "Malware payload (Pikabot)", "value": "0e368752842e645b60153c9ad5bd1e95", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073899, "uuid": "bceb1fb3-c8be-4a0b-914b-f3b43d983537", "comment": "Malware payload (Pikabot)", "value": "7471f8ab5781a630f2e2f11fa016b59d7bbcdf3842000cc97f99af87ff44bc9e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073899, "uuid": "15412734-20a0-4fa0-bbb4-5286f0d16e79", "comment": "Malware payload (Pikabot)", "value": "0cdf5e7e0c029c7cd02edfee495572f8e5370981", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073899, "uuid": "2d875f3c-ce3b-4b4e-8292-ad02717002c2", "comment": "Malware payload (Pikabot)", "value": "ff989e30ac741e78dbf25460fd31b7edbf851a883d46bd3d298023d09c7f603db0da071514a72f7f9201ab6b1fe1f213", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073899, "uuid": "63954944-86fc-43af-a50c-a5de86d987e3", "value": "T11075C0907F88C073CAFE0275243B837CD63D96512B6497D363D4EAAD2CE11D28A3B55A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073899, "uuid": "106904d4-e9a9-4b7f-9aaa-fc8549a5ccdd", "value": "eb842ac86186f73eea06f1e518a1bd36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073899, "uuid": "d0cbc1a1-98e0-4c7e-933c-dfbf40180b62", "value": "24576:XI3AwD982Nlh6IG7EeYU7TzGG3AWsXjkgpW9+Krg7rimtstW+35FRbwdzla:kboeKHGi2TkgKm7sI+35Hwdzla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698073899, "uuid": "16467ede-62ea-486f-86fc-7625296c45d8", "value": 1703282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698073899, "uuid": "b62f717d-dcf0-48cb-9b9c-007c559aa7df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073899, "uuid": "26be2a68-c1ff-4fe9-b406-af0f8339e8ab", "value": "ix.dlld", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b2f55d-7197-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698060750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060750, "uuid": "6d7490ff-f5fa-4129-b0a4-bfc8d0225334", "comment": "Malware payload (Formbook)", "value": "270d90d3b1bead21e3a92383138fcf92", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060750, "uuid": "c4c130f7-0df7-4014-ba1b-5d579e47f80a", "comment": "Malware payload (Formbook)", "value": "75fcdbafa4ea33dfc632aa77f5637e2ff8c374203d942e0d354049ddbeb73589", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060750, "uuid": "484a496d-b10e-4a57-b673-0c52ae47ed96", "comment": "Malware payload (Formbook)", "value": "377f40c1ec0841c587b01a64cda69d9829d1628e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060750, "uuid": "cbc381b5-bec4-40b7-99cf-cc0c6751a3e3", "comment": "Malware payload (Formbook)", "value": "96e92f6099fab96139b6a823babe4f486b7af1392c32de0dd6b763e6ae79b365655d53c047fa96393a2b506013bd8659", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060750, "uuid": "e123772f-5385-42fd-82b3-bbc2fa458b80", "value": "T1D5A423147CACB5EA55B125BD2C5164E27F0D74CEB8E9A8B6D1210C0749EEC87B48C9CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060750, "uuid": "d6c14438-0406-41b5-87e6-7c4678fba905", "value": "12288:dO04KkqOMF9h9xd/s3nFNmCTQ2y8rNP4p0qJVH:dhkiDHs3FNjMEBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060750, "uuid": "3d7f4648-81aa-432a-b5b3-5ebc9bb0efdf", "value": 472512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060750, "uuid": "10144904-6a07-41a8-b1a1-f10f0ecd251f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060750, "uuid": "89530760-07d7-4628-94a7-f6efbbdfc667", "value": "Balance Invoice.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1f3137-7188-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698053959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053959, "uuid": "20d359c3-86c3-421f-b600-5f29b645c00c", "comment": "Malware payload (AgentTesla)", "value": "0f69db723766359fb526c834b936ae0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053959, "uuid": "b73b78fd-4a13-4534-a5b8-346aacf564a8", "comment": "Malware payload (AgentTesla)", "value": "75fd3bb81d4bc91307fbd0d9eef7d5c6eac90421ad63269bf45bde3d4d140ce5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053959, "uuid": "db7dbd75-1a63-4c90-a6cd-0ecdfc352e23", "comment": "Malware payload (AgentTesla)", "value": "b813b0d6c8cf3507ec78619ccad79d2c35f5ef86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053959, "uuid": "f4da2ea2-a07b-4c97-949c-f3d907fd4f19", "comment": "Malware payload (AgentTesla)", "value": "0d4340b01462272cfa886dca66b84c7a1fb14275f6899ec84552f73041c04c4ff46ba345c3bacfa14248d3c06b857458", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053959, "uuid": "a03de034-65cf-4ad4-b323-3b3a186f77a0", "value": "T1A9D4237DE249131D3E72516D0EB3EA38CF6342A6E035B47D916C4370EAB5D8AA1252CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053959, "uuid": "1409f349-cf85-41e4-bfb1-7ade89ea971f", "value": "12288:DoXotpZ2NpAVGm5yDtKRgsyoYPk0rcR2+Oz4vzjuBnSZJxEsiTTpE/XMo:Do+pZSpSGWyDtKRgNzrI2jz4vnuBnSZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698053959, "uuid": "10d579b0-84f6-4eea-a63f-4c74a1ddee63", "value": 656003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698053959, "uuid": "8a6e141c-fc59-4ec0-90d7-a2be7b177954", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053959, "uuid": "3b344719-540e-4306-9db8-88c43747871e", "value": "PO#SWASA2200157.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d45b0cf-71a8-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698067815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067815, "uuid": "d6ce31ee-2c2d-4f79-9f12-f1f1ef201b6f", "comment": "Malware payload (RedLineStealer)", "value": "80f4fe4cb01c32409872d1b3eeb99996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067815, "uuid": "aca06c93-8381-4a46-8186-17ade4d4d6b7", "comment": "Malware payload (RedLineStealer)", "value": "7626d2dd4407af235355482ddb811843a11e1355ee50f029cbcccdf1b4bb0907", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067815, "uuid": "2a1aab11-10c0-406f-b061-cb72d1065c67", "comment": "Malware payload (RedLineStealer)", "value": "c35b97c1019201cf441132687e7853fce19e211f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067815, "uuid": "8aeb5fdc-8ba1-46d8-9fbd-531b52ed4f52", "comment": "Malware payload (RedLineStealer)", "value": "2a5c04a7e50c0000b7137aa8b1ef196185b5cfe8740b45bdf7333ee30a44fe913b3c5a83e575a164c434cef80bdfe088", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067815, "uuid": "97fefa49-5337-474f-b41f-f5c3c97b6ef2", "value": "T1F885230BA7D48477EA785B74A8F207C30B327D622439C22F27958D194DB179224B67FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067815, "uuid": "eb35e774-9366-409d-929b-d47360d6dd9a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067815, "uuid": "c32216e1-5d18-40f2-b9f9-02220339bc1f", "value": "49152://U46QxJg6oWcPz4qyRW5xnUZzy5v7CrWVf:3U5uJg6ohP+qCZzy5v7CrWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698067815, "uuid": "d9d7f530-675f-4048-bbda-a2a4b17615fe", "value": 1764352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698067815, "uuid": "eae56f9c-69f0-41b3-83a5-b71de11fe964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067815, "uuid": "ce7211cb-328d-4eba-93d2-f5be7d3acbc9", "value": "80f4fe4cb01c32409872d1b3eeb99996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fd2b67-7198-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698060878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060878, "uuid": "1a593da8-6654-4073-811f-6a79e66b715c", "comment": "Malware payload (AgentTesla)", "value": "831f257b641348c789ee1b7342656def", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060878, "uuid": "42ad157f-8f5c-48c5-9eea-1ada12af8633", "comment": "Malware payload (AgentTesla)", "value": "7687d8e05da221a2989365d6da6e459bc7c15bd2a41917239213cdb1355f1705", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060878, "uuid": "74269e1c-5019-4e83-a053-dfd02b2e03e2", "comment": "Malware payload (AgentTesla)", "value": "63d4249aa3cced079b5bb65feba0c77a8025ece5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060878, "uuid": "afd54da0-3181-4424-b1d4-ef6f2f89c1c5", "comment": "Malware payload (AgentTesla)", "value": "ba8773bdf648ba3bd2d468f3564a2c8bd8cf4f5010852cb44eadd4e5464930f1bc31f9880f4a351ebde911b6f22a12fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060878, "uuid": "7bed612d-515c-4b48-be86-4e902cb5e8ed", "value": "T1F6D423156E191DF0F148DF73A7E887B3B6E7E81DDE44C6B95771400EC694CAAC6240B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060878, "uuid": "a9d8b235-8d55-4a50-a3c8-1708f9700882", "value": "12288:hX7QvvBSGukpyZCYcOPOPEcAfeVgfLR8fKN6WQzycLJb:hX7nKuCYDPSoY/fKDOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060878, "uuid": "85d71cab-393b-46d5-8799-f124e0a298f3", "value": 605567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060878, "uuid": "59ba1a2e-37f1-4ef8-bc11-11c8501c318b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060878, "uuid": "d280be5f-7002-4519-8179-2c23fd566fd5", "value": "PO#SWASA2200157.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6174b02c-717e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698049810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698049810, "uuid": "c1c7214c-b36f-4928-be22-424e22233b07", "comment": "Malware payload (AgentTesla)", "value": "b361cb23f35219b358e8bec2c6f8fe37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698049810, "uuid": "60f5a403-6cb7-4a0e-8e50-7dcf5717e989", "comment": "Malware payload (AgentTesla)", "value": "76a03acbe7e80c8b866720ce7850a4c187e5cf56bbe71b5ca9b402b7f798df13", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698049810, "uuid": "e4bab36b-d791-42c0-b03e-65562156cd6e", "comment": "Malware payload (AgentTesla)", "value": "ba3cbee4cb061a00d3607ee54ee48213ebd67513", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698049810, "uuid": "00d66adf-16eb-47de-8131-2e31b73abb18", "comment": "Malware payload (AgentTesla)", "value": "ed3894094ba922e32eb54772b0183ec8666b9d005a172a52dbd5b1a7f011c23e153e4194b044928060f23e2193ec8261", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698049810, "uuid": "cdf34e4d-b07f-4df3-8d26-c4741d1e5363", "value": "T16B83BD6CD38B01A98F6253779B1B1E4441BDBA2EF34511B5306C837933EAC3D92256BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698049810, "uuid": "3c770e81-2f4d-4019-9f75-c1697f80973f", "value": "768:1wAbZSibMX9gRWjhBc78dRpYUxVlq3bQc6jZS7Qkyyn:1wAlRGBa8dRmkVlq3bUjZS7Qknn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698049810, "uuid": "a183f90c-fbc6-4fa4-965a-d2cd1ee8ccd1", "value": 87494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698049810, "uuid": "26dc1f82-4b7d-4d72-86c4-e02d9ac16083", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698049810, "uuid": "179128f3-45bf-4843-a800-efd06fe69bd5", "value": "proformaXinvoice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1500d250-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698057413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057413, "uuid": "3b5b824f-6d0d-497b-977a-86ff585fbf59", "comment": "Malware payload (SnakeKeylogger)", "value": "652fc277b44f8481ea0fd8d4a661a1e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057413, "uuid": "0784b0c7-7959-4380-824d-71b8397a0f56", "comment": "Malware payload (SnakeKeylogger)", "value": "77206304b64e1d2f6b0f1dede51784cb8fc6b2dad113676fe065de07a89b8084", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057413, "uuid": "8184f3d4-d248-4afd-9bd5-6d00f0679b4b", "comment": "Malware payload (SnakeKeylogger)", "value": "4c2e669b51228ab92a0bcbd55979a234e567da67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057413, "uuid": "a7c38a2b-a048-4626-a503-7a7669f55212", "comment": "Malware payload (SnakeKeylogger)", "value": "632362b3e33ae9668de0015f23360f59f6bd1903d1fea86032cab1939a03224def7302ec83f397fa46468a054f9d61cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057413, "uuid": "e8f46b08-1caf-457f-8369-bf20cfc82fe4", "value": "T19294F18A2B78CB67EA7FABFED0141501077D7B369500FB991E0AF5C908E17458E42B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057413, "uuid": "457df747-66ae-4ebc-ad19-6fc321c9131a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057413, "uuid": "4db960f1-2c5a-40b9-9f9e-cd266b81ed79", "value": "12288:yD7gUiV2OazGypq9Q/NGbEPGLf6JYrOiqo+ip1:n2OazTNYEW6cmip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057413, "uuid": "4acd27ae-bc63-46b2-b59d-0f30530dd43f", "value": 442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057413, "uuid": "81104454-967b-4b5a-8674-55a14a034b61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057413, "uuid": "709e974d-156d-40f3-b57e-15d0dfadda35", "value": "PO_202310.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb41c45-7186-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1698053480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053480, "uuid": "37ac7c9d-761e-4243-8d93-cc3b2b675274", "comment": "Malware payload (Tofsee)", "value": "7c1224b3caff32df3aa976abfa509c8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053480, "uuid": "4f89bcd5-56f6-4f6b-9794-1fb95e3755fe", "comment": "Malware payload (Tofsee)", "value": "77dfc411f339c045e431069b1a54f6026652df482ab802af31df3c9d9ebe0aee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053480, "uuid": "e6492285-a1f3-401a-9f6e-f217c0759b31", "comment": "Malware payload (Tofsee)", "value": "16e92d79850e959a30832a49ffcefd2d117f18f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053480, "uuid": "fe8176a7-8b0b-4e48-8341-8fe40c68b4ad", "comment": "Malware payload (Tofsee)", "value": "bd692a6fe1e78c4362e7097761b6cd6c88886899a702bd579c089e2f3730ea1b7bb37773daa6fc56f5f4c99523a5a0aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053480, "uuid": "854ab566-86c2-45b9-9e43-d9e83681c9f2", "value": "T1A844AE13E2D1EDA0D95646318DADF6E8362EF9718E18E75733187F2F18701B2C262399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053480, "uuid": "f954184e-9cbf-47c6-9f4f-0cc5eccfc53e", "value": "83ea5da75a27345768c26298d1e8b469", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053480, "uuid": "6e5298a3-1590-4c9b-bafb-8714f15d68f6", "value": "3072:TwXAyikKLuiOixBe305RVqMfvYkIe5ST0uamPiCIZ5MEKQRfrAC:whikKL5PxBT3Ke5utfvEKQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698053480, "uuid": "1f79d14f-8c3b-4e94-8d75-7fead5036ecb", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698053480, "uuid": "4e78c403-fe02-4152-9760-adca0b6b277b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053480, "uuid": "16511358-c42d-40e8-a74d-97059d343135", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93fa4966-71a7-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698067505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067505, "uuid": "e7512719-abe3-49da-a99e-faed154e6644", "comment": "Malware payload (RedLineStealer)", "value": "3aab874699d82c941ef0947b543b7300", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067505, "uuid": "2b7f5757-92ce-4ae5-8db9-8dd004316840", "comment": "Malware payload (RedLineStealer)", "value": "78075b4f4be5aef18593b0fe52478c1bb3e561b0322909b3ba2fb0d4ac866be7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067505, "uuid": "9241a55a-b65e-4b59-8083-b33a8a0146f2", "comment": "Malware payload (RedLineStealer)", "value": "3fd9d9f72c1c39b142e124e6d9be41cbf3baca31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067505, "uuid": "5981d77e-6d8a-478d-b432-1d06c0a2d2c0", "comment": "Malware payload (RedLineStealer)", "value": "4d1ac43d47e7e7daeb7b56a002b9ea8ee4c0553e7008ce5b015d159996bffc0b55e7fba3c172b8319fd24315b2b05822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067505, "uuid": "df810804-0ce7-4c6d-bc42-8581bae076fa", "value": "T1AA75235297D018F3E9BA2BB019F273E349333C6259765373A69584BE1DF3694903232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067505, "uuid": "cd074b3b-e588-43dc-a3c8-c84221e8a870", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067505, "uuid": "74496928-beed-4591-af60-ccae17e87f5a", "value": "49152:uQD6tOnr1TzlCkqmVanmJ3UFC9XTIcB9kfqr:x6tgTzAkVans3UFMTr9wk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698067505, "uuid": "b35d811f-adb0-4d2d-9621-3305335fb46c", "value": 1584128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698067505, "uuid": "8d4596b8-fc99-4e54-8e4b-6c347981177a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067505, "uuid": "98a1d837-83c2-4430-940c-d5844d6558f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06ff23c-71bb-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698076250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076250, "uuid": "235e0f20-d328-4aa6-aca1-97d48f7c7dc1", "comment": "Malware payload (Amadey)", "value": "9cc4a16279526744fc2df3193699b0fd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076250, "uuid": "0d83246f-e805-4d12-b66c-b29a3b1e16b1", "comment": "Malware payload (Amadey)", "value": "78f29e74d0868d5d384f76833798f1cedd5e12fe2e6a15d955cf3fbce99d8997", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076250, "uuid": "634e081a-73b1-4f52-a221-148583e899ed", "comment": "Malware payload (Amadey)", "value": "436dd121e25a87fdd63133b4539d549ee64492e8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076250, "uuid": "a636e7f7-6f0d-481a-83a4-4aee9cfe56ae", "comment": "Malware payload (Amadey)", "value": "4cf5c8cc4391ff8dd3fb8ea983cd4510b6a2037a61a75b5496cf3c68eb2759239125dee968562900b52b97390d4bb9e8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076250, "uuid": "b9002d15-b568-4a19-b6a1-67c92a855f4f", "value": "T1937523A3F1F84932F8BE07701AF9239305353CB3553587462290EA891DF27A5DA3672E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076250, "uuid": "cc2eace4-56a5-452d-afe9-e2faa56e9f71", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076250, "uuid": "ea3e5658-40d6-43da-8ece-5aa80cc2d783", "value": "24576:1y1OjJIfJOdbwPayutqdT0zw5TzXr7nH9GCryXhGhq069beao2mLesdIusZ:QwjJ4gOPvd6wJjH97ehWf69UhLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698076250, "uuid": "9ad4d5bb-6b70-43d4-b041-66433461ad79", "value": 1581056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698076250, "uuid": "57df7bd6-5db8-4269-9602-e31d5df33f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076250, "uuid": "1a97ed75-d3ae-4839-8fd0-8e4f4dacec63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117797a7-71a9-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698068145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068145, "uuid": "4290bbc6-b4a4-4d06-952a-0100285fe3b5", "comment": "Malware payload (Formbook)", "value": "1c874a3660b5ec5b6d9666e5622ee3db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068145, "uuid": "18548f11-387f-4773-b95b-c12ed73d3afd", "comment": "Malware payload (Formbook)", "value": "79a182aeec51b93ab6de3bc1a784799ad7ac9622aac54fee587024865bfe6d1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068145, "uuid": "76f52d9b-77b5-4557-9038-f824ac22ed22", "comment": "Malware payload (Formbook)", "value": "e2f1af54d7eee02f0489b4db04389044676b9c81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068145, "uuid": "f5e7d3f5-9231-4575-9091-fe75e431c439", "comment": "Malware payload (Formbook)", "value": "5cfba231195ec4552df328ab0288cb294a8761340c5c71848b8769c7e626b1028f613f55fb903e1ec37d84da02dac45e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068145, "uuid": "8605f8f8-40a4-4ad4-8dd1-648d02763036", "value": "T17C752312FBD10433E4341BB054FF6783193B3CB668A44B9B2A85996A1CB3768E43576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068145, "uuid": "7f3344c2-28ec-47bc-b5f0-3ef1884284ab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068145, "uuid": "ce291b37-1bb7-4ee2-8fb8-e14c3c320ad6", "value": "24576:zycFHLYEdH4G3We0I5BMXDt1UxxoTm5GlW4s6kioxRAelA7d62A5da1k:GsddH4GGe0IinUx20GE4KOP6Na", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698068145, "uuid": "5673c88b-30aa-4f0d-9ab5-ad90a9763ec2", "value": 1583104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698068145, "uuid": "75ce73da-615b-44a5-8914-cf2fcb7db298", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068145, "uuid": "a8a35219-aef0-434c-9f8b-7e4b230e8a29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ffc489-71c8-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698081841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081841, "uuid": "2c2908ca-e83b-46ff-936b-2dc25415693e", "comment": "Malware payload (SnakeKeylogger)", "value": "a7e406a5384a28f4ccc5a7267d32eefe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081841, "uuid": "266a240d-6cd6-4764-bf9e-6f01701416b6", "comment": "Malware payload (SnakeKeylogger)", "value": "7a11bbdedde47ea79c363c4a1c607d39deb591433c970c710d9310162037be4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081841, "uuid": "7d9ce180-163e-46c7-bd63-a5eb452651c3", "comment": "Malware payload (SnakeKeylogger)", "value": "db3a4ca66734359ba1e0b1d3bce800efc954c1ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081841, "uuid": "09c6dc89-29b7-4d80-bd0d-57ad4b12a242", "comment": "Malware payload (SnakeKeylogger)", "value": "7ffdb1c42c1c4d63333d1da23cf68a645161bea85f94a9550bcc3187c0d93f11eda6d0c70b632135fde5157b8cc76983", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081841, "uuid": "60c60d8b-c7d8-420b-9816-e0a65b8f9c29", "value": "T1B464021E33DC5A22CB5C2A7ED59261B5037CE5B26F17F35EAAD800DA1927BD0840D7E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081841, "uuid": "9ee19368-ee88-4b85-927d-96b915e1705f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081841, "uuid": "2a54ecc2-adbb-4005-804d-7ee4808d6125", "value": "6144:tRyDjxdpk5cGr90DqZDrUN9uy25EGFGMghhapd8b/fNMIpCO:tRyDtdpkOGrmDqlriKE9DrbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698081841, "uuid": "05428340-f565-47f3-9645-a137b1dca746", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698081841, "uuid": "3d2cfd2a-b03f-4f8d-8072-8789cd389f4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081841, "uuid": "fad6afed-c1ab-40db-b95f-89386c242494", "value": "Glbmmjsnr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff6a50d-718a-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698054935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054935, "uuid": "8385a0d2-95bd-4af5-873d-9558ad482fe7", "comment": "Malware payload (Amadey)", "value": "751da4aca942b23f740ae084b5f7d4ea", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054935, "uuid": "30dde0f2-dede-4088-88c2-9ac0b83fe10d", "comment": "Malware payload (Amadey)", "value": "7a97a9d898febbf368878eda37494f61dee5a64f16a780d2a75165563e540e0a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054935, "uuid": "43e2816b-2c9d-456a-ae48-cfe3c6c65f33", "comment": "Malware payload (Amadey)", "value": "478783cf3eb265fcf138c3367baa7c24b777c4f9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054935, "uuid": "769e8af3-8e4e-4d01-b6d2-c62f3785f9a4", "comment": "Malware payload (Amadey)", "value": "2a9600c1bf1e349827cf5dda85b545575808d407553fc86f6869416c79438e7f155a7ecbc67925b8ba41ef6fdf9c821f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054935, "uuid": "093afcb4-db2d-4c0e-a329-eac0ac31e19c", "value": "T1DC752397A7E5852BCCA01BB458B701930E363DB0DD614A4A3BD5CA590DB36C8F931B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054935, "uuid": "38010745-c08c-436c-ada4-3c838cc108e4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054935, "uuid": "1b0ee039-666f-4e6a-9098-25a83ef1c59b", "value": "24576:fyk+alkzCC+Ph5vFJzx+m1JEBwGeO2XgyjKS3aexI+9WTpSsz/E2ANxjmzYf2kI:qDbfUhxNz1KKJ4DemTpdzEt5Bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698054935, "uuid": "170dea0c-970f-4842-808b-5d7109438b1f", "value": 1588224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698054935, "uuid": "c3359bf5-b1fb-45ca-b3da-9678db2f3072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054935, "uuid": "e84e1132-9d46-445b-b4b9-70e8e6264c15", "value": "751da4aca942b23f740ae084b5f7d4ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dcbb0bb-71fc-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698103787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103787, "uuid": "0275200b-d46f-4a00-88a6-9a162b4854b2", "comment": "Malware payload (GuLoader)", "value": "39022eff0b28bdfe77897a0fc5ff4920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103787, "uuid": "b991d2b1-277b-4c4b-bbd2-da00417d5ac6", "comment": "Malware payload (GuLoader)", "value": "7af525c73aaddfe3f532acc545ee8044bae61fff536cffe4db15edf5b5e92454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103787, "uuid": "1d92cbcb-671e-4c8d-be18-9206746e9f99", "comment": "Malware payload (GuLoader)", "value": "fffaea32c7e1c83e96fc8d195d78e03029a133ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103787, "uuid": "5195bb9e-4276-4ae1-8b8d-4d7eef44e070", "comment": "Malware payload (GuLoader)", "value": "40f3e5d2fe18ff6b390ec57f93aa0504719b1f96f6bec733722d215d450987a3c538a6742f73ef45699a5885f323e926", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103787, "uuid": "c1223c63-a4af-42da-973f-8d70f7deab54", "value": "T147641297AAD198E3EDDB29740D36B7D3B3B7EE0E5410861BA768BC474C01285CD342DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103787, "uuid": "0878d3a5-dee0-4e3d-b79b-835e5e511e03", "value": "3f91aceea750f765ef2ba5d9988e6a00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103787, "uuid": "bc5f8a48-d46e-4cdc-b9de-199e8e08a69e", "value": "6144:QMrudbcDdgFhMYFKLy6EQSXL0tLJj99VoftBbxSeTXnUwU2:QfHB+ZSXL0RJJeTxSIXnA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698103787, "uuid": "814ca0f3-4310-4fe5-b5d9-2ad13ef01259", "value": 315737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698103787, "uuid": "8f42b636-8363-4607-8584-3d6554c595bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103787, "uuid": "83f0828d-fa00-4dbe-834e-0fa36b18e77d", "value": "rIMG-2023010_WAAa646737kendelsesordniGenicular.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95e6dbf-7193-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698059031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059031, "uuid": "e953c428-3643-47f4-b024-1c8b8e0fd25b", "comment": "Malware payload (AgentTesla)", "value": "2cf04556b328c8d1c37d8c10da0919fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059031, "uuid": "47d4379e-5dbb-42cc-8cd7-cfbdb15823b0", "comment": "Malware payload (AgentTesla)", "value": "7b0b61c1d70509e64d368db1ad60e185781cda049714ebefcee2400ee46d9a58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059031, "uuid": "0b0f4253-1314-4f5d-89ab-04886d6c0a52", "comment": "Malware payload (AgentTesla)", "value": "97ded19649f54f8f24c32ed5ba1b692279a20529", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059031, "uuid": "4a56d17c-187b-40eb-b022-38c2c63e5894", "comment": "Malware payload (AgentTesla)", "value": "a28747f588452b98790c61a0466e94f78560399a7833072d880200d126cd8353fadc48e056e8135aff521bafbb44de88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059031, "uuid": "f014ffad-65ef-417f-b552-112d09cf119f", "value": "T168452253B244405BC5DEC3FB4C621A772EB4A6421624D6CDBCBE34DAEFA5F5008E1927", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059031, "uuid": "09d448a6-543d-4008-9436-af2eb5c14696", "value": "24576:oOCvomxyqe+IgTCDcPbm1pzn5rDF9ylO:RXQXdKcPbWb5rDFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698059031, "uuid": "4639cdce-d331-4297-9b2f-ecf92252ded8", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698059031, "uuid": "fd484d04-3091-46a0-97d6-f4a9aff9cda0", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059031, "uuid": "e2d6509c-0464-40f2-818e-374042734ac0", "value": "PO 210993484882.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fda27dc-7158-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698033487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033487, "uuid": "90b28ccc-ea30-4ee8-ba65-37b951c58334", "comment": "Malware payload (AgentTesla)", "value": "b7f98625b6f4dcf82c2aee79c751da3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033487, "uuid": "8402c2a2-b2e0-4ab6-8b21-e114edd7bc4f", "comment": "Malware payload (AgentTesla)", "value": "7b6ab8b6e40ad0f4f6685c8a98dbe53e44ed1612c680d4f3720666f9ce02df2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033487, "uuid": "d5a9870c-9279-4aac-8ade-73240ea25a01", "comment": "Malware payload (AgentTesla)", "value": "53c4b03c4f164d5c9c950c13851c00dd12bb8b28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033487, "uuid": "ff6533bb-e2a8-435f-929d-bf164aa3e4e8", "comment": "Malware payload (AgentTesla)", "value": "afd5e178b9ce0d6e887c2e6b151be9fbbebb960a9009c309e5f1392e27321222b864f7fbfdb5e6d58349d988a87cde74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033487, "uuid": "a2a5e6f1-83ce-4064-81ea-d7f9bb7e45ff", "value": "T1D334171035EF901C7273BFA71FEC79EA8E6FFB66593A606A200403564B53980CE65772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033487, "uuid": "e114a94f-2b56-4699-9ec2-a7314fe52739", "value": "6144:IpGSEpAp4SY6APZHRSe41sSm4SQ66BuZyqOHMSe4KOmZqc6weSwzvlV8z8vT1UTn:IoSE+p4S6vSe41sSm4SwGtSe4KOmZqc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698033487, "uuid": "bf26c871-c99d-4c8e-afc0-6aedc941c19f", "value": 246924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698033487, "uuid": "cd7e5451-348c-420e-aec1-a46edc068b42", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033487, "uuid": "80ce0ba8-32e1-4da2-ad4f-4b57c3d1058d", "value": "045c256e47200d5e03315657eee7ccef413f2efd3a863c7bef63adfe.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bdcb73a-71cc-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698083302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083302, "uuid": "81b68d4f-7e26-48fc-a530-1bc27d644976", "comment": "Malware payload (AgentTesla)", "value": "d5c378ffc39b23bfc2b24bc1ba14f0a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083302, "uuid": "242c36bc-1bc8-4063-bd23-cfc270099b03", "comment": "Malware payload (AgentTesla)", "value": "7b77311dbfef045027187823c8c541f530a599d7e289a5889a34bba0fc903914", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083302, "uuid": "3876ba69-9543-45f3-b62a-88c9300eecd9", "comment": "Malware payload (AgentTesla)", "value": "4b5f15410fd7063abf26719dd65e9c4afdc8e7ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083302, "uuid": "db4466b3-a67f-4d6e-9b03-78f3143b0812", "comment": "Malware payload (AgentTesla)", "value": "35486cc2eef5fd0a759f6fe127330ddf163e47fa48a363ea06df4930399ef90def1afb332bd034bafae3f51ef30f1ee4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083302, "uuid": "c3ff1e86-dab9-443d-b4e9-b83b8fa63a0b", "value": "T119D4239435BB03EF9BD94DFA5A053A4D4FA5208F11ADF8227FFF4640D046251A8129EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083302, "uuid": "e5f3d6c9-00d4-4274-8a23-3eb883012e3e", "value": "12288:4UCBJxzR+vkUWc8zDH+/SzaAdODQFe5CdmnwHTPMBpStnPjc:K/1UEzDHSOtkDvCiIEWnPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698083302, "uuid": "a8688941-bed0-4adf-9737-9f7c9cbf5962", "value": 633307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698083302, "uuid": "beb5c875-4dad-4aa9-8c2d-d16dcf13ca2a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083302, "uuid": "8f2e09fc-7799-42ef-8aa8-44aca77a8518", "value": "Purchase_Order,xlsx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a69eecd-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698057583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057583, "uuid": "b384826d-412f-40ca-bcec-6e3817f7c254", "comment": "Malware payload (Formbook)", "value": "1b8a635b8570eef963f2a2510898db23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057583, "uuid": "ecd34002-9b68-4590-84e7-22483bea327c", "comment": "Malware payload (Formbook)", "value": "7c0cd3853233771f97e91d68981a1c5e00fa37263e4d1bb2e9cd6a3afb57a82c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057583, "uuid": "f04ba850-953f-4146-999f-a3348ad863ab", "comment": "Malware payload (Formbook)", "value": "899aa360ea12dc812c0e1f583056946a2e63548e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057583, "uuid": "3671172a-e911-416d-ab57-d3a0498f3f0a", "comment": "Malware payload (Formbook)", "value": "45df80279845110dfb534023afad7e764c93b44768890922b58972dc0795d530d18a19036dcbb97cd66fb2c0d1e7ca8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057583, "uuid": "3b95023a-df1d-4b19-ada0-e67dc74d11fd", "value": "T1C915F73804780A12C139D2BD9AD4F613B3904F96651DCD6686814FCA0AD6E2F2DDFDEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057583, "uuid": "39e260db-cc3f-4a21-b9ec-4a47024e54d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057583, "uuid": "c4f22a04-db36-4d0a-9fe0-61a2fdf29149", "value": "12288:NEKaJAEX6DtNPYhVAfNP2rXfALpfktcZ5ndPdY:nzB0VAfN+bf2fVZ5lO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057583, "uuid": "18a5939a-76b7-46ba-93f6-661fb7058a68", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057583, "uuid": "e4aaf189-6ed6-4081-b8cc-3edf00f01708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057583, "uuid": "5f75e905-3ab4-4438-8427-68e51f1fc4f3", "value": "\u8be2\u95ee 2101-2307022.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b8251f-7176-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698046466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046466, "uuid": "74dc8270-d5a8-4847-a359-1c85a3955f72", "comment": "Malware payload (AgentTesla)", "value": "ad779ae9351217984ae38eb94089a02f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046466, "uuid": "03de2c37-1170-4277-b5f2-d63c32a9d653", "comment": "Malware payload (AgentTesla)", "value": "7c82e5efb828ae672d131f3b37ff0c4a4d7307b647a5d42a7f2d573584909e3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046466, "uuid": "820156f9-dac8-42ed-bb29-2839087b3476", "comment": "Malware payload (AgentTesla)", "value": "31d73b286e2139c76eed2031dcda0bca44178844", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046466, "uuid": "958f7a29-0a6e-45ce-90cc-77fe306e6ebe", "comment": "Malware payload (AgentTesla)", "value": "cc2709d77c68921adf76926b4b350d8e567dd115419a930005a245a39ddfde6bf910befc32db1991935dffda99b28f9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046466, "uuid": "84b80ee0-a003-4ccf-80ee-e556913cb954", "value": "T165E42347BA74C7B3C55F03FA451926A087B27E115012EBEE8E84B4DDBEF27021E2465B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046466, "uuid": "86d93d71-6199-4743-bdef-0f2a47c80476", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046466, "uuid": "2b246ac4-f5f6-48b7-a830-29a084f19dcb", "value": "12288:Db5yzvbYmBHreGEuARVotWGDF8p4K+YKKKCaQjzqH1aPsF9XjEG:hebY0KVR8Wc8eK+YKKR2V95j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698046466, "uuid": "b64d6f95-80a8-4375-a4f3-f73becdc4ac6", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698046466, "uuid": "64fbc756-e5c1-46f4-a377-7dfbca10b62d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046466, "uuid": "b4306e2b-faa4-47d6-a170-7a252cfca2b2", "value": "SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e40acb2-71a8-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698067951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067951, "uuid": "c2e297ac-af09-4a7b-98e2-485a4fd7d66b", "comment": "Malware payload (RemcosRAT)", "value": "09f5a737c5466e172c97545553a0f6a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067951, "uuid": "526e57c8-0a19-45b3-840a-820144182802", "comment": "Malware payload (RemcosRAT)", "value": "7c93d76a0e9fcc56590bd9ff9aff722afcca47c6645df567f4a38fc79c57e40a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067951, "uuid": "3f1416b0-b23d-4699-bf70-9dd73c7b735a", "comment": "Malware payload (RemcosRAT)", "value": "31dd5e67d5dc19d3977fae09dfc0a044a60940c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067951, "uuid": "d037fac7-0fa8-4924-a05d-8a1966f87732", "comment": "Malware payload (RemcosRAT)", "value": "c73f605b76e82f17a1a4595969ae4e6e89c0fb496c53012eb12bd7ccc26f3626b386e9af13ea11657183cfe05cde65c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067951, "uuid": "b2788612-dca0-4ff3-9c5a-ddb46b344b42", "value": "T1C52502C6D98047A1EC2CABB854726C2543A7FD7ABC74F14C9E5970E52BB3793403298B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067951, "uuid": "457486cc-a7da-4d10-ae3a-ab4c184dc690", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067951, "uuid": "5461b41f-21b0-464f-9387-f1b93502d8e2", "value": "24576:bDDxs6gD51G+ciyeRBfpZ1Dc4y4H5ZfHMzuBtjgZ1PDAct7+:bDNs6gDzGLiJZZmAH5Z/xaDAO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698067951, "uuid": "3a2cd790-dad5-4a3a-a8e8-3a1ac928ee44", "value": 1030656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698067951, "uuid": "ff4cb8b1-9e5d-448f-96be-8a7788436d65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067951, "uuid": "8a812134-e39a-414d-bba8-9accdd4b625d", "value": "PJORDU23ED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374a3406-718e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698056612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056612, "uuid": "d319fbc2-ccec-4609-97de-0cf44a623602", "comment": "Malware payload (AgentTesla)", "value": "7fea4d54b433a39c9c37a45917d99289", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056612, "uuid": "b7d10926-64b7-4220-b89e-1427cd715f8c", "comment": "Malware payload (AgentTesla)", "value": "7e612c958b630e712ae8a230539d4e5706a8ed341c091805addb149a80662611", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056612, "uuid": "cf9d4a9f-4f8b-4828-801a-ce800d48d39b", "comment": "Malware payload (AgentTesla)", "value": "6bb3f767bebd631db2e439c529dd674b98ed738f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056612, "uuid": "74c08917-b225-48a7-9c7b-1a498eb85a43", "comment": "Malware payload (AgentTesla)", "value": "5d2ec1b5095c7f5317502f5556dd7d6c24416de178b9de9b1a46b2a7a2bd1ce00cd7aedf04f2425a5b7ae063e0d3c0ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056612, "uuid": "d227d86f-0a49-449a-8c8c-3552e9a83a67", "value": "T181D423CE3A804315A61FE927444A999785D4DFB0A86CFB9219C42DE5259F3930CF73CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056612, "uuid": "35e68402-792f-4690-86a2-12c84b3adf1c", "value": "12288:UienWS3/iO9hmjj8nGxhYBJ49vIdoaxSvJfcakAJEpHzzGj6arBVKJC:UzlVhznAYEIWYSvy6JwerPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698056612, "uuid": "a40f5531-f6ec-4d20-b78f-196715af002c", "value": 639711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698056612, "uuid": "68eae7c8-6f91-4bdd-936d-fa7c33b23e83", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056612, "uuid": "9334bcd0-76a2-42bb-ad6a-4fdc36f5e4e0", "value": "RFQ2 Guyana Event.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7353a495-71bd-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1698076899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076899, "uuid": "ed054212-663c-42dc-994a-2d7b8dd82dc7", "comment": "Malware payload (MysticStealer)", "value": "e40a0bc5d83890eea4c54caa668f8f98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076899, "uuid": "a1002f94-7c25-4ec3-98e7-95d2e261058e", "comment": "Malware payload (MysticStealer)", "value": "7f10cce7bd835c0a69ce067711dd9a6b64a7ca180cdede2a6ca37d297c4511d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076899, "uuid": "0bf4ec84-9cec-4da7-b97e-b8acb436b284", "comment": "Malware payload (MysticStealer)", "value": "b2e1a85d22bf8efdfdb8a017560da2cf0a7549e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076899, "uuid": "2ef98f65-c3ee-43ce-be21-6ce361fab2c8", "comment": "Malware payload (MysticStealer)", "value": "18da04584ba6b66989c8850a78ff10ba1efebbd7859f3e16d999fa2d45d5b95e87ec55528b25016e054ee8ab1cb6ecfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076899, "uuid": "49d7aeff-32f8-4cd8-ae12-6825f69f7ff1", "value": "T176357DE039D0503DEDF220B647ECB62982AED4B0072955CF12D816EEE750AC17EFD696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076899, "uuid": "c7718705-ecfb-478f-bfb3-00e783cc34f7", "value": "440e77e14aa712e0e687ae6e10b63f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076899, "uuid": "cb8549c1-e898-4bc0-b3c6-391df08c6b4d", "value": "24576:4NmtwQOC4b6SxHHHHHHHHHHHEsy5EVrnSpiqezeAlnmk:tOC4b6GHHHHHHHHHHH2Ehqe3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698076899, "uuid": "1c226186-ac5f-4e97-8137-1496b1caeb7c", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698076899, "uuid": "c0d094f4-226e-4da5-b035-077dfe24d7f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076899, "uuid": "7f7fd093-ca41-4999-adcd-678341482ebc", "value": "e40a0bc5d83890eea4c54caa668f8f98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554168ce-7149-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698027027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698027027, "uuid": "429cebeb-7f50-483f-9d43-4eeb785bf06d", "comment": "Malware payload (RedLineStealer)", "value": "07799e968f282513fa6fbc0aeedd04b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698027027, "uuid": "543ddbd9-a95d-481a-8ba8-38f3f2f95d7b", "comment": "Malware payload (RedLineStealer)", "value": "801da7d6cedd0ba03ad2ded6f85e726451ffad38d05a02b5aba0d26659641448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698027027, "uuid": "db60cbbb-85ec-455d-ae60-c152db05a24f", "comment": "Malware payload (RedLineStealer)", "value": "8fd27975b3b47476ac3311172c85160cfb0bdb75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698027027, "uuid": "863e1d0b-8585-43fb-8eaf-48c396ea382d", "comment": "Malware payload (RedLineStealer)", "value": "07ae99f8277f782049e2a447d432f4e44d701f31521259110ea6bbcaa70092f3b1082c7b6930f953bf74a02d85a33523", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698027027, "uuid": "7d05d869-4dc1-4c4f-8e1f-e75b9fd973c5", "value": "T143840243EBF94173D8B117B058F703870F34BCA299B8835B6B96A55A0C72AD4A472737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698027027, "uuid": "00216f27-150c-4438-a616-896995b7c449", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698027027, "uuid": "735c575d-72cb-48b5-98eb-6142d2c38a5e", "value": "6144:KMy+bnr+bp0yN90QEibsyAv++JO+vQkojjWSf/+OwKtBVpmwebbSgRMYp5Ux536:oMrTy90ArAv++J1L4Nf/zwKXVziB5UxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698027027, "uuid": "26e1ce18-9826-4c32-8c5b-d64090db2d1d", "value": 379904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698027027, "uuid": "f857ba04-ba69-49d8-8d4b-aa49695d8ca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698027027, "uuid": "28d06b50-0241-4584-aa16-62156d403b8e", "value": "07799e968f282513fa6fbc0aeedd04b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f675b8-71ed-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698097526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698097526, "uuid": "977bec26-12ff-4d2e-bf6f-e8003fb87d83", "comment": "Malware payload (Amadey)", "value": "f70c98b8c441005f2052bdfad0c8ffcb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698097526, "uuid": "aa0f5fe8-1ef4-4716-aa17-31497cb1250e", "comment": "Malware payload (Amadey)", "value": "81a4ae1d234a6b34935dc6aa3d76065be24a52a900a0b5704cb8544903eeb740", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698097526, "uuid": "f2b8f5de-13ee-4234-8e18-b158f8a9caf0", "comment": "Malware payload (Amadey)", "value": "8545527878d9256a80acb28194cb2d06f703917b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698097526, "uuid": "34d23983-1059-4f67-9b74-33f59c93e89c", "comment": "Malware payload (Amadey)", "value": "f8c48c0568537340614944b00daa365b97de28d28016dcb5361b64f593ba2b4f8ae8c2cd20de0100b1f67eb54882c836", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698097526, "uuid": "470908c0-8925-47be-9c8d-e0386e6386bd", "value": "T1A08523017EE99072F43007B29DF542971F32B8B8CF79A6DF134A619E44B2791A435BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698097526, "uuid": "68527bff-df24-4f38-bff1-fb29808a7be7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698097526, "uuid": "f97143f9-01c6-425d-bb76-9e11c5413690", "value": "49152:6fG8E4Pp3iOm0+7dqvxW7ZfAyO+4b1Va0o2VE:w+4PpS90+JsxW9AyO+wV4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698097526, "uuid": "29b24a46-f594-43aa-9218-6baca3907858", "value": 1764864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698097526, "uuid": "52f4e43f-12c3-4138-859a-865db9a4d0e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698097526, "uuid": "ee316ccc-8607-4eb5-8ba1-e2a105cddd4f", "value": "f70c98b8c441005f2052bdfad0c8ffcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72da00e-71c9-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698082274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082274, "uuid": "041b3dac-46fe-444f-89a5-d09a74450de9", "comment": "Malware payload (MarsStealer)", "value": "36c3a21e15e4baa4b7397b83de69b4e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082274, "uuid": "ebae038f-914d-44bc-9245-7fe4c331b442", "comment": "Malware payload (MarsStealer)", "value": "81dc4e840be63ced06cf2949a358127e2f9e7bbf917aeea7181a46ab58353f75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082274, "uuid": "f0b8490e-46d6-4015-80f7-0a2fd277d446", "comment": "Malware payload (MarsStealer)", "value": "7b33234bf595976d925e287fabef6a148c611331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082274, "uuid": "f0b46702-f31c-470d-88b8-8514c46766da", "comment": "Malware payload (MarsStealer)", "value": "c9963875ef69c965cce5acc1d3744a35e66cc3635ed87ecf2b7fd3f299f6785e6892fbb8f742a5ba71f66230769f72f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082274, "uuid": "0ea02e75-8f12-4613-8d91-9dd45e0a4ec7", "value": "T1D8650613A1CE8D36E33E35386AF711B448983D80B664A8467FD87ECB0721A7965DD34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082274, "uuid": "0cf1d201-341d-4b5e-8039-6c098669a2c0", "value": "f5fcef2eacb86c1adad598b65c67a3ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082274, "uuid": "0d7fc28e-8f51-474d-b1aa-ffa55ed2f849", "value": "12288:bRgcdrhCHwfbv7rHMUtXe44Lzyne0txn+9WXH3ML:bmqewfbv7IwOlLzyne0txmWXH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698082274, "uuid": "ac20f2d6-1745-4b6c-b9a5-be384ff0e107", "value": 1433088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698082274, "uuid": "13e8feee-e688-49af-915e-642e68f85e31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082274, "uuid": "e25c6c7d-057a-47cc-a3e6-d468e3efd748", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.37990.26117.18224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766da33e-71f4-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698100526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698100526, "uuid": "890c5e7e-8a37-4a63-91e0-87e9e6bd6bdc", "comment": "Malware payload (Formbook)", "value": "b805c094194c6f780cb8660d2af04887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698100526, "uuid": "b4a31a0e-b1dc-4cba-8abe-ae1d8e4c06d8", "comment": "Malware payload (Formbook)", "value": "82151f2b7b7b8082b367f1bced5ccb551ee511c5df009957c9183e423799416d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698100526, "uuid": "a757b49d-b745-42ba-909e-6762776ae453", "comment": "Malware payload (Formbook)", "value": "8ff0835ce83ace33fd3e2c23794852c7028b6976", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698100526, "uuid": "0381f5a3-48b1-49b1-bff6-e3842ff58801", "comment": "Malware payload (Formbook)", "value": "60e517b3f88683b5de2d0338230c04f1be50bcbc24ece135243ef68b590cbd6245b191a0e935619f2ffecba562d8390f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698100526, "uuid": "75d36d49-680d-435c-826a-6a426b719812", "value": "T199049D11B4C0C072EE62193609A0EBB19A3EFC340F54BEDB6BD8167A5EB02D19635D77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698100526, "uuid": "c16425cc-ca5b-406b-a8e5-eb2d6dc9263e", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698100526, "uuid": "32e9d1fe-c9ea-43ac-afab-81e163e5c859", "value": "3072:RDQrvizKw/kal99mdVeiOEru0PIBiceQcbfmxujfdrxnd:RKK3l99cV4ECTwfmU7lxnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698100526, "uuid": "32d64b4f-fd51-4873-9a96-61887d4cb463", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698100526, "uuid": "83b2b5bd-f042-4f09-9f8a-112de3fb9f05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698100526, "uuid": "7e2a2b5e-e323-4384-810a-9efb12df5adc", "value": "b805c094194c6f780cb8660d2af04887.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2daa9a5-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042726, "uuid": "81f79994-9580-4e5c-a4ae-25ada74b2be0", "comment": "Malware payload", "value": "e2349df823ac65533ee0394445ba988c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042726, "uuid": "e4e6dc57-04dd-4c6c-a728-fe8486686230", "comment": "Malware payload", "value": "82b408f5f641927cc56e715b4278cb42a55e7c6e7823137ae7d038527265d680", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042726, "uuid": "fe13dd94-fae9-489d-8a45-eb36b9d67822", "comment": "Malware payload", "value": "c26c42e685b5c9bee8c077e165e276cb79f5f521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042726, "uuid": "27e20903-64dc-440f-a010-b2233f9b8ea7", "comment": "Malware payload", "value": "8eb06f10337f7e479ef695f29ef1ba8ceb178a61c290803d8daf614fc71e1320c78d67195d53d1a10c46e52e64574d27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042726, "uuid": "fa026662-5f57-4669-9b7e-4ff9730dc6e3", "value": "T1D6D42293BE0CAB39C05481308486CC291559FE4270EF9F4B68D37F4EEAB7B45B6415EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042726, "uuid": "ce90c5c8-e73a-4d0d-bae7-fda017d0db50", "value": "1da69c7906329104212d818f6eb91619", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042726, "uuid": "026de520-b0dd-4bac-8b12-3a0f98e94617", "value": "12288:rKJVueImTiZNUn8bsqSLNhIlj7DKAbF04nknwi7myXSd2qynqYi:6ZLTifU6xSMh7DKQZnJi7HXSd2jqYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042726, "uuid": "fcf8782e-2af7-40f9-961b-a3a7f917e3f3", "value": 652520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042726, "uuid": "f6e9b9a0-8393-4468-8e3d-55b1be320478", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042726, "uuid": "93ee7e8c-205a-4f6d-978d-d3a59c0e84a9", "value": "SecuriteInfo.com.Trojan.PWS.Banker1.11145.28247.10243", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061e705f-71d5-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698087023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698087023, "uuid": "11115e7a-ab99-4b63-b96a-cafc9f79ba18", "comment": "Malware payload (Amadey)", "value": "0497ae1221b57520f42af36b3d70ca27", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698087023, "uuid": "c3eec003-7ee5-41bf-9206-b97c5b6b478a", "comment": "Malware payload (Amadey)", "value": "8360f53194e528456bfb45175b7d597ec6c4dabfa448badc0ddef2525c691fa5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698087023, "uuid": "aeca3391-9c4a-4890-b493-7a5890d3ba8d", "comment": "Malware payload (Amadey)", "value": "599c86e2bfb67fe3c2fd124816c3f106f0b1e837", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698087023, "uuid": "aff9313c-c19a-4ba8-ab9d-f34cd5bba775", "comment": "Malware payload (Amadey)", "value": "1e2cc743b28686c0aa81e617ce1282b36d6b2a6f8249dc9cd47c0ad19098784d9a905adf889659cb230d54f476cab54f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698087023, "uuid": "b3c3c22f-a9c2-4ddf-92ca-1eee461ff3f7", "value": "T17285FA1176F95B59F9F30FB85ABAA611487AFC6ACF11C2DF1250908E0D21BD09970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698087023, "uuid": "c7bf0d9b-ba34-47d6-9fd9-0dbc7bd9c98f", "value": "a23cbfa58d4baffb298f8e637aac34ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698087023, "uuid": "3041f793-df5d-4424-a03e-ec80cb7a6b86", "value": "12288:qLhyjMAfS5S8a1TxCZG09fEGjQSHC6bELuzzc9X6a9DhvhhqGtWXI2:qZAfS5S8a1TyzEGdxE6a9Dhvh0eaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698087023, "uuid": "fc2ae7e6-2008-465f-9c9a-f7ea63bd3d36", "value": 1724928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698087023, "uuid": "587f2c8e-4913-4c1e-af52-193b5cbde09f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698087023, "uuid": "ff2ca9e2-85ad-468a-8791-1457446a3f5e", "value": "0497ae1221b57520f42af36b3d70ca27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb03456-7164-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698038553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038553, "uuid": "67076e49-65dc-4b24-9e77-bfec7825ae40", "comment": "Malware payload (AgentTesla)", "value": "62ca5bc3a7b05b32496fbb7688c99057", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038553, "uuid": "b59222a1-82af-46a2-b816-c2f75647a94d", "comment": "Malware payload (AgentTesla)", "value": "83a0494e66fe488396045de3283a3b15077cf14a47218a61dcfb2820aacbac97", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038553, "uuid": "81fbc7bf-6ce2-41f6-99ac-4273940dc039", "comment": "Malware payload (AgentTesla)", "value": "b177a1188c8b1a2b9662a4ef92073fa2fe077c83", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038553, "uuid": "051183fb-68de-490d-8915-daaff83686c5", "comment": "Malware payload (AgentTesla)", "value": "2bc16a3d1bae747eab82d97753322a0f4fa9ece7fc597fa654f2ed8a01a1ea6698916b598061a81dd66b9e68d3229708", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698038553, "uuid": "82e9a5d5-a61d-4a84-b0c4-6efa31165ee6", "value": "T18A9433E3C1A9BC2F4B1918F38B5215B6E153483F7B33A5F2B1873A63B51C82411D9E19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698038553, "uuid": "d0a0af56-3d5d-4f1f-a9c3-bf72e7bf665e", "value": "12288:zVnJmFdr0VH6Hb6Ucl6DrySGjwlY9hUaUDF:FJ6wa76+DrUjrTUaUDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698038553, "uuid": "fbd42470-700e-4875-80f9-c8ccbe370495", "value": 416502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698038553, "uuid": "15e43c85-5b62-4580-b330-203842ecae9c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698038553, "uuid": "16226c50-ca28-4241-aa2c-f07ab1e0cf3f", "value": "payment overdue.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd182ca-7138-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698019824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698019824, "uuid": "f3dbcb83-519b-4fa7-b6f3-a769bfa8eccb", "comment": "Malware payload (Amadey)", "value": "061a4b142e7f81915eefded104491e58", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698019824, "uuid": "5dec5b7c-7cb4-4241-a0fe-31d4f0c9378d", "comment": "Malware payload (Amadey)", "value": "84565296d0d5de7fb6cfda5def970e597b09d90038003113a9d72b0307033c96", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698019824, "uuid": "076043b8-12f6-448d-a576-6a602cf74b64", "comment": "Malware payload (Amadey)", "value": "f18b5cec7bf758590e81eb4c64264edab5516f2f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698019824, "uuid": "effe05ca-415e-429f-b2e4-0f9906e913ca", "comment": "Malware payload (Amadey)", "value": "6d2e5fe4185a3eb0d9a935c1108933f689e8fb2092ae04346890d43995dfd8905c4129e0523935b277fa8b8a83ddc284", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698019824, "uuid": "160b6d39-bfaa-4f4b-996c-837f3a27e7dc", "value": "T117C41202EBD89467D9B537B098F347C30A363CB19D78566B378669990CB3790A43273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698019824, "uuid": "0cb9afb2-238d-41ca-a692-2b60204dcfef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698019824, "uuid": "4c134d0c-7f49-4cee-9d5e-00d49d296281", "value": "12288:BMr8y90Y3j0846VObCNAAyrfAo1DPtuzQ1n99fRmShWNMGo5:Nyfo8kCqrfptKQ19XmSINM/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698019824, "uuid": "bae0166f-3cf0-41bb-858d-675634dcfc68", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698019824, "uuid": "c25455c5-1775-4ab3-9901-11b1678b6e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698019824, "uuid": "a9e7e990-87aa-40a0-a994-7b963345d6ad", "value": "061a4b142e7f81915eefded104491e58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ff474f-719c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698062891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062891, "uuid": "d033c1f6-8e01-451e-84e4-bdeb09e509d4", "comment": "Malware payload (AgentTesla)", "value": "bf393c0a09a556f4c18bb4859bd791c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062891, "uuid": "d0d23cb8-30d4-46a5-8eda-2e398c4daa98", "comment": "Malware payload (AgentTesla)", "value": "848f0e48009695b98b11be3fe4b46ad7ceb1d49b69eedec10e5accd110a96234", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062891, "uuid": "21931ab2-feb0-4343-b9e4-5fc158a86bc4", "comment": "Malware payload (AgentTesla)", "value": "73c9be4eccd4886fde15e80e6d8ac60208802c24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062891, "uuid": "92f8801e-7409-4e33-8809-78a087cf7ec9", "comment": "Malware payload (AgentTesla)", "value": "4ac38eff592e4a1738dd364780e10a7642a52350db6db9fc344428661148d7de1778cfc199f80fddeafd3938a617dc0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062891, "uuid": "87f238d9-d798-42a1-a482-5fcaf4e8ea53", "value": "T1F0C42392BE351779F5B2A442F7E65D0A50A1CCBF98DE0D14A4E7E72D5222C0F8E0E24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062891, "uuid": "efe43137-5c68-4009-8227-550813d3aa8c", "value": "12288:o90pnZ5theEB11LDvwcbQtOU7w7GeG6yemh2Zjd1rOl9x:o9kZTh37wcUtcyePyub1rOl9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698062891, "uuid": "001a02c7-fe4f-4dc7-bbf8-8d77669a8f23", "value": 554265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698062891, "uuid": "87c7960c-9a56-429e-8b15-c791b0be8300", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062891, "uuid": "719b3380-56ad-4203-8e17-6d7bc3fecd86", "value": "swift.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f077031c-715d-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698035877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698035877, "uuid": "7d28f013-dcbd-41b2-89da-031ffebe5095", "comment": "Malware payload (RedLineStealer)", "value": "b0f762154707591f1413d89992e14f91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698035877, "uuid": "0cba05e4-92a2-454f-a53f-c0d8bfb5013b", "comment": "Malware payload (RedLineStealer)", "value": "84e902f84f695d1c9c627dcdd8ba449e5b330d04b578c1698c2d7f636a1b6e59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698035877, "uuid": "6b9198df-0050-417b-934d-073466011a0d", "comment": "Malware payload (RedLineStealer)", "value": "88d656163de6ebaa7661fd6194a9b5527f5c1081", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698035877, "uuid": "6518ae03-b898-44ff-b122-47bb6fd881c9", "comment": "Malware payload (RedLineStealer)", "value": "6d2b6cda0fcf1349bbd6588cd2af573db4256d864184f99d24af722c4a5e6624433a3cf266cd94c24ead8561cc317c0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698035877, "uuid": "4e133dd8-c2ca-45ed-a3ec-e733026f298a", "value": "T100B48DAEF5D0F831C077C532C81F6B28D4939A788B0617E77EA1C56D17982E2BA764C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698035877, "uuid": "e3b7033a-823d-45c8-9df6-7c1ca7d57c87", "value": "d52ccff4f325ce6b295038c3a3f9150f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698035877, "uuid": "c4574885-53a0-4f4a-b93f-d31fcbabaa32", "value": "6144:QILQ6E1vZY2/vpUOXia60CoOO5R2ZnxQdLTJFb246eQB8ApxgNh:bLQtZLvpUOXia60C3O5R2sdLu4uBPiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698035877, "uuid": "7699754e-9e4d-4f27-b55e-28d697e6d807", "value": 509512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698035877, "uuid": "6907d3ec-5e1b-45ea-8a1b-ee55b2e38fb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698035877, "uuid": "1d61e1be-e431-4783-b8b5-bc8a89f15ae4", "value": "SecuriteInfo.com.Win32.PWSX-gen.20616.10434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4c0f0f-718c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698056055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056055, "uuid": "b952b911-33ee-4a15-8a40-16cf5726f34f", "comment": "Malware payload (AgentTesla)", "value": "feae228eb2ac7926c3057e02e2d92367", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056055, "uuid": "b620b027-df6c-4210-9b47-36ed1937b2d3", "comment": "Malware payload (AgentTesla)", "value": "855a7c0ea43b66852e2cc47758a0eeef994188435dc821dd4a0214ec08eaddae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056055, "uuid": "6e872e85-ee7d-4cca-af9d-90c780e836ce", "comment": "Malware payload (AgentTesla)", "value": "003e9682879eff3eb7125fa99a80e9b01c008bf1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056055, "uuid": "952a5bdb-61cf-468d-b656-3c0c21cfc3c7", "comment": "Malware payload (AgentTesla)", "value": "747db992620cb4dc95fcf14ee4a446b9a0c18e617273459eae064a8baa85e38be22b683f4eb44393a2a839755bf523b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056055, "uuid": "9964aca7-9e96-428b-ae2b-a79e592e4920", "value": "T169B3129C4DA9A0D378BD0CE2A51A3AF29D512042A477F95C00BCA1DF5C3BD07FE99D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056055, "uuid": "b5993302-0430-416f-9326-3579073b9fbf", "value": "3072:Knr0ufqigGKDIpyQgaw9y9TG0N5V9DlyTD0jvPI:KrVyigGeQgawIp/9D0ToPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698056055, "uuid": "287b178f-18b6-44cf-8ff3-e97888462e5b", "value": 115349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698056055, "uuid": "c0590841-7471-4556-b686-7e019d01921b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056055, "uuid": "cbff2543-638f-49be-bfc1-99977b226f56", "value": "Remittance slip 060223.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17f3822-7175-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698046187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046187, "uuid": "fe2aace5-faeb-47fc-8210-aab0981e1b73", "comment": "Malware payload (AgentTesla)", "value": "00e0b3f7063887c9629d957b5b769d13", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046187, "uuid": "e13e101f-5cb9-4e6c-b648-40dd733c8654", "comment": "Malware payload (AgentTesla)", "value": "85d0e15fe8e747d9e299c7a0ffa20c51f563a9c74561d9198c8293f0a6497841", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046187, "uuid": "3d56d8ec-e16c-48ff-857f-1b829737b3b9", "comment": "Malware payload (AgentTesla)", "value": "c0887ef46edacce1e17871c78133b146ce19f516", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046187, "uuid": "e2b3d732-b3c2-4572-bc51-53aaa5416088", "comment": "Malware payload (AgentTesla)", "value": "34fbfd7888278e14e1421f90c5ac99039fa21ba6f76302b635799560ffc92edb1809829a971e19f4ad7435a6f76a766a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046187, "uuid": "3cc9ab86-b526-4e97-b1e4-071457360ce1", "value": "T1EFE41242BB54C7B3C68D47FB4414A2808BF12F724216EFDE5D84B6C93AB73625B25607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046187, "uuid": "e0f416f5-efb7-4a11-b399-671d90a40348", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046187, "uuid": "9df3c437-359d-4819-bffa-8e5e4bf44486", "value": "12288:3b5yzvbYmBHnxsnFfQlCkvfBHmUYYmktn4eiMRSrZGOrjUcrlcNnuAQaELAr7Fel:VebY0fCUZmUxNrRerjnCNn4WeD/UJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698046187, "uuid": "f21fcf42-2238-47e3-9605-cd8c6fff5d77", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698046187, "uuid": "422d8ede-b049-441f-82e9-63d3cf4e0cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046187, "uuid": "5092ebc6-feed-4d7c-b9cf-734391d7e64f", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5afeafd-7187-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698053925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053925, "uuid": "19aae159-118d-40a2-a4b6-d155dba86bd5", "comment": "Malware payload (AgentTesla)", "value": "99c7225f076ab3b67d9cdf951d535e9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053925, "uuid": "02ca7b59-33f7-49a1-b48a-f65fa63ac6ec", "comment": "Malware payload (AgentTesla)", "value": "866cd6791682949776e15b2e52742eac461a8696283892d0de2284b1fc367cf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053925, "uuid": "771dd0da-a08a-48e5-9979-fbd5d2bd27f5", "comment": "Malware payload (AgentTesla)", "value": "ab747dd61671f83a7dde9782085b8ec9ba02c27d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053925, "uuid": "4f74ceb0-12fc-443e-8d83-8665e3d6c137", "comment": "Malware payload (AgentTesla)", "value": "6df3a1098254cbe502b88e2ec975f654ab447e3242d91bd02678a2c3fdc2a4389047b4c92ebf92442319982e2529365a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053925, "uuid": "ae86e23d-f0ec-4135-95dc-615908a4108e", "value": "T1A9D4237DE249131D3E72516D0EB3EA38CF6342A6E035B47D916C4370EAB5D8AA1252CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053925, "uuid": "1c667bf3-44cd-4591-b7ce-0050642b38af", "value": "12288:IoXotpZ2NpAVGm5yDtKRgsyoYPk0rcR2+Oz4vzjuBnSZJxEsiTTpE/XMf:Io+pZSpSGWyDtKRgNzrI2jz4vnuBnSZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698053925, "uuid": "b7ee32f5-4e96-4263-a2b6-67e47462c506", "value": 656001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698053925, "uuid": "11c854b5-8d3a-4560-8cc5-256cd65e5ced", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053925, "uuid": "525e5b6a-97a0-484d-a9f5-daddbcb93fe4", "value": "materials list.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5639fb-71da-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698089455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698089455, "uuid": "cc2314ba-1766-4a02-a34f-bc528b9eed59", "comment": "Malware payload", "value": "0b3f20cfff3a2b590e691f16ab612628", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "SpearPhishing", "colour": "#6118B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698089455, "uuid": "dbbd61e0-7a3b-45da-93c6-fbef5aba75e7", "comment": "Malware payload", "value": "8708c4a8775bf06a7b6b137cb6951230b8ebec732ee6bb97e2dfc3fa49171844", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "SpearPhishing", "colour": "#6118B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698089455, "uuid": "f206c41a-ae06-45bc-b5b9-7d1fc9ec85df", "comment": "Malware payload", "value": "b3c98880ab2f6fc2dbda08980b88d836bab68c9e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "SpearPhishing", "colour": "#6118B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698089455, "uuid": "8d4a09f7-1155-408c-aedd-81f05e3f124c", "comment": "Malware payload", "value": "dc94697e407d383cd574485d7bd0b2f677fee1a53a5a648fdf80320c7367810da67aaae269553d9d59151f844ee44f78", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "SpearPhishing", "colour": "#6118B8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698089455, "uuid": "a8d718fc-9c09-4fd5-a128-0f4fde2ae130", "value": "T191F2CF31C1B9049FC2136BBDAC570B5AD73DB726C2967816FC02829954E0EED8A43F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698089455, "uuid": "c7e5952d-8e26-4ed9-9f93-41e0dca0898a", "value": "768:SpbVQ7TLFP3VqedbeULFb5+XR1rZPNQX8dx8MRB5fEIAfLvUDSg:SpsXJ1xw3FNQX8dx8M35fpYng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698089455, "uuid": "767ef921-333b-4429-bc72-bf31de3b14bb", "value": 35092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698089455, "uuid": "82c55ca2-aa19-4d3b-9460-2b41c0339461", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698089455, "uuid": "4669e920-b9b2-47da-b8a9-80bf4e08d7c6", "value": "0b3f20cfff3a2b590e691f16ab612628.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcd034d-7195-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698059579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059579, "uuid": "d33dc01e-0aab-4940-bebe-b4d11b8ac13f", "comment": "Malware payload", "value": "9038d0a3d033f78513824a5509b453b9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059579, "uuid": "3c595f6b-1d1c-4b0c-9f52-521898675da9", "comment": "Malware payload", "value": "8802714e453577dc6f2decadefa75d4ea26c88de56dce193a50293d699799190", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059579, "uuid": "b972acb8-0fc6-4d37-8364-47e267121077", "comment": "Malware payload", "value": "387cb5388f44f175a180c0cf2c1ac7a75cba2deb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059579, "uuid": "c5fdca5a-b7b0-4b99-9618-e02a57a70331", "comment": "Malware payload", "value": "17079a034f4083c6fb3dfa048592704bcb327eb4e1ad9f6aca000ebdab34178c7fa8452e4df9a803581014f97876d158", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059579, "uuid": "8cea6e00-acf6-4b42-a48d-80004f948bac", "value": "T15B95CF26E7718474C99D42318A28F76510EDF63AC620A5DB77D07F5E6F318D2E328A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059579, "uuid": "e8b9a28b-a883-40ec-8f3a-cef05b83de90", "value": "a15787fdb5dd616d2c98fc3d7eb82fb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059579, "uuid": "923b3c62-ad5a-416d-90c8-1f6713c71389", "value": "24576:vtOooJS5jqWfLMiRfGu2WE9v6hkhlpnZgiQ4tZlmsQ1UcmKgce4kLUO4oo9E0Dg:voJpW4cT8/qiLQdUcGkoo20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698059579, "uuid": "7ffb9c68-ed10-496a-b9b5-83cbdd1f9419", "value": 1970275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698059579, "uuid": "4c620bbf-cea4-491d-8d44-2c4881ad4567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059579, "uuid": "13e90997-b635-40a8-9fce-aba3ea7991b5", "value": "envir.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcde66b7-7145-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698025590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698025590, "uuid": "e1e90868-e0cc-4445-bd75-c006e5c9b585", "comment": "Malware payload (RedLineStealer)", "value": "ddf0c97964cddfba76034d66affa3449", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698025590, "uuid": "71c97d38-64e1-4c45-b97a-c52ef9ae96b2", "comment": "Malware payload (RedLineStealer)", "value": "886453383c7e3a0b520ca655c4f8050c3843bd8d62c5d8a97f9d0dc783b36922", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698025590, "uuid": "827de8de-a973-4e5e-b3d0-7ff1c2d8f32a", "comment": "Malware payload (RedLineStealer)", "value": "14e481340b4b6687101b6921b03b43c6d139b443", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698025590, "uuid": "289b0544-d3a7-47be-8c86-5449036510f8", "comment": "Malware payload (RedLineStealer)", "value": "5a8754cfdd2347d15c737adab99edc0406f9c71e0963698d695a0a9c158e9fa5d429ec2932bb5cc35703151f665eb734", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698025590, "uuid": "cc5f9bc6-4e3e-420e-a817-ae9db04a0176", "value": "T1E7B48DAEF5D0F831C077C572C80F6B28D4939E788B0617E77EA1C16D16982E2BA764C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698025590, "uuid": "d0bcdf85-ee2c-46e7-94ba-fedcd474e269", "value": "d52ccff4f325ce6b295038c3a3f9150f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698025590, "uuid": "9474fba5-91fa-4c11-bd74-65f17301f7aa", "value": "6144:1nbQrkF2fsC2/vpUOXia60CoOO5R2ZnxQdLTJFb246eQB8ApxQNh:xbQsMsNvpUOXia60C3O5R2sdLu4uBPSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698025590, "uuid": "5ec7d4ce-e813-4d2e-92dc-0933146037e4", "value": 509512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698025590, "uuid": "b91e9bde-a5f9-4724-82d3-ebaf778c680e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698025590, "uuid": "770d4358-0cce-4fc8-9285-b611d21b249d", "value": "SecuriteInfo.com.Win32.PWSX-gen.23285.21523", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd00ff8f-71c1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698078740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698078740, "uuid": "76796da9-89f6-4a96-99d9-04f7c4786572", "comment": "Malware payload (AgentTesla)", "value": "9c444d337d716c7ab2d7e0d9760a3c90", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698078740, "uuid": "c20dd6b2-6f06-4388-b0ef-7e4659bf04b8", "comment": "Malware payload (AgentTesla)", "value": "890f8be40f938774c3902f17127503ccdae0236b8f31ea26493e5040ba3dd623", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698078740, "uuid": "f7b1ca60-9333-48a5-a53d-c90f834a134b", "comment": "Malware payload (AgentTesla)", "value": "2f6298f7e8d68c5dcc09982120ab7d5451b126ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698078740, "uuid": "80d23025-1878-4840-b9c4-850770f3a43c", "comment": "Malware payload (AgentTesla)", "value": "d4b3b8a17d102ed555fe041a4d09ff77e3489d164aa3b208d7aa5261424587d79f039249c0cd3a18f290d83117a1be67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698078740, "uuid": "3eed1330-b76b-4f65-90da-dae32283d791", "value": "T10EE42207F5B8C377C16D4BFA8871A2C847B47F63A214DBCE4E8971E9B6613025A25827", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698078740, "uuid": "80ee45c6-857d-435f-8340-838f43644a99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698078740, "uuid": "fcff6c50-39f8-4983-a545-ec2c11ec159d", "value": "12288:NWb5yzvbYmBHRegVbxizDXtFrrkrWmzhcm3q6OI8OZNpWgDi5ujoXfmRKnityBik:mebY0sgbi3PrP6OagTwoeAitUibo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698078740, "uuid": "c626ddfa-9ba9-4afa-a245-76f117213bdf", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698078740, "uuid": "1e59aba1-f43f-4025-990f-38df85084925", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698078740, "uuid": "969fa16c-6821-4c9e-84ba-7c3e20c14963", "value": "SecuriteInfo.com.Trojan.Packed2.45834.19399.13507", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2e1ec1-7184-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698052567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052567, "uuid": "cc8f1b17-caed-4742-9692-cc006953906e", "comment": "Malware payload (Formbook)", "value": "b037a52db0bce54f8271a5d56b610d7f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052567, "uuid": "4502e43c-5fbd-4a9c-b5dc-f3ccfd805e68", "comment": "Malware payload (Formbook)", "value": "8997a327b786a9000b8ef5241dfd7e61a92112f9f9bc62d96924a6f11fdb31b2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052567, "uuid": "8421d651-b113-46cc-a9f1-ca0c01a0e324", "comment": "Malware payload (Formbook)", "value": "5773dcc757d49316993cd9a96eea7b559ea1b3e3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052567, "uuid": "b00916c4-69a1-4a08-94ba-9f6977cad6cb", "comment": "Malware payload (Formbook)", "value": "af9fef908dcf2d3ffa804dbdafb24fe43e276085288068c7995e4c3d2f6145d6c7bb252b1d88c1784a2dd23f92667250", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052567, "uuid": "0472ed30-7aa6-49e1-b4bf-187fb885b33a", "value": "T1CB84230ACF114BBA857C3BCCFD3649E9B044551289353A9FB80F22AF9716AD88D175B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052567, "uuid": "d9ae3d75-3fd0-41b1-91e4-b0ed9e4df25a", "value": "6144:b3WZE4CQ6f8aTel1trB8e1Hf2aasSmXRlnrdbreJOG5Cy2GP/AYkerp4hRPgZ7aU:yDqTezB8e1/2ajtbnrd3eAGb/AYkKp4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698052567, "uuid": "3f6cb6b3-0b0e-4497-9186-9b47b46f0fe7", "value": 372630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698052567, "uuid": "1c735220-cb3e-45f5-b53e-bf253014480c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052567, "uuid": "f2100dd0-77b3-4b07-a83f-3e8351602aa5", "value": "Documentaci\u00f3n Solicitada.PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f1d615-71ed-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698097546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698097546, "uuid": "2af75684-6eec-4fd2-b21a-14c19cf6ef9b", "comment": "Malware payload (RedLineStealer)", "value": "9deab429145ef1fbbe8931b78ec22d11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698097546, "uuid": "1c988d4f-cb87-4daf-9c92-289d6be1d277", "comment": "Malware payload (RedLineStealer)", "value": "8a050fc64eb70e4b9e3e73c3da3fcaad6e7ff5a8b262a924d7a2a82ea42c9bbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698097546, "uuid": "19ffd768-0e74-44c1-8bf2-003fb564a6b1", "comment": "Malware payload (RedLineStealer)", "value": "afb080abd546dd631ea0c4ea69f00cde5a7b40e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698097546, "uuid": "3fd4dc53-7b2b-4d29-8bd3-50b2529f2b01", "comment": "Malware payload (RedLineStealer)", "value": "b393bc1982ec958160749ba9df302e330e28dda5865e1fbb428501c44d07ec4ffbe4e2e82e6d13698da0ad154224d876", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698097546, "uuid": "cea246cf-72e5-49ca-a09a-c7babc914fd3", "value": "T145753323FEED6A25E9714B705CF902E30E313DA150B4DB9B37A1980B54B3592763136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698097546, "uuid": "5bb89cf6-1078-426d-a943-22de809beab8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698097546, "uuid": "7f07f656-2a50-46f7-8d71-e78d22b6cb4f", "value": "49152:2wYoDWMsFjrswZypDicKyj1AiQYl5TkFcZA:jJvsxFZKDLzRQqS+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698097546, "uuid": "f4265614-438b-41fb-8537-dbc35f98abe8", "value": 1581568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698097546, "uuid": "8941ea8d-2673-4590-8c10-798901d8a67f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698097546, "uuid": "0d926075-838e-4623-b1eb-667ad72a502f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f482cf7d-7177-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1698047051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047051, "uuid": "7e7d3b3e-da5e-4084-970f-81ac7ddc587f", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "2f962323209282ebba31efff7117d0d4", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047051, "uuid": "98a29ad3-fec0-4b0b-8a95-39384ab1ef08", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "8a22b3547d55ed1bf92532b2a248957af18942f3341b54d624846dc2351dcec6", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047051, "uuid": "a5128c8a-60df-480f-be3f-48087517431e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "0fba8348c9cfcf54a0dd29b2acb9f0011e049484", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047051, "uuid": "bc80d7c1-ffb4-4dd1-a5a6-c500f22d826a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "29f2cc15c9afeef475babe47e1e8b7dee67489f3dce7eb9e59bcf14cd86b0861753a4eceb6b4d4fc848b1951d24eee2b", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047051, "uuid": "0eb25b92-5d6a-46f4-9ccd-e7ca216428a0", "value": "T18775235BE7E44022EDB54370D4FA02871879BDA76978591637C9AC4A0AE33C4B931B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047051, "uuid": "a7181c75-f7b4-43e3-84b9-7e3a42469dc9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047051, "uuid": "5025c1a6-95f2-438c-a096-950f4a9abfaa", "value": "24576:Sy3l3ne9IPlf5pI+C14ESn6d2kQGBoiwdGWmg1hkiWmEcksD2WTPqG/t:53l8U5p4Lw6qK/fw2WTSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047051, "uuid": "07989138-15d5-4615-83d6-41b1d06a927f", "value": 1592320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047051, "uuid": "6590a4d6-d334-4a7a-ab05-d1656a34840c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047051, "uuid": "c46ed0cc-b4a6-4723-85c0-fd5730c8f2c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e881baa2-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042736, "uuid": "0727775a-b9eb-45a9-8be4-2b04d4709570", "comment": "Malware payload", "value": "14a067832883057e503feea3a0ec6ed2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042736, "uuid": "843a87ff-21e9-49cb-940d-8b54234fd909", "comment": "Malware payload", "value": "8bf7c94c1fee3e1de57a0b7d4dfa2bdec0c2a387b434dff13e72afed7a81f19c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042736, "uuid": "b43258f3-7d50-4e83-bc5d-fbf728788e8e", "comment": "Malware payload", "value": "62ce012b53607c4106ee6f98c24ca573ee89239f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042736, "uuid": "b55a41ab-4de6-47a6-a50d-266abaa1e5cc", "comment": "Malware payload", "value": "93d0a1088689acd3754fcb0c20bb94284aa23f5a5cd94788b0e1cfeb845ebdc30892cb3889aeded22f4d61f4ddc2e711", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042736, "uuid": "470b8c00-e7c8-4d97-8d50-d66ab7b378bd", "value": "T160344B2EF7F9C833C01E87B04CB646B46A73FC524D10868726557B6D68BBE046E23667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042736, "uuid": "5c21db51-9e60-4b4c-957d-30991dc4c68d", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042736, "uuid": "85eb680b-ffdc-4d3a-a99f-8553c2812d08", "value": "6144:+RR5rhZFQGrsUwF7vlPoSF6ASaHeE64uR8J4f33+3MJ/AJr/lhlWkn:+R5nWFpPoSF6yH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042736, "uuid": "b9915e1d-e139-4a16-9cff-da330270214d", "value": 238305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042736, "uuid": "c5cac33d-57c5-49f1-becc-4b92345a3ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042736, "uuid": "ca9e250b-e290-4b37-86c2-55c8309c4902", "value": "SecuriteInfo.com.W32.Agent.CE13.tr.11335.20640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e841116-7197-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1698060543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060543, "uuid": "25563f4b-e3ce-415b-8ed2-b8473f70f87a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c1e80da312a1bd6a1f1aaa161018666c", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060543, "uuid": "f7016409-2e15-42b5-811a-eddde038efb2", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "8c01f096725d70248403986433a2052358112499578c1e5ce68b1363709434bd", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060543, "uuid": "fe8eafe1-8df6-4701-9dd1-217b58caeb47", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "32e5f748d2e2cfae1be622e40f311915149416c7", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060543, "uuid": "aa4a2f04-2a9e-451e-9613-e06371e9a9e3", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "1a0597283bb2e53e43baba2b4832e8a35d1f43b2834161bdd05b7b7d7fc2da39a77d0d1d5d0511542acff0d9ab0a3cd2", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060543, "uuid": "fb074200-47d1-493b-aad7-4a64965448a9", "value": "T1AE852361A7F94422D97637F098F610636B3BBDA12D3093493799EA490DF2284F47933E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060543, "uuid": "0e68e30c-5bf1-4fed-b75e-27b384a24ab8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060543, "uuid": "22407b53-041f-40b6-ab54-bbe4ae8882ab", "value": "24576:cykJbJ36Orsbh8qXBxizQmEOUIx7qse9vvyDF4UMuohhDLFmEAfiVReF4EG9HfFs:Lkv36Ouh8qLiEldgYCx4L7YgaEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060543, "uuid": "0811ea8f-4482-4600-8a80-0f5188472742", "value": 1828352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060543, "uuid": "ff05cf79-9d1f-48ca-aa67-8b342c337537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060543, "uuid": "a9ca3351-d89c-4848-a14d-89ee0ad0cf78", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89616e57-718d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698056320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056320, "uuid": "e935ee0b-59c4-4f5d-8620-dc4df56c5b14", "comment": "Malware payload (AgentTesla)", "value": "4691ba2e89e7ea5d42b7d4c1f6033294", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056320, "uuid": "ecc1e19b-e042-4c17-9571-51d48cce24c1", "comment": "Malware payload (AgentTesla)", "value": "8d928a270063533dbc270c11408e0224ec8897632dbb372e6eaa22b41de15866", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056320, "uuid": "aee36b4e-e756-451c-8a5b-a9d3a51ddf82", "comment": "Malware payload (AgentTesla)", "value": "95f5a6cfb62618fb2c051efda15f647f559672ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056320, "uuid": "d705350d-31c0-4127-b74d-0c29f67d2e89", "comment": "Malware payload (AgentTesla)", "value": "aabd7b48c6f347624871acc9413a92e8a6646c2219024ecac6af59a939745bf0127667553250c9dfd01911b4ab1fe357", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056320, "uuid": "3a4f6196-ea70-457e-b3bb-61709efa3c61", "value": "T1ABE42355C4800DAE7FBECCB41362CFD2475AAAE26D8D901FE77AE73A40099CDBC51984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056320, "uuid": "d62b0475-9835-4622-b503-24fd694bdf69", "value": "12288:nJykxQgLuYAaU97CGSEYAZIbyU/giJI5bYGPCWzB6ssj5gGytmFPHrbK7taF:nJzxxu8GSEYEIM6r0Hs2tcPIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698056320, "uuid": "50235321-63d8-48a6-8825-7f7bd1b06d94", "value": 682472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698056320, "uuid": "d09182dd-1a92-4e06-91bf-0d6a85c93fba", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056320, "uuid": "f8f13351-1630-408d-9d95-becde1a9eab1", "value": "Purchase Order_NO_1904749.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08cefa89-7177-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698046655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046655, "uuid": "48d9bff7-8bbc-4f75-8b65-a86274a5b6ea", "comment": "Malware payload (AgentTesla)", "value": "1fa4fa8721481761b5bdfbbef6de9fff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046655, "uuid": "07770973-846c-469e-8e40-eac7760cde1c", "comment": "Malware payload (AgentTesla)", "value": "8df8ebeccff19de81a067779330c2e5045172a6258873ace716b5eabcba08f34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046655, "uuid": "4deb52c6-1333-48e0-b88d-7f70e666d921", "comment": "Malware payload (AgentTesla)", "value": "8920cafa4d1367cf8a2ef7bfcd8c82787539b050", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046655, "uuid": "098edae0-823f-48f2-b283-ae2c9015ee85", "comment": "Malware payload (AgentTesla)", "value": "b7b6699dc27e32b0c616b8410101472094437a80cfb1ec26f7e8b30b0612a2b83dea119b490261f5a20a4975fb08255f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046655, "uuid": "18a48cc7-c1e2-4c45-a2a5-54ee841b33ba", "value": "T17465027CC7FA0E62FA6DBCBBBA1D1C890BF26D5335EB8127104752983785085DD60AB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046655, "uuid": "64695f1a-532a-4d43-ad6b-6da7428ae998", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046655, "uuid": "c6c48de2-6634-4532-858c-2912ce8d1fe3", "value": "24576:7eg/G/VYiav1alSfD9/nqkneB09wAsgF40H+xP9GKZaRI38p6EHsbr9xCwoW+DHG:KKsmiMaYR/6BKwAv40exP97ZjTB9xCTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698046655, "uuid": "8f7a40e2-02ee-4c02-b2ef-d7b32823482b", "value": 1533736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698046655, "uuid": "51a7f930-b7c0-4665-84f0-bc13c6874cd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046655, "uuid": "11319518-a74c-486d-ab0f-15c184c37a79", "value": "EBM R3G560-RA24-03 (400V.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825a8154-71df-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698091527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698091527, "uuid": "2ed4c8ce-30ce-48cb-9436-88466bf6f416", "comment": "Malware payload (RedLineStealer)", "value": "89fb1bc93489bd14c92394f6c311e016", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698091527, "uuid": "e8994be6-ea86-42c3-935e-b3d987f468db", "comment": "Malware payload (RedLineStealer)", "value": "8e2be0390780a6aa42633d3ffdb616e950bac13e3c0636345bbe586b998b0043", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698091527, "uuid": "68837bc2-ea07-400b-aa96-c30f44e2869a", "comment": "Malware payload (RedLineStealer)", "value": "f139da264faa80df488b38e60a5fd3f0356c1a84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698091527, "uuid": "6809b30f-6766-423a-ae3e-7d89d6a846b0", "comment": "Malware payload (RedLineStealer)", "value": "1b6888685432f9def15d5b1c2d809a59387582ccb03ba06eee786e62c2e7753c9f759adfa37740fb9dfee769c17fbf74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698091527, "uuid": "4f529ac3-264f-4776-9dfe-0e6681febe51", "value": "T1C385230356E9D176DAB593B1E4F30F9B8735BE988478866A2360A04F4EF32C4D1353B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698091527, "uuid": "b70d4ee3-3ea6-40a1-a6f4-1feee174c165", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698091527, "uuid": "6a7c1892-9af5-4813-b4b9-6f7eae715ce2", "value": "24576:Jyp5a1Yg5QLiEVIBh4MVeo8zs5hM7eAEqShmY0zHRb/VlvSFpCx7JBYG4D+RuCPb:8p58YgmLFV6hl8CM7eTqShaaoJ7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698091527, "uuid": "3b362b6a-fc07-4d5c-a690-0072074e740b", "value": 1761280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698091527, "uuid": "2fd03a10-aefc-4552-957d-719637ab3b4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698091527, "uuid": "ec0ee254-8ac0-4160-9d93-76ed3538aa57", "value": "89fb1bc93489bd14c92394f6c311e016.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390e9538-7198-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698060910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060910, "uuid": "52af3728-5700-43ae-b372-faed22564635", "comment": "Malware payload (AgentTesla)", "value": "94f8902b5e600bc31da83077d3ab3bc5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060910, "uuid": "99a0e331-1c15-494d-bc93-b093cfcb877f", "comment": "Malware payload (AgentTesla)", "value": "8e4b1d2f75d4745b45a8d564bdb3a7f06de34285006808a926de011a025262e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060910, "uuid": "83e74ec3-764c-48c0-8c9f-00bc4141341e", "comment": "Malware payload (AgentTesla)", "value": "8379dc3bf6d23ae29c3998f6ab8abbf5a7e798e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060910, "uuid": "8f2d8ccb-676b-43df-8ffe-a649aeb38535", "comment": "Malware payload (AgentTesla)", "value": "68b0e8b9f0b26fbec4ca03c2719041eb768c77eb95d8d2e408e18648a775e1f03fce2ee68b220e29ea92156049522b2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060910, "uuid": "a7036dae-f562-4662-a3f0-b616cb271de0", "value": "T16AD423156E191DF0F148DF73A7E887B3B6E7E81DDE44C6B95771400ECA94CAAC6240B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060910, "uuid": "4271c985-1aa7-4e38-80fa-fbf6071d1ec5", "value": "12288:UX7QvvBSGukpyZCYcOPOPEcAfeVgfLR8fKN6WQzycLJK:UX7nKuCYDPSoY/fKDOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060910, "uuid": "a4c2c67f-7393-4f50-ae32-9f22a7730ffc", "value": 605591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060910, "uuid": "378c09b3-dfc0-4195-a122-5bd4270d22a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060910, "uuid": "43a540ee-00b2-44e2-823b-fbdceaaa06df", "value": "original shipping documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c20d4b3-7155-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698032192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032192, "uuid": "4f7803b4-4b17-4d08-9913-f2b62f3b138f", "comment": "Malware payload (RedLineStealer)", "value": "d8db4a8bf958fd4dddbc9072cbc6696b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032192, "uuid": "5c8d4d8c-4e4d-4a55-8bea-65cdac9c2798", "comment": "Malware payload (RedLineStealer)", "value": "8ef6983e75e758988bc62f41114df351aeaae8312103e2bfb3d828a129bbceb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032192, "uuid": "b842a980-fcaa-4275-a669-781ca23e3941", "comment": "Malware payload (RedLineStealer)", "value": "3d9784c28d734d22af900638f02f122870b6e681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032192, "uuid": "a6c303d0-b41d-450e-82c5-e333f2e32d9d", "comment": "Malware payload (RedLineStealer)", "value": "bcc65865af7cab5ff3dd24a278158e9dfbc90163a5863868c359b0265c454ed4830e5eccd432d17c1127e61b5bfa6a02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698032192, "uuid": "5d6f11a6-fc4f-471f-bb83-a2279dc6108e", "value": "T19CB48DAEF5D0F831C077C572C81F6B28D4939E788B0617E77EA1C16D16982E2BA764C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698032192, "uuid": "13a35138-a811-4473-9b16-1148b16ff8a3", "value": "d52ccff4f325ce6b295038c3a3f9150f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698032192, "uuid": "22d9a7dd-0ef5-4729-b622-c1971db94746", "value": "6144:5HmQrhsGWl62/vpUOXia60CoOO5R2ZnxQdLTJFb246eQB8ApxgNh:FmQFWllvpUOXia60C3O5R2sdLu4uBPiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698032192, "uuid": "e1725826-9795-4e8a-bfdd-7eb66f11006e", "value": 509512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698032192, "uuid": "7332ac82-445e-4b48-821d-213786835a00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698032192, "uuid": "10437f70-2b9e-4b40-8710-32f15a5b28e1", "value": "SecuriteInfo.com.Win32.PWSX-gen.18639.15865", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2336f1-71a2-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698065534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065534, "uuid": "ff1dfe8b-8fda-44f9-bfb0-5a63d0189156", "comment": "Malware payload (Formbook)", "value": "c07f2ac4d315cfac097a57e702a0d915", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065534, "uuid": "5999838d-3058-4f57-a857-85e741b86942", "comment": "Malware payload (Formbook)", "value": "8f231e1ecb926bcf798ec71235260e119e23046e1bb041bc597b8ff2f9ac7b86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065534, "uuid": "9c6732f5-29a0-4756-a496-d343238e7897", "comment": "Malware payload (Formbook)", "value": "65e699bf120468782a74edde4633bfeb2d48a45b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065534, "uuid": "ef8e0dc6-069c-4d01-84bb-0a78f235e9bf", "comment": "Malware payload (Formbook)", "value": "c82da0e3ed74d9445a29e6a593013dc5b779ea1485b6d4e1ac2e3d8ef1beface250c65034089f8833d9c26b185557e63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065534, "uuid": "c0d8fb69-8f78-48f9-b559-44fb5b886e88", "value": "T177752313FAE290A1F86E277008F763D34A367D576D68030A1715E51B1CB3BA9D83636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065534, "uuid": "c071ea77-aa43-469a-9fce-37c7dd1a1316", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065534, "uuid": "a44078fa-e15f-48e6-9c21-4eef3e4aab58", "value": "24576:Jy6Vx8wwNsE/B3b+n5qKXBihoSynOMdOY6c0dzBVfeJ+RedEg7Lhps4:88i/R+nzWoSx4OYqdFVfeJmNShp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698065534, "uuid": "ed861ffe-768f-414a-af6c-f6eca7ad67e9", "value": 1581056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698065534, "uuid": "3e5ff14c-ee48-4fe0-8f3c-ad291833bf59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065534, "uuid": "ec327d69-b05e-49b8-a60f-aab73381bf82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178660ac-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698057417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057417, "uuid": "f225c6ac-1b3a-4e2e-b1d6-173ea4681f33", "comment": "Malware payload (SnakeKeylogger)", "value": "38c7d78e5d7cfad455053448c7861505", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057417, "uuid": "ee37097a-5bac-4e8b-87b3-3d82119045c5", "comment": "Malware payload (SnakeKeylogger)", "value": "8f37fbe5ad7ab657d74837c722b3719561a8f6ad9153ac3e803a654d06041299", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057417, "uuid": "6b85bc95-d323-4029-b55b-7d88820d015a", "comment": "Malware payload (SnakeKeylogger)", "value": "f354edfb44d8c47bbdd20ec8b73da46175b4989b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057417, "uuid": "dcb3a7a2-1656-4a6a-b0df-9b60d018776d", "comment": "Malware payload (SnakeKeylogger)", "value": "05eb2310597cabeb64d9f10935d51b03323e4108d8822c0445c5a61ed216aa222af82472bd20bf1ee5d7d48eee48c3f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057417, "uuid": "c50d4cec-cc3d-4b8e-81e5-149d0c0b4736", "value": "T16A94F1191B78AB6BE9FA6BFFC5242120477DBB369105F78C1D0AE5C904B23418D82F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057417, "uuid": "2723b0ef-73a3-4724-8c8b-753f5ad1784b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057417, "uuid": "1da92145-08b5-4ea2-a34a-eab993ce8b50", "value": "12288:zD7gUinfOOazylCH8hTk5WukXBfYrOiqoe5:cfOOazy5CWukXBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057417, "uuid": "11394524-f2cc-4091-b8f5-c5af74fc39e6", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057417, "uuid": "5a765209-5355-4dc6-a7ee-842fabdb4f78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057417, "uuid": "441f3725-8de6-4eac-8bcf-1bade8b092fc", "value": "sailing ordersvessels details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0431ca0-7184-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698052573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052573, "uuid": "79c5738a-c4a4-49ed-b7d8-b8bc73cbe3b6", "comment": "Malware payload (Formbook)", "value": "294bf0d1879c052cbe36fe21b14b0d82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052573, "uuid": "a0078741-eec7-41e6-bada-a8e377a2ccfb", "comment": "Malware payload (Formbook)", "value": "8f86841c7f89a8fe2995492a8bb71e09bed896c812126a4c0f8bb72c146ab4ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052573, "uuid": "f1515c9d-6010-44b4-b1c7-9a744f4ded0b", "comment": "Malware payload (Formbook)", "value": "8dcc25233394468dcd532968dc5d95cb2a15c9f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052573, "uuid": "e9a572f8-12f2-4391-aa7d-61766fdefeab", "comment": "Malware payload (Formbook)", "value": "e4fb16a56d76e969443bdf33aca298c922f8a7b7340530d7a87cd1721ab5407f2380e47f0d2ef1d023f28a00f5f2d738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052573, "uuid": "1776663b-7766-428e-bf46-cfebc0ebc90a", "value": "T13E84230673F9CC77E7B406724E769FCB26A0E549562D968F53201A38F953F42E84C38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052573, "uuid": "997ec049-46b7-4e07-ab72-7aa95feb34e0", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052573, "uuid": "b428511f-002e-49ae-96b5-0d46569a8334", "value": "6144:pXFKo5lVWVWdauaK8liP0hhTUXt4ej2/osbZ/sD3NPr5JdcXpkfH+/EWF8zT/h3m:pXRBauaKxP0hhw4ej2fe5g+H+/Mh3ojn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698052573, "uuid": "635c3aed-bc9f-43db-b263-3baf96408a43", "value": 387506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698052573, "uuid": "05aa01eb-d366-4628-9a3a-2669b6cf7304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052573, "uuid": "819bfb74-b1e0-405a-a2be-9915bb32af47", "value": "Documentaci\u00f3n Solicitada.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11abda46-71a4-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698065998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065998, "uuid": "9ca3641b-18a5-495e-a280-8f309b9e11f8", "comment": "Malware payload (Smoke Loader)", "value": "142352447f68c37419ece0253e89f41c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065998, "uuid": "4bad8a55-3875-4715-aea0-6bc0362bae6a", "comment": "Malware payload (Smoke Loader)", "value": "9042afcab837d06d2b0372e15c2b981c253b32e0b0f5e6e2cd57d52c77ba3ce6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065998, "uuid": "57d27216-b70d-46e6-b1f3-cad296c152e3", "comment": "Malware payload (Smoke Loader)", "value": "dc78bfde529bae13609294f52c561bc054f6c992", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065998, "uuid": "24b54199-07f5-46e6-ae5b-5c2c3ee1f814", "comment": "Malware payload (Smoke Loader)", "value": "c04aaeee1de6c2f4a5cd6b38c47b82210641ebc9fb8c5de57426e1863bf7e7cdf1f968a08e7ef5922f2f6796459624ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065998, "uuid": "fa4c66bc-0ed6-4a73-a070-ed242ec366ba", "value": "T113850B1176F95B59FAF30FB85ABAA611487AFC6ACF11C2DF1250508E0D21BD09970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065998, "uuid": "33b04fd6-6284-4e67-91a1-393d7ee23c15", "value": "037522269f8348aa17add864631a3f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065998, "uuid": "e0a6a3ca-6b03-48da-aa38-275f59d924a3", "value": "12288:oFV2CQp0mPAfSBsqe7E95XuHCbdPYmstzd480uzzvs9X6a9DhvhVsYMxgIY:erGAfSKqe7E9xfdPWNK6a9DhvhacI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698065998, "uuid": "ee7253a1-fefc-4eae-9031-04009fa7280a", "value": 1724416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698065998, "uuid": "6cfa6881-ff1f-4e73-8ae2-38a735a03035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065998, "uuid": "711c6604-a827-4cef-876c-389f457bcb27", "value": "142352447f68c37419ece0253e89f41c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374abc54-7183-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698051887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698051887, "uuid": "180e03f1-6eb1-498f-87ba-273c8ebdec36", "comment": "Malware payload", "value": "77776732815cff60fa8e6463e034f3cd", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698051887, "uuid": "5ce94f3c-a102-42db-9d7d-b4d6390d2354", "comment": "Malware payload", "value": "9056653006806f63555b309ef18be3f16a1ddfb559b3ce3c3eb20f1091f3c05a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698051887, "uuid": "1e6c440d-2199-4df7-a47f-93de0b36a016", "comment": "Malware payload", "value": "f034fa1cac2416e2b4df8ddb12c031ecd775850e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698051887, "uuid": "0463643a-ea42-431c-9b84-551a874f8d87", "comment": "Malware payload", "value": "2259fc6d4f4f355f1448a98d9009376f24bc13798400684032caa505a3d9e7b82cdfdd6957d9a10b2c20bf1fdfaacffd", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698051887, "uuid": "d34b8dea-ce98-4e2d-a3e9-969a875bc796", "value": "T11CE423CD3DCEE452EF0DCFBCE2B38DEBF66961A5851EDC18618C40F8568097591A0627", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698051887, "uuid": "18c15d64-3e57-4336-8e25-85b73218159a", "value": "12288:EaF0CKkwPb4q4WorABaiyHvykGILWUxlg2oZiPZPqFyLR1dpYJKR0i+u:fF0ZbN4WaiyPxZoYVMY2Kuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698051887, "uuid": "1507acbb-bea8-4a9c-9ae9-c4faf1780429", "value": 689614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698051887, "uuid": "88969428-0aa3-421d-b34b-a6097bc0a096", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698051887, "uuid": "40561af8-c2c8-4231-8b8d-028792f55d27", "value": "Shipping Document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca35e76c-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698057717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057717, "uuid": "d47ee9ec-797d-407b-837c-3cfada439abf", "comment": "Malware payload (AgentTesla)", "value": "499fcd097494745598966b579e104135", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057717, "uuid": "3c5b181b-dd2f-41a9-9c01-17cb2ce82c55", "comment": "Malware payload (AgentTesla)", "value": "90d63293d26ff8d79d3cb130d63e4d69646527a8c61ea5308288980fcfd5189d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057717, "uuid": "edd820db-3928-4550-8ae8-161180b0b3b6", "comment": "Malware payload (AgentTesla)", "value": "64f24504a045e0c894fa88f29938246a06ee97b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057717, "uuid": "f9bfbf9c-f86c-425e-98a3-4d740c413ea6", "comment": "Malware payload (AgentTesla)", "value": "405b1d35a6eee8ffee3c77fca1c0fdb8198479b489d8236fe7d941d25ce5a3ef9ebb37648902a0a66df72c47facccde3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057717, "uuid": "91915be9-f6d9-4433-8a9c-21c5a00d1db3", "value": "T158C40291723A6BA7CC7787FA8801250317F2952E55A2F3164DEAB0EB6495F110BC2F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057717, "uuid": "e1f7117b-c101-4cfb-a2dd-737f1d14aadd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057717, "uuid": "f0775269-bfdf-4f8d-812e-deaa8ebda198", "value": "12288:MvoV41D4iDCrnr3htfw3XZYeyX5XwurjNUTW6:MvoYD4QAr3hFwmbXBzryK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057717, "uuid": "482a9c7c-eb48-4ae7-b54b-fd5db282ca8e", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057717, "uuid": "7ea12f15-fba6-4203-9f79-6a2e24b2107a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057717, "uuid": "b4d326c0-095c-49fc-a723-f8e076ce4993", "value": "NEW PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc02e36d-7197-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698060727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060727, "uuid": "52122a81-185b-41ca-88d6-09633a1c89c8", "comment": "Malware payload (AgentTesla)", "value": "099066015132b843dac885bf4fe889eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060727, "uuid": "77b9c3ae-5440-4524-b21e-7e4f554e4879", "comment": "Malware payload (AgentTesla)", "value": "90f2a4d197b1370900643697e22b3fbbc4f7d05c63a1a7bd8d0f665cc76dbdc5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060727, "uuid": "0c637987-fbb3-48ba-bcdd-84e2a63af270", "comment": "Malware payload (AgentTesla)", "value": "6600646fee061b12e5b6c9cd4694898d71f53afe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060727, "uuid": "a4349fa6-844e-413b-86d5-3ab4f33c4d33", "comment": "Malware payload (AgentTesla)", "value": "459a8d8076eb986012dc01e13b1fcd6a40f24404beffa0b2817e7ed1545723cf3823c404aa3c820313aab2ba52a79a9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060727, "uuid": "860a2cd2-621f-4fff-bc14-d9d37381d516", "value": "T13B05F1BD31EB68D6F4B2EBB1C3D91B89876BF3E5213F7B562C8102438551981EB125B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060727, "uuid": "57ec55e7-3e70-4db5-a147-fc139148fa30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060727, "uuid": "4cd6fbf8-7ba3-43bd-9e1f-1c0d7c8c9e45", "value": "12288:C43C5xTyVKH5YIQ+puTjS6kcdwk6dK89m4JFkEIYTAXUOdyGwNJdtMUmkOKq3:T0IKHeIQ7TjS6jd4K6JHOUZGrUmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060727, "uuid": "e0ea95a9-1b28-42c4-9864-0434d2b0f546", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060727, "uuid": "da6e81ba-51e8-4739-9507-aa104aaa7a59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060727, "uuid": "22b39a19-677b-402f-b8b7-f8d0f182fb5f", "value": "325zEB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5430db4b-714d-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698028743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698028743, "uuid": "56bc0761-4602-4b7a-b357-d70f3f4356de", "comment": "Malware payload (RedLineStealer)", "value": "c06ab3b118b015d8c84a3e46f614a3ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698028743, "uuid": "27971947-1af5-4cad-90c8-0612dd50033f", "comment": "Malware payload (RedLineStealer)", "value": "90f8d3b0a8ab79a3c28d287141d6c9fc433bd076906a75098cf2ef9efd339139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698028743, "uuid": "92f6ab76-477f-43a8-a2ec-8860b399dc08", "comment": "Malware payload (RedLineStealer)", "value": "5c32fb6d6e7076fc53cb3b4983d6f80917ef884d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698028743, "uuid": "e57eead4-eb90-4992-9b2f-e48f87cb471e", "comment": "Malware payload (RedLineStealer)", "value": "2cd01dd095ad2976f46292e1699110a67922bfda3758a98bf79966aed33bc9f89ab6a823ca5b41d3969bfc8950add582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698028743, "uuid": "055739aa-f3b9-4b7c-a7e5-bf114bc08a22", "value": "T1A5B48DAEF5D0F831C077C572C81F6B28D4939A788B0617E77EA1C56D17882E2BA764C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698028743, "uuid": "c24fdf71-abdc-4cc6-90e9-1d80310fc690", "value": "d52ccff4f325ce6b295038c3a3f9150f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698028743, "uuid": "5285c19c-d63f-4337-90e4-78fd17216fcc", "value": "12288:/8Q0LJb2vpUOXia60C3O5R2sdLu4uBPyL:KJb2dC3O5RnLu4FL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698028743, "uuid": "e8b7aec0-3599-44fe-b460-ca11b329a50a", "value": 509512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698028743, "uuid": "0a2e204d-645a-49cb-8947-18c4e5f23b81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698028743, "uuid": "19071980-b757-4e8b-8977-66acd2ff254d", "value": "SecuriteInfo.com.Win32.PWSX-gen.15018.12191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a864da8-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698057449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057449, "uuid": "5e85f6cc-eac0-4894-a5e0-58dbc60ac619", "comment": "Malware payload (RedLineStealer)", "value": "873e8688e4f22947d6ea64b726f7fc8a", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057449, "uuid": "5427a876-53af-4606-b533-d925fa51c1fa", "comment": "Malware payload (RedLineStealer)", "value": "9159017c61287af814b52773e4461318614129d6d851e7f4a558564b369e624b", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057449, "uuid": "86129642-af6a-49d0-b263-68525983bc58", "comment": "Malware payload (RedLineStealer)", "value": "b1877273f01ce1ceee71e667e0fa8eea615bcede", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057449, "uuid": "93e5326e-8ea5-48da-8260-9a8850495c1e", "comment": "Malware payload (RedLineStealer)", "value": "1e5101c10ab097f7b9c9ee2af67eabb882c9c9adc46ccd17aa922c76e751c138a1b9adf3b45d88dfc2b97dfccd97f3ce", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057449, "uuid": "4f51f075-60ad-4888-a97d-ebf5a7dea26a", "value": "T1B2645AA5FD81C43FE47646B35CAFBE28F8253960537153DB6E93C53B0A642D19AF2088", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057449, "uuid": "1b9189b7-fb3c-42bf-b4fd-bf3b5eb4a46d", "value": "d52ccff4f325ce6b295038c3a3f9150f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057449, "uuid": "95aabc32-e5c1-433e-b5b3-d620026e5b83", "value": "6144:bHqQflMJvz0CYozXA7MZAxjdQCo98z6IzzK/oNh:7qQW70NozXA7MZAxiaWabL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057449, "uuid": "98274573-d9a6-4063-94f1-13cc478d6872", "value": 336968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057449, "uuid": "a56ff4df-4e09-4763-b341-5f628bfbaf5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057449, "uuid": "ac543c04-9b6f-47da-b158-067e3a42cca8", "value": "873e8688e4f22947d6ea64b726f7fc8a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d53667-71b5-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698073519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073519, "uuid": "9f87e8f2-ac55-410b-a23f-fa27d8dd2861", "comment": "Malware payload (RedLineStealer)", "value": "153e18419a8d2394077e4b9a8475927c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073519, "uuid": "663ea28e-e6df-4cc8-8059-0e040ed10807", "comment": "Malware payload (RedLineStealer)", "value": "9173aaa7878972c28468353c8df3fa6be2e0df8dd9748be19753b4dc629d882c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073519, "uuid": "06609eb9-f8cc-404e-9bfa-d42fa3689db8", "comment": "Malware payload (RedLineStealer)", "value": "d898e5be8dd037a612ba0f81c00e4e417e73326e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073519, "uuid": "246d014f-48e0-48b9-b691-79fc25370a87", "comment": "Malware payload (RedLineStealer)", "value": "3716bad46d29744c9cfa1ae0306783d291882da63e060c6c1529b6d944a964b70175ca92fd6c2d55d1db9e298502a8e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073519, "uuid": "e02d71e5-b895-47c4-9dfb-7c77041aa764", "value": "T114852316EFE59433C1B6133088F61693AB75BC759A18D31A33C7CCA70976AD12131BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073519, "uuid": "13b85fec-321b-458a-8058-de0ae138ae9a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073519, "uuid": "880efeea-d86d-46ac-b1f4-e0889d2e3bf9", "value": "24576:OyY/Ng7CJSJYQX5IvM/Vh2cKMHKSPhhwc41SgtN133aBfOMC+ZUpLz/L0heI0k0:dKGes/5CM/z9hTdgmesUpiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698073519, "uuid": "23ed8f6f-3dc2-43a7-9a2c-1b50b7784959", "value": 1763328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698073519, "uuid": "73d0f516-6d93-49aa-93d9-47e49fc6dd0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073519, "uuid": "c351733f-7320-4956-a66b-77820c668372", "value": "153e18419a8d2394077e4b9a8475927c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a17738-717f-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1698050193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050193, "uuid": "2256e8e3-416b-4acf-a2ed-5f8d5b9eeb9e", "comment": "Malware payload (Gafgyt)", "value": "42263919aaf616113ca296d9a07571dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050193, "uuid": "6159e22a-acde-49ba-9261-4eb98cb341d3", "comment": "Malware payload (Gafgyt)", "value": "92550028e1c4efe507afd59ed63817f679671d28275e94aa8df990ce05b9176e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050193, "uuid": "6abb0f45-b1f6-4418-95bb-c347327fd463", "comment": "Malware payload (Gafgyt)", "value": "e0361c8634797beda0867b98366de6b4689bea56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050193, "uuid": "6db30b6f-b5b4-4c7a-92e6-ad224c564b7e", "comment": "Malware payload (Gafgyt)", "value": "af8721961483358f13dd6fac197977bc96a79f68340c8b9863d5a0a23b105719fb860c7e2b155d448ed1c3e64bee6145", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050193, "uuid": "5eb78680-09b0-4524-a980-681058f6f4ee", "value": "T175635B17B0C5D0FEC599C6741BABE1369673B12E4231F1AEA7D4FA273E4AD211E2D900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050193, "uuid": "5c6562af-8a53-4bbd-a01f-a40eea4622d1", "value": "1536:n44W8qaJ8RPmd3k3m5bLcCmSiT5qJNasgj+ygwCYeznq1S:e8MAr5bL3piFqOsgVgwCHnq1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698050193, "uuid": "27973f0a-7e33-4e69-a8f4-5757466a541e", "value": 73376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698050193, "uuid": "8488c670-3b83-47d3-8df4-9f14531a1deb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050193, "uuid": "152dc8b5-41be-4e3f-a72b-191bd0d754db", "value": "SecuriteInfo.com.ELF.Gafgyt-NI.30943.11537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6220061-7161-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698037605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037605, "uuid": "bfc8df07-b62c-402c-ad2b-bab5efc7a522", "comment": "Malware payload (Mirai)", "value": "8314e4e87e0a904dde5cd52e38f0a81e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037605, "uuid": "559f0d7b-fbc8-4ccd-92d2-177e6a996e98", "comment": "Malware payload (Mirai)", "value": "93259c4ded78a419c350f44bda1d8822c5a8d2f4f018b5f6fac1aacaaac20e33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037605, "uuid": "f4d2a67c-bd85-44d8-889f-14f29ef3b430", "comment": "Malware payload (Mirai)", "value": "bcb707db5308bdaf647eeab4aeaa897a41c08ada", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037605, "uuid": "cfcd2375-0f02-416a-ae4e-92be92ca1f2b", "comment": "Malware payload (Mirai)", "value": "815b8b390a55b5e58de070d2ea1924da3bd9c7b89cb59438f34f92d1874c7a915cd3dcb6150987e56f38b511c420afce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037605, "uuid": "c187b78a-bd4f-4b93-ba0e-fe4cb759facf", "value": "T105336C36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037605, "uuid": "3ce173a4-e558-4434-8e2d-65e018015946", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698037605, "uuid": "83f6be6d-6818-41e3-bc37-54dff92e801e", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698037605, "uuid": "e5aeb4cf-6d0b-4b06-81c8-acd58810281c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037605, "uuid": "4f1c3bfb-8784-4998-9dde-b4326a7023b4", "value": "8314e4e87e0a904dde5cd52e38f0a81e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d65fd14-71cc-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698083358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083358, "uuid": "243fe251-3bdb-4700-a322-3f515f568526", "comment": "Malware payload (AgentTesla)", "value": "3f0b39dbe80763a971650259cf173bab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083358, "uuid": "c15924ce-fbd7-48b2-b0ac-1a869ef7f094", "comment": "Malware payload (AgentTesla)", "value": "9327aef86c931e3715c077cab8970904915e7ae4c152de92dd9946545a17cf38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083358, "uuid": "3d680c7b-f2ac-46f6-aec6-e7a8fd53b210", "comment": "Malware payload (AgentTesla)", "value": "66f387b72a67c7c5898e2dd55788d5fd33beb779", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083358, "uuid": "6914dc97-6afe-4b8e-96ef-32e9820c31cd", "comment": "Malware payload (AgentTesla)", "value": "3551298cc334d47b9147e648146842cf2ecf0213b6d1324c973d812a23e47978780e6e9d8fbcc11ccc4d4ce63df8f1c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083358, "uuid": "8fcaeb85-2749-4d81-b0c4-e881d71a3bbf", "value": "T160D4236F2F5AA1DED78BC2DAE2351B5B9D1C96D8EF710C11336192C2378A9D125EC40C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083358, "uuid": "d8a96578-4fce-4b7b-8b11-b9334bb23ed2", "value": "12288:O3ryBV3SuJar/pMD7Wf1k9kIL8hBxnYv7F1fYidAdjfn4tkbnDALvEe:MeBV3Jae7Wtk9kWYrYDLgi+dUtI8Lv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698083358, "uuid": "2f6bdca5-8caf-477a-932f-cdc84b431143", "value": 646893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698083358, "uuid": "03c3684b-b000-4caf-abf8-5390714896ca", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083358, "uuid": "f2172a25-4fc9-47e9-a8f7-b190c3e48227", "value": "INVOICE.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab63e275-71a8-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698067973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067973, "uuid": "96b2cb65-65f9-4fe6-8f71-594136e6354e", "comment": "Malware payload (AgentTesla)", "value": "c19717dd47ab946565216078c0d3fc63", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067973, "uuid": "adca3ac7-a66d-4e17-b73d-b1c6a0a98af3", "comment": "Malware payload (AgentTesla)", "value": "937dab028a6d88b7b985465c62eb1257878a42b865b73cb745c5593d0b70b586", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067973, "uuid": "cc3f11fb-f09d-4250-adf5-f5b7ea34878f", "comment": "Malware payload (AgentTesla)", "value": "73a53e1126b814ba898d779d388c914b7c73075f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067973, "uuid": "4c5a7966-6842-4085-9ccf-3359fa6ff754", "comment": "Malware payload (AgentTesla)", "value": "a56c16ff22bbe36c3123ddda1c2dc2d0432be7cebe5be0b2c21ad3fa2760641e9c9c708b0d6cba3bd543f5c72248ab77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067973, "uuid": "301e2193-8919-4af1-912d-5e28b727c579", "value": "T132F412003764AB96C63D23F791CAD16C47F28B796722D70C6CD6B2D152B672AC9A1F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067973, "uuid": "f3821b31-5ce1-44ca-81bf-178392e4b7c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067973, "uuid": "c4bf0b83-ddec-4a50-968f-15a824b5ee95", "value": "12288:MMPm+M3gR/mZRM+BJaWcM0sXXg/JXF5oJPwpG9HvrlyBwPdmbx64QwgrZmhhICnm:cgkZR5CW0sXwB1S5pDlDP0lwurm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698067973, "uuid": "afe28202-0702-44ea-acf8-d83657c97233", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698067973, "uuid": "ba7cf45e-60d6-4448-a1db-6ce881458189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067973, "uuid": "2d3958f4-8711-49c1-bf60-131c28e6df0e", "value": "RevisedXContract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b3f604-714e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698029128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698029128, "uuid": "f075bcb8-3e79-45bd-af0e-d907cbd15295", "comment": "Malware payload", "value": "022f0833d2ee9748d412bd27da23ddf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698029128, "uuid": "ff5ee865-2898-4492-ba72-a056e706c62d", "comment": "Malware payload", "value": "95e14527927ee5a2a7796fbd2cf8565eda3a7b6ef24c30fb84532092189033bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698029128, "uuid": "0cdc5a58-2908-4564-b952-d38284136176", "comment": "Malware payload", "value": "06b7261c1ad4f1d146dca41772788d3fd644cbaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698029128, "uuid": "f0a5e4a4-9299-417d-9a74-c85e7f54b836", "comment": "Malware payload", "value": "4f94cee0869ad506e0b471b72d3df75dbffefd884299ae09617df793bd0ce79b50199f04774796b1def72bc4679aa7ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698029128, "uuid": "591f4af1-8306-46ac-ac1c-93b728340c00", "value": "T182545B40F785C1E9F9A5093464D97F7ACA33A9B4870E59B3B318DB4A1813264BF0678F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698029128, "uuid": "cc485b93-8f7b-4db0-bab1-86f98b88861a", "value": "652c6b8d4a87e3cd965d7d7d7093f0e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698029128, "uuid": "d26ad625-5ad5-4b55-9115-702dc2aeed49", "value": "1536:AuCxmHFzsPR1SPegK/hJcTTvsrI6Y0cOGPfV++k8OlpnXS:A4HFokK/hJcTTvsc50pG3V++kDlpnXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698029128, "uuid": "cbac7025-ca97-4b9c-bd5b-6a8a0536e008", "value": 280026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698029128, "uuid": "b55aa9a9-30f7-404d-baa6-ccf590455fb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698029128, "uuid": "0d378d3c-926e-46d3-afb6-7eafb8c4e3df", "value": "022f0833d2ee9748d412bd27da23ddf0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768c14e0-7187-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698053711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053711, "uuid": "f5678f92-5121-43fb-af89-02c7b99af0f3", "comment": "Malware payload (AgentTesla)", "value": "68508033be679139e5d59b3f32429fab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053711, "uuid": "755c8960-1b13-43cb-80a9-c92e811c34ff", "comment": "Malware payload (AgentTesla)", "value": "95e502ac566d62e3930ce23cae0f68209b3f5ea75f27cfc17fa62004a0fb6556", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053711, "uuid": "63824158-f6e2-4526-90d0-f8e51fab58ab", "comment": "Malware payload (AgentTesla)", "value": "73893b3bdb9dffd9239428da626d17fd844d27bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053711, "uuid": "431b7040-1d0c-4902-ac1c-e771326305d4", "comment": "Malware payload (AgentTesla)", "value": "380b9f254e970cecfa62cfe5a05e7dc22470b98a0a6b474dfdd72bd166e6fde0be21927ba94aab66e653b823729f7840", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053711, "uuid": "3d76bcf1-e8d8-4cdd-85a7-2a1b1f268538", "value": "T1D7E423591FC33A8996DC1F8C25C07E35FB72272A7C0533B9566206A7830B92F6FD2196", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053711, "uuid": "7654e4de-b3a1-48fd-800b-578ca53145e4", "value": "12288:HvXhpZ+MFOkXTXynnmjTp9kEGtNAlYvXRFpedGdSyVuJBr6wsIr:HpXz1Tp9qNpvhzeda1c6wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698053711, "uuid": "e880cb97-817d-4d80-97e1-2b32f971c40f", "value": 663807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698053711, "uuid": "3ecd442f-e341-40b7-8488-d91475058fbd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053711, "uuid": "b3920bd9-90c8-4a33-91e2-f8d20083478f", "value": "Outstanding Payment.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43f04a6-7158-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698033629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033629, "uuid": "0789ef13-1870-4f7c-b12d-2d0fc2225b35", "comment": "Malware payload (RedLineStealer)", "value": "02fcd5f7287942485e7c6d6150147983", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033629, "uuid": "3d07f4e2-ef3c-41fc-a446-736e392ade1d", "comment": "Malware payload (RedLineStealer)", "value": "96e9f0ef9354933006a9ddde91c5a0bad64f94eecc040655d47f6e5b0033c375", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033629, "uuid": "880b3cee-245a-44de-94c9-a3712ef86c42", "comment": "Malware payload (RedLineStealer)", "value": "86a1bf08c416f297102a79cdabff6288c2599abb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033629, "uuid": "435aa1fb-1ed1-4c19-9eff-f8ea1ecbcda4", "comment": "Malware payload (RedLineStealer)", "value": "239ff45fa29995bc1bb955c9a18d2d092c9b2f3c92650e3e031192d53d1467ea49bf789229b84b5cd4ad5c5eaedf39c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033629, "uuid": "9e1be438-a5a7-4551-b4a0-894d748ab43a", "value": "T19DF42217DBE50532EDB12B7A08F602D30E363C618C79D76B3B85A9660CB3594A47273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033629, "uuid": "db7c849a-12c6-4324-a1ea-259d5decf866", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033629, "uuid": "758cba32-881f-4ec7-bd2b-52c54f8273c9", "value": "12288:BMrgy90YUz0i0ZUDPgzSSK/J55Hk/zwKMVQg/1EdVz0XgtQyVVcC:JyVOkZ4VSm5bT/1EdVz0EVV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698033629, "uuid": "01a2ab07-68a7-4c96-b234-9d5d28218014", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698033629, "uuid": "a05eb283-f2ef-4445-8aa0-23bb4ab1fd59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033629, "uuid": "185cf629-87e5-4c14-9ce0-8376fe5d296d", "value": "02fcd5f7287942485e7c6d6150147983.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282d0e28-71cd-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698083645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083645, "uuid": "b4af6d5a-012c-4b7f-a261-4fe5f824a30b", "comment": "Malware payload (GuLoader)", "value": "51468f177569429b0520ad9a76b03161", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083645, "uuid": "33305077-56ff-4fc9-b1dd-73e9cd1fe16e", "comment": "Malware payload (GuLoader)", "value": "9707c1faa4b7191af96f2879472c6bb368eef29b80d917dc9dc197f92ae86b8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083645, "uuid": "f4490a09-8c62-4560-8fc5-a7c116df4150", "comment": "Malware payload (GuLoader)", "value": "8aa5242e9da0e1d53189c7ba647cef3392213023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083645, "uuid": "76795c50-9faa-414c-8fe7-e82b3a9e63fe", "comment": "Malware payload (GuLoader)", "value": "1886b1993f431b19161b6a3e8afcf664b34393b078b85087aa55a21cea7823be9ca5329d3869cc9d8223d37091d4d526", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083645, "uuid": "58ecb1c5-8a2e-4d3e-99a3-2e1dd161d8be", "value": "T1E83523200AB6D017C8AC17F327B5D463AA6E7F62D1463A237325A16C7930395F6AD373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083645, "uuid": "c1cb03fe-6d62-4904-96a0-c58337a2ccd8", "value": "7192d3773f389d45ebac3cc67d054a8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083645, "uuid": "1baaea43-5d7e-4143-b880-652c120fb559", "value": "24576:QvuXRId4qVnc/tGrZ5JEEemQqiB75pf1vIRBKoFQtFNHbgekT:rRId4eEoZ5JEEe6il5pNvIRBjFal4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698083645, "uuid": "280b7b1d-9a46-4fe7-8068-969c3a2613ca", "value": 1077744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698083645, "uuid": "7e581ade-3ba2-4a3e-8035-1327792beb53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083645, "uuid": "7f2fe4ec-2a7e-4ea6-a1e1-c65313206cac", "value": "IMG-2023010_WAA646737kendelsesordniGenicular.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726e89cf-718e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698056711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056711, "uuid": "39ceee8a-135d-4d0b-9bd9-b9722f061174", "comment": "Malware payload (Formbook)", "value": "4aa6ea3405f9bd2c4d2009e262c2d46c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056711, "uuid": "a0bd7cfa-a3ff-42ae-9b7b-4621ea979d16", "comment": "Malware payload (Formbook)", "value": "976314b7a78022730e95f94ec9bde2c2336be574eccdc364ac26757fc7c1e267", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056711, "uuid": "fe6248f5-5523-4f04-ae22-c8a87d36f42a", "comment": "Malware payload (Formbook)", "value": "f43269a6c58648f43ca489f55b9e4f05e198d6cc", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056711, "uuid": "6564bd6b-ba56-4468-9648-df6ae12c2d2d", "comment": "Malware payload (Formbook)", "value": "8404945032bc5c75994bd8021544b8dfe1a7ced8fdf76015f484f82a9968167ce96d27e87b52d3b02594aac273c7fd9c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056711, "uuid": "7f4ec9d8-b16b-460e-ae75-c17cd781ce1b", "value": "T1F2838A6DD34B01A98F625337AB1B1E5442BCBA2EF38152B1346C533533EEC3961662BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056711, "uuid": "d536e480-bb4c-4d0f-af6a-ad3b90cc40ac", "value": "768:RwAbZSibMX9gRWjSdFm1pgWxNvwJ7vyWE:RwAlRK/gWxNq7va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698056711, "uuid": "231c61dc-2a78-472c-a642-99d04f64f0d3", "value": 85864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698056711, "uuid": "4275d756-d25c-45bb-b8b6-d3def9362146", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056711, "uuid": "7e438c37-1229-4863-ab51-4fb57b06c226", "value": "Quotation_Oct23.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d8259e-7164-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1698038730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038730, "uuid": "c10135e3-bb69-4bfe-8600-f42ed2040ed0", "comment": "Malware payload (LummaStealer)", "value": "4e59fd543a029d6201ab081c160ad251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038730, "uuid": "78a06ba7-1898-4dda-8b53-4b06eb22e92e", "comment": "Malware payload (LummaStealer)", "value": "9767fffd4c64f88c3b9d469997d162a5e637c3e0f9263dfad781f0a06c5c8ac7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038730, "uuid": "60d843ce-ec59-4afc-8b29-249f360a145e", "comment": "Malware payload (LummaStealer)", "value": "996007857d4970a375e9af04da749852c71a5a4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698038730, "uuid": "43c12e85-4897-4253-aed4-3bf4d98e9b48", "comment": "Malware payload (LummaStealer)", "value": "fbb106353efaab1240ada8023cef877a88a074115641d20e2d125704491ece77c055e6e5cedb9dd93940e2092364a489", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698038730, "uuid": "e466a23b-b938-4de5-a9da-a9c37ae18c53", "value": "T11585238916D84172E9742B3CDCFA43C30A797D02C879D65B2FA0B94C4E63690A476F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698038730, "uuid": "5b3c86ce-4607-47bf-934c-4a4d751e572d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698038730, "uuid": "60b840b2-fe50-47cc-ad4c-bbce390e3895", "value": "49152:RNGhD4hPdJOh7SNLYROJZARnD4SjYpHczCWY+:bZdCZRqqnD9jYpHczCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698038730, "uuid": "1b10ae47-e031-4733-9b12-7da783f19510", "value": 1825280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698038730, "uuid": "910bfbb8-d97b-4d68-81d7-02cb24a54348", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698038730, "uuid": "c5e1ab02-1940-47a3-8221-cbc27814a793", "value": "4e59fd543a029d6201ab081c160ad251.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8343e6-71ac-11ee-8907-42010a9c0042", "comment": "Malware payload (Meterpreter)", "timestamp": 1698069477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698069477, "uuid": "562e2b80-c5cd-4cb0-b756-a0d271970a70", "comment": "Malware payload (Meterpreter)", "value": "19879eb49fbe16da1127ffb7cd5f58b9", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698069477, "uuid": "d6c50e86-12e2-462e-a6a9-f7f31c18e98d", "comment": "Malware payload (Meterpreter)", "value": "987bc934bf99021763399808d9a24bc5cd4ba351edf5addd6e4a16aa6cbeb68a", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698069477, "uuid": "6e006cfc-ce04-4b10-928c-67f0fb07ab4b", "comment": "Malware payload (Meterpreter)", "value": "5dd01e719fc935b05a217c9fbca3a1a1e422d75a", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698069477, "uuid": "61fdf933-6cad-423d-ac1b-353b79935e76", "comment": "Malware payload (Meterpreter)", "value": "d6bd332244d065138f894b847ac82ca5cbe2d2eac8beda4075f1aa5d44f8d093ba895532514cd003953191d9a4a55fb5", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698069477, "uuid": "7db893a8-f85c-41eb-b1b9-4247b07255fb", "value": "T19573BF42EAC81866C1A6117E17753AB5AA70F5BA3345C09A3A8CCDF5DFD1C70A3263C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698069477, "uuid": "9644ec96-86f6-453c-9a71-27182a1eacd5", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698069477, "uuid": "564cd073-f6be-4755-8e8d-32a733a09850", "value": "1536:IwpLP8QKNRErP6BGIlqQJ0UMxIosTJ6uMb+KR0Nc8QsJq39:fpLP8FEEQQhTJte0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698069477, "uuid": "9de40cdf-a9f0-4524-ae1e-6b672091e5a1", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698069477, "uuid": "6666ed28-59a7-413b-aef8-c1231dbbb2b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698069477, "uuid": "c83786f8-e661-4452-8358-98de937141f4", "value": "ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ae3097-7186-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698053168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053168, "uuid": "7756f804-2c80-4d43-aa93-3f027ec81de8", "comment": "Malware payload (AgentTesla)", "value": "da4389ad4160e9e309e39f5df093b785", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053168, "uuid": "04c1a0ee-7b76-4b0b-afa6-8a3dd3462234", "comment": "Malware payload (AgentTesla)", "value": "99691dbe4117df0f9364913855c7b66ab15b39a36f6008736377d54b19ae2195", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053168, "uuid": "09499668-6249-4284-a0a1-4a9324faaa79", "comment": "Malware payload (AgentTesla)", "value": "1431c8ab520530b980b574621bf52abfbc1a5775", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053168, "uuid": "5d735069-a754-4638-886e-2c2892ca7f88", "comment": "Malware payload (AgentTesla)", "value": "bc6f4a7bf011be5c0feda0fc68d4a8e1b28e3e93d1d240b8a6f43c62defcdbef2090ca86dcfbe96e8ed86aed8f3174a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053168, "uuid": "1e344fe4-da82-4e6b-94cc-65ff4dcc5f81", "value": "T109C423DE80881FC3E6C146327539C533B18A3BBF1C825DBE6D964523A9B1869327E65C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053168, "uuid": "837fa51a-689d-4d9d-8419-562265a07516", "value": "12288:A8Q0vn88D1174MBqyggevLY/ZtXzuVaScPZE46fGfQa:jQaDXRqtgfxZiVsZO0Qa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698053168, "uuid": "fc4bf952-a5dc-4d83-ac66-7100750b69a5", "value": 572249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698053168, "uuid": "d7c1ed89-719c-42f2-8053-37c009bbd47a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053168, "uuid": "50c22679-7640-4f26-9988-85f1161fbc01", "value": "Offical Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418bc529-7173-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698045032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698045032, "uuid": "7355532f-a2ef-4a2f-a9e1-1fe2a8adc8f6", "comment": "Malware payload (Amadey)", "value": "1950328abc16d1d9031b6d0b31cec828", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698045032, "uuid": "7fd01547-7c3f-40a5-bf37-54811ff43710", "comment": "Malware payload (Amadey)", "value": "99c860e50ce141cd665e7c0f852147aa62d50d755567fc59b23b20976caf5f0b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698045032, "uuid": "0eed32fa-c848-4ebf-a051-6636c6e38bff", "comment": "Malware payload (Amadey)", "value": "9b3dc4a5df39da091767833725d479beaf9c51cd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698045032, "uuid": "08df54fd-1975-42aa-9186-3f4a0da3b984", "comment": "Malware payload (Amadey)", "value": "c6c16d66b8bc6bb139d4fb265d72c14824a4b74cae647d1225a8ec141ec678df3b0821c0c1db19b8dfe1da20e7031e61", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698045032, "uuid": "3c1e04f6-e402-4d2c-afae-57e907f8e1b7", "value": "T128152323F7E84032DCFC1B709DFB11570A36BC909D6887AB3762548A4CB1590AA7277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698045032, "uuid": "0299562b-a2f7-4506-848a-243eb939ba6a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698045032, "uuid": "ab459b75-f4a6-43a1-a8c9-ac825dee02cf", "value": "12288:3Mr2y90MgDlaBXtblgK22QVG5rcl769A5E8x171wDineYZbNDtmFh/Ckq9e8c/E5:1y8at7Q85T9t8jyD18xmnCkF8ci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698045032, "uuid": "5890afd5-e413-4378-a612-008cbe4406f6", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698045032, "uuid": "23d0ef11-af44-4706-beef-d0d846aa80d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698045032, "uuid": "d85f2fe3-c0e4-446e-a622-4592814905d0", "value": "1950328abc16d1d9031b6d0b31cec828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95e50dd-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042710, "uuid": "4545d673-0447-4bec-884e-06355841b9b2", "comment": "Malware payload", "value": "ac4a66755965d1a0417e9350eb153063", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042710, "uuid": "4daa7870-0792-4b0a-801e-05ae7990646c", "comment": "Malware payload", "value": "9a3720df6f4b56b27ffca22780b82cb147b776502811c8f5ffffee9582e43812", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042710, "uuid": "f88a654b-e39e-4e71-890a-633ed694a19c", "comment": "Malware payload", "value": "24cf2f7aeecc2f7c21682bf3bf1405527d52665b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042710, "uuid": "f2e5bd03-005c-4df7-bc21-0904b18a11aa", "comment": "Malware payload", "value": "922af71c3d070d3cabac4b9863a732bcbea389e27bb08517c03a8cf6fc535cb601d3bf6ac25aeec2a4369f47583a3878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042710, "uuid": "cec3ba52-cffd-4782-acfd-574709b2bd9c", "value": "T1861502433E06C899C8256938190BF9AD8920EE18D64BCA5A33C7FF6D3B73F29674550D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042710, "uuid": "12b29cfc-98fc-4410-b643-45d2d4ad679f", "value": "aff394365861313f1aa77d5245cf7c52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042710, "uuid": "507da1e6-3394-4731-99e5-b2296aaca864", "value": "24576:KaiuaQ9sDAfZxADr+fD5IoIpMyYtaLXXVVhdo11Itspc:KajaIscfZxAD/YiVhdomCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042710, "uuid": "c421427c-8e25-419a-b86c-ad4bd93f0040", "value": 898648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042710, "uuid": "550e114d-685f-4ea3-8630-c43503235a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042710, "uuid": "1d7b8f25-cf92-43f8-8a22-0b6711655a74", "value": "SecuriteInfo.com.Trojan.MulDrop6.37997.13737.11745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d985236a-7180-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698050871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050871, "uuid": "c2d4023f-fbcc-4b0c-9490-4d6c02e35e1b", "comment": "Malware payload (Formbook)", "value": "ba528c8e3a9c1f5fd874119c537ee263", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050871, "uuid": "f2391512-4284-46e8-b5a1-2e705da7427a", "comment": "Malware payload (Formbook)", "value": "9b20b8fde8dd9b95995f57752a6ba6bb3b0f4985ab5f80b9b64cdc2e7ecb0fc3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050871, "uuid": "272f70f3-5be5-4d1b-b937-9087dc03a95e", "comment": "Malware payload (Formbook)", "value": "2ea60eac86919d82482e2e57351e8e9ab0694f3d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050871, "uuid": "0ab5aa7e-490f-4b01-951f-6540d81f257d", "comment": "Malware payload (Formbook)", "value": "6f9110edfee2ebf0d0f82f148b773c6b8bd3ee1c4308848688c136e98d2596a33da3bf5ba240908cdf902806fa699138", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050871, "uuid": "f417721b-482f-4c61-bb09-892c61356fe6", "value": "T18812C043BC1264BB87DEAF971AA86C6081D64E17C65DD24AACDCECA30B159042FC1A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050871, "uuid": "9921694c-fc92-46f8-917d-ae90de4be868", "value": "192:doqvs61sAGMz3RcuiGD7ygSaohbLSO4OLX2jZ:eqvsyJGARc8WgS1SwLGjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698050871, "uuid": "91af0908-955f-4fa7-a018-70f91baa9eea", "value": 9645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698050871, "uuid": "ac3f119c-5ca0-468a-ac9c-1432ae97da73", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050871, "uuid": "5217d987-221f-4787-a67b-96f924cd4e3e", "value": "Po-37485.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336a138f-715b-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1698034701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698034701, "uuid": "68dabd19-8403-434b-9688-da34696de9f9", "comment": "Malware payload (Tofsee)", "value": "cd3e9f9c12ca60569ec8eb8b8d2849bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698034701, "uuid": "45621beb-5107-4fdb-b624-698cfd055d67", "comment": "Malware payload (Tofsee)", "value": "9b773f29aa60dfb946d4a2435b8a421cb5d481969e6c9e3cb6d43631c1efa2b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698034701, "uuid": "22fc16d9-9733-4a61-a464-9aac0e2fd072", "comment": "Malware payload (Tofsee)", "value": "f5ad0063e1ec3c9f58c8494f2a8350acd8f314ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698034701, "uuid": "bdc11fa1-f9a6-4f39-aedf-61f9f026e209", "comment": "Malware payload (Tofsee)", "value": "2839313df2d089a589a65aab0bd874db2a913fd1690c6c0ce9ff9610932eb07f48ecbbd6f41f7c7ae74a2b46f744d0ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698034701, "uuid": "be7595f3-6cfe-4364-aa1f-9aa12804c109", "value": "T18704DF217690C072E0A7A5311970C6611E3BBCB2AF7580CF37683A7E6E713E19B65B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698034701, "uuid": "5f2e7485-b289-46b1-ba39-f5026eda6792", "value": "8ea5db4b889f56362e73547d3beef0d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698034701, "uuid": "36ef3d9b-5a7e-43fa-afb8-d50e78b35ef4", "value": "3072:FyBNbfF6eAnc2Tzx4QL0YNmHhBZ03eYqqOkkYe0jNC4vj5MLIFBX:grnAnXTz6Qwf87qqrk16M4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698034701, "uuid": "ed7fec8f-1f61-4b4e-9ec1-d5ca8f6963d2", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698034701, "uuid": "fb223440-1c42-4512-b475-bfd3ee755e24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698034701, "uuid": "df5c4a36-eae4-44cf-9bd3-31d82d072d89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a75bd4-7188-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698053985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053985, "uuid": "904f0c84-49b7-4539-ac60-5dfbcaff1adb", "comment": "Malware payload (AgentTesla)", "value": "fad6b34fb4c8cb1d3905a90385e3173e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053985, "uuid": "214caace-aa1d-4912-a3a9-38e98164c850", "comment": "Malware payload (AgentTesla)", "value": "9b79474e99f76f290dd2f35a548eda9a954bd9930e767bab428609d396737261", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053985, "uuid": "b50540db-6216-4f49-b9b1-59167f60d238", "comment": "Malware payload (AgentTesla)", "value": "dbda19ffe7706884c1139bd2b85348d762df6846", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053985, "uuid": "e1cc082c-352d-4ef6-8182-e50a6cd376b7", "comment": "Malware payload (AgentTesla)", "value": "f144f25ac82d489ea8474676818c7c320378c9e4ad665b6c4d49c791fa0dc52ba1ee89d0ed4a98282d947af939b59b40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053985, "uuid": "cc22ca4f-8cf0-45b9-834a-3fc1545248cf", "value": "T1F7D4237DE249131D3E72516C1EB3EA38CF6342A6E035B47D916C4370EAB5D8AA1252CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053985, "uuid": "4f974da5-9e76-4d28-a559-5d659e820957", "value": "12288:GoXotpZ2NpAVGm5yDtKRgsyoYPk0rcR2+Oz4vzjuBnSZJxEsiTTpE/XMR:Go+pZSpSGWyDtKRgNzrI2jz4vnuBnSZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698053985, "uuid": "0ed0fe60-b6f1-419d-890a-536bf7e43157", "value": 656027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698053985, "uuid": "4583e282-789c-4fe2-9190-71451c6dbdc6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053985, "uuid": "6d5d660b-3c27-4132-83c6-93ca66cfe4af", "value": "original shipping documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9cf5a4-7176-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698046608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046608, "uuid": "f79dd9f8-0fdd-4310-be27-292fe6328443", "comment": "Malware payload (AgentTesla)", "value": "8e8368d611ad11019be4de656f4ea858", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046608, "uuid": "0e2a4cbe-a60e-4e9f-8b1b-b5f8ad503e7f", "comment": "Malware payload (AgentTesla)", "value": "9bb7089acae83dafa7d2b4acae2384cec384bc2aab6962e514122ac69c6a5fed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046608, "uuid": "b2dbe2be-93d8-4135-9557-6107f1666cc2", "comment": "Malware payload (AgentTesla)", "value": "53039eda52fea72877e9336efe1c9f0c03ad3a62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046608, "uuid": "69db54d9-45ab-4187-bd13-a78c8dd82d3d", "comment": "Malware payload (AgentTesla)", "value": "25ed2eab2a24391b41b71fc7a8927343f088e00788503df8e38dd4346342aaaf575d085db8b535a749370d3a93b18fbd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046608, "uuid": "9a04531f-9e17-4432-bdc3-1d0b8bbcd628", "value": "T152E423511BD5AB83D076A3F958E641A013B1AB5DA423E30D2DC215CD27BDF42CAA2FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046608, "uuid": "6a15dbcc-8d22-450d-a181-b29f82b7ed98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046608, "uuid": "66f1b170-da53-42ea-8985-8c9b0daf0e77", "value": "12288:N2PQNjMFP/sFi4m5b1qvl0GzLZl/vlc3dk+8jhsR8pigR/mZRM+m:NJNwFP/KhuJClv52WcgkZR5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698046608, "uuid": "40d75469-25d4-47b4-9bfd-261d6d56d378", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698046608, "uuid": "ea50f0df-8b36-4914-bb4e-a57405d44c21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046608, "uuid": "11ecb5e5-b4a6-4e26-a413-5b62d0934bbe", "value": "ithalat Transferi ID Bilgilendirmesi 2023-10-20,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b13ca9-7146-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1698025947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698025947, "uuid": "fc251d29-9f78-4f23-bd2e-2131ac56b90a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "2b8bd5b5849508f465f4eabfdd3ee1a9", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698025947, "uuid": "e77dd62d-398e-4857-ab01-cea33a3eacdd", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9c5bf3d9eed2217c4da66fc4ecc7dfa9c79a0bf6cbbcdbef9f28ad3518879e78", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698025947, "uuid": "e1372d36-5fc2-46e7-814a-0add591fc9a6", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "a0c8fd78227b07a8a6ca7d6bb2422e7a218d25f2", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698025947, "uuid": "265f1a1a-5f14-4f6e-bd0c-056ce5351ce3", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "f526c6ae1e7b4526bc05b158e232ad0824fdc35b3973ff9dc707797dd9ced59343080b769db31b1f2f99cb39147bc0b6", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698025947, "uuid": "031d022f-bf83-49d8-b217-890b981c83a8", "value": "T1F9752343F3D98063CCA01FB058F2119705BE7DA65C7486AF268AAD0B0DF3585A1B7B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698025947, "uuid": "ffcb1b7f-e1e3-4bde-aaca-d77466e7dc32", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698025947, "uuid": "6351969d-d78a-497e-a1e2-1c9a2fc6f9f2", "value": "49152:mvnZSzCFDAUxx+ddFfU+hxOXd2wBzLBi:onsme1drThx9wBzLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698025947, "uuid": "b31aa17f-3166-4005-9b97-bcc55407a3f6", "value": 1592320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698025947, "uuid": "bbcd6a3e-c839-47e0-86bd-4da5ecfbe831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698025947, "uuid": "38de1d09-b4ae-450e-b7be-8395162f96ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ea99e6-717e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698049759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698049759, "uuid": "ce92df2b-830b-41e0-ae51-b485bee225b9", "comment": "Malware payload (Formbook)", "value": "f2299a90272e6c686f7926bf010d0956", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698049759, "uuid": "8bbe29e5-e23a-466b-ac38-e6c50aacac3c", "comment": "Malware payload (Formbook)", "value": "9d144139dc61940b251e02233e416f9e7ccde1b6cc4b96978c1f88fb6c09f5d5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698049759, "uuid": "75945c46-fcdb-4a8d-978d-5ce0f2fd5fe1", "comment": "Malware payload (Formbook)", "value": "d66d4eb626380ec825932d19dbd11bcc1eda9cce", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698049759, "uuid": "54328c49-3ead-4c7e-b532-319b6247b22e", "comment": "Malware payload (Formbook)", "value": "e525afa19fae91d72104b100b866665cbd3bbe4d4d42990b3d7f1d25873a9c20d5471baa874699afc375a25bf8313d18", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698049759, "uuid": "eea8cd7f-a701-4841-93d7-e235266e7fd6", "value": "T150939B6DC34B02A98F6663779B2B1E4542BCBA6EF34452B1306C433533EAC3D51266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698049759, "uuid": "0b510988-c4d3-4465-92ca-32805d196018", "value": "768:ZwAbZSibMX9gRWj4GxVI7Vqg8LYUMAGPl3KVIRF:ZwAlRbGxVIZqVEUMcaRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698049759, "uuid": "84e47b94-5075-48d5-bd37-815d67e62433", "value": 93416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698049759, "uuid": "9f6a18ec-e526-4574-9c84-a9fb049bf459", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698049759, "uuid": "b1203667-e87f-4d4d-83b2-b3418c602222", "value": "RFQ.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56aea8d-71ab-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698069279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698069279, "uuid": "f3a2baed-54e7-4fb2-ae50-c03eb868f11b", "comment": "Malware payload (Amadey)", "value": "942af93b242c40ab20e36efb01e406df", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698069279, "uuid": "906ab863-6ab7-4b00-9889-898400a1c808", "comment": "Malware payload (Amadey)", "value": "9da56a411ef414d31af776816e20f022a005a3df31d49095b3824021c7693122", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698069279, "uuid": "a7ffeb9c-a8fe-46cc-b0d7-858556d1a8b5", "comment": "Malware payload (Amadey)", "value": "79b5e689997259ef53e4ab84b0eadafbbdc694ec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698069279, "uuid": "54a2a665-94b4-4bed-8c3f-9a84b6498c50", "comment": "Malware payload (Amadey)", "value": "4f68d7bd9b0d40bf77fb9cca09caf9537df562fbb056caf91b34fd7c6689cf32d46ee6bdc9dbb1a4c216a7910dab72e8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698069279, "uuid": "938b5a25-b1b1-4327-995c-7d1468485f2d", "value": "T132752303D3F90A71E8B867B019FA13C3193678625F3453676BE5C8A60C73645983AB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698069279, "uuid": "5e4dbd2d-56fb-412e-900f-1da178a9491e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698069279, "uuid": "73d612bc-c80d-4f5a-bab4-3d4246c26fd9", "value": "24576:NyuQTzCM2dsrDjsBJ5xWX0/UqBzHPOB6iqK7xq1lXwSGVL9b2h8wTJObL3G:oRP2dingJjMqBLU6s7YI9b2m2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698069279, "uuid": "8ff96d56-8430-43ab-a3fc-00af4b672169", "value": 1583616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698069279, "uuid": "40a555f9-a2a1-412e-9591-35920863a611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698069279, "uuid": "adf2fcb1-c8e7-45ba-be0c-8ab15ed25c66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17238686-71f0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698098648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698098648, "uuid": "2b1b113a-63bf-4aef-9d3a-05fcdc74ca2b", "comment": "Malware payload", "value": "863219f7d35d1e33f1b05ddc2bb42faa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698098648, "uuid": "71703c96-c3ea-46cb-8c6d-f4d7c21b3e10", "comment": "Malware payload", "value": "9de7f524dcaf5b3f154521233d410711f0ae0c139bfeec16441c342534ffbc80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698098648, "uuid": "dc647a63-f4b0-451b-85be-d48fed2fd1fe", "comment": "Malware payload", "value": "2a12d30bb5d171d933b7c0c5ec23266d093335c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698098648, "uuid": "ccf8869d-9d43-4d75-bd22-6f1123a9ea2f", "comment": "Malware payload", "value": "f57a46e9f1eaad6cd775cb88ff89b0a8190c0ff206c47199a703647cdfcef3ea0935996efef679ca7dfbff9e5c4f83c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698098648, "uuid": "a3f38ba3-59fe-4519-bb48-b7f466b6977c", "value": "T12C1633EC7340213ACDEB8572B668AA763D4D20CF1C07592B77C769FBA05104ABE447E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698098648, "uuid": "7965ab44-e1f1-4750-b0d1-8dd0f92042aa", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698098648, "uuid": "165c7830-2543-429e-95ad-65c1f4adb667", "value": "98304:a30A8Tp0iDktBybzqwlbbnZMj6f2cOdvpOJGPRQkA:G0hFhQtBoqYbZMGhIxPR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698098648, "uuid": "aea346e0-830d-49bc-b5c5-0fa5e9b52c20", "value": 4075136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698098648, "uuid": "2326fbf6-42cf-43c1-969f-28d2175c2f82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698098648, "uuid": "124356d7-3555-482a-b34b-904e80a0eb55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b69a36-7197-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698060688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060688, "uuid": "022dc227-72d4-41dc-8896-da085a87e094", "comment": "Malware payload (AgentTesla)", "value": "5e9c86d312cbcf19a2fd08acdc2d85c8", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060688, "uuid": "3f638258-c4fd-4f2d-9a16-0149071ab756", "comment": "Malware payload (AgentTesla)", "value": "9e9e1e1a9905f26b22f29ec0f39ecdb3d8acb7cffbdfd0d31bb31be2a7a23c13", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060688, "uuid": "608a74ee-74b5-4f42-8dd6-33f35061e3e8", "comment": "Malware payload (AgentTesla)", "value": "a7fdf8d828b3208430045411a77685d0005f6b81", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060688, "uuid": "91431ed2-0009-474b-b280-5ef06d2517ba", "comment": "Malware payload (AgentTesla)", "value": "ffd094af7e159742b4b5db682cd308cfe34b9b650aa13152ecd0b82074f5a0924c2939aef18f536b15656a20bd2afc7e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060688, "uuid": "697a4d9f-3d8e-4bd0-b0e0-6dc9289812a9", "value": "T10EA423E73CE1D41D22CBDE2816B2D5618A7DB49D2C6FFC311742C41A8AAF9AC1BD2D05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060688, "uuid": "11e5aa85-9fa1-47ed-95dc-be85957e69d3", "value": "12288:cdak4bno6yTY9yRsMCsh6JVSqlmrQ1x87Nqk/Q3EjLuP1ZJJ:O1Cn99yRsMhcrSq9rc/MEc5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060688, "uuid": "42b09d11-e049-4088-83d3-1e72ab2a9242", "value": 489305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060688, "uuid": "b6cc186b-1a62-4545-856e-032ce3881d99", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060688, "uuid": "9c31b5d3-c0a5-41c8-9242-eca02a237de7", "value": "PL.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77189e8-7155-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698032426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032426, "uuid": "3e4228d7-ff6a-44f0-8d17-f62db4cfcbb5", "comment": "Malware payload (Formbook)", "value": "16eea85bf499503e012fa4c9268ef5e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032426, "uuid": "cea24a55-1750-4555-ad3b-8844ef9b389c", "comment": "Malware payload (Formbook)", "value": "9f0e9210228e043cf7560d1870045eedc3025aee61288e392b6169730950b3fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032426, "uuid": "ea4dfc11-2a8f-41a6-b23b-0b565b6887b9", "comment": "Malware payload (Formbook)", "value": "ed54c93b866c85735fa658933f0a932e5a622209", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032426, "uuid": "4ba61c37-75aa-49fa-b732-00ed5e7203b7", "comment": "Malware payload (Formbook)", "value": "53b273bee05d4f55bdda088a85e7d0c89f6112e5893165237969e22e28eb5c8e93895d74311f71be79cb159c31e993b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698032426, "uuid": "8c985f26-1174-4087-8dd6-44fd5170886c", "value": "T18C23F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698032426, "uuid": "a37ef3b7-61b2-42c6-946f-4a8d84803229", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698032426, "uuid": "2ecc14c9-369e-466f-b7e2-085803dfa696", "value": 46914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698032426, "uuid": "57ff3b58-bf71-44db-87b5-6473b444f01f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698032426, "uuid": "016f6d03-91cc-48e3-908f-d0587e0bd0ae", "value": "16eea85bf499503e012fa4c9268ef5e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01588176-714d-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698028604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698028604, "uuid": "79644374-4fce-4360-a3e6-927c1a2ffa95", "comment": "Malware payload (Amadey)", "value": "182ae83e050a98a664429af8062dfb9e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698028604, "uuid": "48c1df83-7166-4565-9432-9bbdbe098996", "comment": "Malware payload (Amadey)", "value": "9fc548cab2da8422df8e6a508dee71a6f3c3d212d760fea26719b693f24c34cc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698028604, "uuid": "68d068f3-cab4-4f95-b275-578aede2ec84", "comment": "Malware payload (Amadey)", "value": "33e2940f6a2a12e2a559028f6064929bf7fa2e32", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698028604, "uuid": "c86d3bdf-2355-4a93-ba48-5d12cd659d3f", "comment": "Malware payload (Amadey)", "value": "c1a2b8ad043b31f5b533faef792a45d54c6f37947118940cbccc11d40d3a5ccac4db4913daa4f0bc1a136efa272d1be9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698028604, "uuid": "1ef7189e-4ff0-4239-a521-dc76ce8ef150", "value": "T19A752393EBE5906BD8A463B055FA01C31A35FDA06C38C76A1746C8191DB35D8BC37B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698028604, "uuid": "6772232a-1c79-451b-81e9-ff9e7890d532", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698028604, "uuid": "ed019880-e70d-4295-a437-742bf78e38b0", "value": "24576:CyYhQkfDsgzokwi7hy37eoMEdVU5Earsvk3Em2Uu2mJwSS0BBDxdJyks:pru3z1wi+Dsx0m6rCuBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698028604, "uuid": "fdead94d-03d4-4e6f-a49a-5af08082f0e5", "value": 1590784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698028604, "uuid": "059fec73-eb1b-44a4-b8b1-644ab14d2dd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698028604, "uuid": "3559c1c4-185e-4bbc-95f8-e3a4611e848b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42fba10f-7181-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698051048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698051048, "uuid": "39a02f8c-c21f-4a56-917e-e1863924a63e", "comment": "Malware payload (AgentTesla)", "value": "dbb8ea5ec59876b4fc2f9076088e1852", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698051048, "uuid": "11aa8de7-6712-4f15-ba43-b6392eb08c17", "comment": "Malware payload (AgentTesla)", "value": "a0300d6fc527cbc778fc4f20023709418d47964a1c12df7cf66adc72de3909f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698051048, "uuid": "83099a26-6e81-4e1d-b69b-6d7a28461d82", "comment": "Malware payload (AgentTesla)", "value": "8cc2ab0925b181c8ae598308fd560956201d9af1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698051048, "uuid": "68ba8326-c960-4026-a036-47b6ec6f311c", "comment": "Malware payload (AgentTesla)", "value": "b191cd8df59398acbd6c358c8ad315d0ef91cce568ad9d01e2711688b633f74e175b9fc6f1219868ef87b0e4f85dd4b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698051048, "uuid": "db878bd1-8454-4f8b-85ea-dc8310d03133", "value": "T1D2252325CF906FA981EC6264393B4E070B667E919681E9EF10963F735C0BF839572D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698051048, "uuid": "ca475e12-bbb9-4fae-be94-89992ba632b8", "value": "12288:21MLn8qTIKlCoaIkB0ht7EIkw9/sLRby1PA7CFuvDJZhoEOp0XVB6W1Ucjy8geyi:p8OvaBMtgjRbyxA7Cyho1p0LV1Evs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698051048, "uuid": "fd664619-8736-4096-9372-85b6ddf8347b", "value": 1037973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698051048, "uuid": "7b5ba77a-11d2-4024-acee-b74703979b71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698051048, "uuid": "64171aeb-1200-41c9-bb79-9b1808b692a1", "value": "QUOTE STH0000514-3.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3784573-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042727, "uuid": "9036ab3f-6381-44eb-ba02-5df19a4f0843", "comment": "Malware payload", "value": "172b70844bfda1529597ec6008c32d44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042727, "uuid": "42df8c75-3d5b-4a44-9aa9-d44cd6274163", "comment": "Malware payload", "value": "a0ae8ddb0b2299ce0b66d315f0c2b785cd38226c614b89f34868d30a038e0b1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042727, "uuid": "7f1755f3-eace-4ea2-9a26-e7aaa7cb8047", "comment": "Malware payload", "value": "8387e777f83c83bafa2fab45bff57f93b465b495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042727, "uuid": "4ebb4b92-305e-4146-8a90-522fecc5dbb9", "comment": "Malware payload", "value": "c8fb7175557cfb8190b1a7c83b93233bf710e36f6c0d68f9e4529a80be993c3be7687dad0620aa935bbc8546d2ac180b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042727, "uuid": "47dc5c4e-1ae6-4542-8e56-d9261446e159", "value": "T13DB29463D52C7665F6824F724C3387BE0A17BC211A40DE1B39DA7F4C1D32AC26E9661E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042727, "uuid": "e21c01fb-d007-436b-9ca2-c5b9023d7f39", "value": "2b1320bebbb4e8135c765094266026fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042727, "uuid": "6e61d221-7f7a-4dbf-8c59-6103677d298a", "value": "192:UeDT/qYWYrUdiWc8BbujS2k3RL4JtQ6UD2xY5:UentEtcUbQSxGUD2+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042727, "uuid": "8bfb6c09-0f5d-4937-a020-2fe7f6420ae9", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042727, "uuid": "ace26b97-98ef-42bf-9b10-9164e0e563ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042727, "uuid": "3e6f21cd-d7fe-46d9-b590-0f4dd3bbb85f", "value": "SecuriteInfo.com.Trojan.TR.Dropper.Gen.7617.5958", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8110a2-71b5-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698073586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073586, "uuid": "3040b7b8-194e-4e94-b13f-6070d13f24e1", "comment": "Malware payload (AgentTesla)", "value": "50bb3edfe5e8da7da67b9a0ff6e991b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073586, "uuid": "82167826-e15f-42ac-9f23-8326d9f5cc85", "comment": "Malware payload (AgentTesla)", "value": "a0fb662473509e8c430d1dde009a85acc2c0d57ccaba3b290380d1f3d4ab9457", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073586, "uuid": "90005231-7836-4afa-9131-02372f3d7218", "comment": "Malware payload (AgentTesla)", "value": "038a2dcef9df250c3067440b8e75c3359efa9291", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073586, "uuid": "f2fb65e6-3de7-41dd-9d25-380431aca760", "comment": "Malware payload (AgentTesla)", "value": "aa3246864ec111cd63b4b9752301551a5be72900031ce6adf51ebad9eaf6501b8526b17cdd7a4093cffa525827c4f57e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073586, "uuid": "8a526e0b-4525-4762-beb5-a90538ea5454", "value": "T1A6F412203FB46BD2D63C23FAD8D681541BB69B3A6723E3586CD292C71961709CD60F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073586, "uuid": "c784259b-3cfe-4519-9e98-27498c5ac422", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073586, "uuid": "9fdb3738-beb7-4ad1-abbb-333cca353dee", "value": "12288:nM2MM/gR/mZRM+BUGOLPj1aktUNzFShakI0Hngv58ADR2TSQtwxe39aKkSqtp5V:ngkZR5OTLPYkt8zYhawHgr2RF3AKkT35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698073586, "uuid": "93a8fe72-4256-42aa-a5b6-cf84f7e1b086", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698073586, "uuid": "bcadb80b-6bbc-4d2e-8513-8832f143eeb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073586, "uuid": "eebd1930-7e28-4234-916d-51b072b13dfd", "value": "bank account pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bedf962-7196-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698060002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060002, "uuid": "f49f2b3f-e380-4310-9769-415f9f4d19ea", "comment": "Malware payload (AgentTesla)", "value": "8d965b31bba820bbdd511c2591e22a1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060002, "uuid": "b3a1eb67-1f0d-42e4-897b-eb36dcb2b318", "comment": "Malware payload (AgentTesla)", "value": "a1e7ec48d7c3132bf44925c62cb501b68404d386770e08ea971f22404b27d08b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060002, "uuid": "0d971e99-6d66-4755-a808-4b31843fb2f4", "comment": "Malware payload (AgentTesla)", "value": "0fc3f724decb761c24f99d66f46919c19aa27e21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060002, "uuid": "a92a8441-47d8-4ff8-8cc3-483432e3af04", "comment": "Malware payload (AgentTesla)", "value": "3594ce22d2048d7b5162fb7847ef30e54f27949520bc77327fa8cad2c397a3c9fc8f4326a0b27a324c2dba3740d8bc4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060002, "uuid": "9663d663-3a1c-48d0-a8e5-cb296bc24917", "value": "T1E2E433CBD6E86D1ADB3460340BBC25C6B18DD5A687C3A8ED46534E4B683130C872EB5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060002, "uuid": "49185a16-0217-482e-84bd-a35e4a6f0d34", "value": "12288:zCiswLbMJcjFj2vWxiz9NTcrNZqZ42/qjMRoYyxrO5F1af4eD+7KJ1Eo:zXYcZjK++Wi4uFRofkBaweDGS1Eo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060002, "uuid": "abd57917-69c7-4ede-8dce-ce3af24b77a8", "value": 674938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060002, "uuid": "a655afa8-046a-44a0-8d38-05ce625fcb89", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060002, "uuid": "95ac42eb-73f6-4b86-8d7e-479a04372a30", "value": "PURCHASE ORDER COPY.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162d7e11-71a4-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698066005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066005, "uuid": "a7572664-bd26-4eee-b66d-ddcb252702dd", "comment": "Malware payload (RedLineStealer)", "value": "c1c4e8274c13ea2bc0ae0941e080d9c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066005, "uuid": "20abe667-1cf5-4379-9c73-5d39f60bd7af", "comment": "Malware payload (RedLineStealer)", "value": "a34c93ea0b22c36b5f59a7971494af06187d95c9f9e5c80723f4de4d651d5345", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066005, "uuid": "f918e368-fb2e-4813-b2b9-856cec0dfcd6", "comment": "Malware payload (RedLineStealer)", "value": "814e7e495ef72a7b0cd8e066d2cc64f44e2e3f0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066005, "uuid": "61de1e10-2bad-4085-ad8d-6c36d59c2c83", "comment": "Malware payload (RedLineStealer)", "value": "f5a9ef222ba6729b22bb29de4ee6a03d9861fa0784d3f0b258726a6aba1a2a94a9e6a3a26ac6bebda312bd5d10ba1ba7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066005, "uuid": "524fee08-76df-4717-928b-935b3e54d821", "value": "T12385330BEAD81060E2B59FB015F433C34B3A7DB148B5939B2ED7F8991E6215050B67BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066005, "uuid": "3a271414-a908-487a-bbe0-766b31b8db44", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066005, "uuid": "3892dcf3-6b89-4fd4-82fb-3bf37d13e29a", "value": "49152:RzZdBEuGFwp4Eygmtj7luvF5ckje+9lG96:NZdBExFw+EyLsTcae+rZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698066005, "uuid": "59b7eb45-d699-43fb-a5e6-93608614a827", "value": 1760768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698066005, "uuid": "6b4c0a9a-dd55-4a84-aaba-8e32069a63e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066005, "uuid": "0375b480-e59b-4b92-bdfd-2a35343f3c42", "value": "c1c4e8274c13ea2bc0ae0941e080d9c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e945fd16-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042737, "uuid": "8ce7ad4a-2072-44a7-804d-5a3b365c19a9", "comment": "Malware payload", "value": "d938ebe2da3c304bf1c46a09c1941f46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042737, "uuid": "c90c92b7-2fa4-46ba-a9b3-08d4ee4d2f59", "comment": "Malware payload", "value": "a3dc4d5ff7a272d519a497b716b1204a13b9fc6d7061d24ad8cb0db33f8b6a23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042737, "uuid": "e2ed8a02-f5fc-497f-a8c3-0fa65a83850f", "comment": "Malware payload", "value": "3cfd89595143331e4aacd3363af82fb5a46d7922", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042737, "uuid": "a17d4b3b-9888-40bd-9fb8-c10a09a4e8d4", "comment": "Malware payload", "value": "d5cce49dbb08b87c5f27c9f5c4cf657c1d38c3c6db9d33ba0db78c99ff0b376e58f9ef08c84e67ecc5c484c5d3361419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042737, "uuid": "43790166-3af8-4f72-91f3-0084252fa207", "value": "T15CB5335A6AE0A537D62D433476F9EA17F2216F237F70EB51460BF2E743BB022009A715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042737, "uuid": "07fe9ae8-4075-4684-9b3b-462f16cbb805", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042737, "uuid": "4676b4f5-6bcf-4526-aa91-dc6f8bc85eb5", "value": "49152:mGk3oSo1sFwMnwnz+3RhTYnWiB67hl8CsZGOhtEuMwO7S:mx3oSoCWMwnzuhTYDUl8CyGOht3O+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042737, "uuid": "5ec3937b-a8bf-42c6-a399-464b5f54692e", "value": 2306048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042737, "uuid": "4ed16eef-706b-4476-be51-0f18005c6d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042737, "uuid": "66ea59db-7ab6-47a1-8893-d10fc22b5f95", "value": "SecuriteInfo.com.HEUR.Trojan.Win32.Generic.9162.24191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d89600-71fd-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698104210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698104210, "uuid": "f280986e-5e16-41a4-9503-3ebe6541735e", "comment": "Malware payload (RedLineStealer)", "value": "b56926dee317661eecefff1e8683584f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698104210, "uuid": "c9223824-940d-4e48-8f77-6d035af2fa70", "comment": "Malware payload (RedLineStealer)", "value": "a3e337e452eb2928cb9caa92c95074102edda3634702f82550a3b8fcd7edbd79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698104210, "uuid": "f9468c91-aed0-47af-832e-300fabc803cc", "comment": "Malware payload (RedLineStealer)", "value": "0acec169d35f9dba349c65aa88ea04428bf36047", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698104210, "uuid": "a475ba47-eec6-4920-a410-880c0e9b5a0c", "comment": "Malware payload (RedLineStealer)", "value": "2d1f43a9b2f46ba026e70ac93899404a19b3cdc061306c539e9269ba4f6a00e791d5423d98af8783d729c2ad96884a1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698104210, "uuid": "6e23465a-8882-4e2d-930a-ed988d1881a9", "value": "T115752343ABE6B513E0B117B104F543930B3ABE95287497966361A80F8CF278AB07577F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698104210, "uuid": "37c33548-8460-4ad7-aca0-11ec8c46aabe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698104210, "uuid": "e86e589e-4ffa-4f86-a20b-141874f52eb4", "value": "49152:1RjQL/vs2XQjn2ly7ybR9Ga0SREW37bWc:j8LHs2XQj2lYySM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698104210, "uuid": "fe955fd5-cd33-4ae8-a5c6-153c9fa89c5d", "value": 1585664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698104210, "uuid": "fdc5ab4a-2071-4fe2-82ba-790da94af909", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698104210, "uuid": "ed1c0910-d0a3-4057-aeb0-92683fef7250", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9cf767-7180-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698050876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050876, "uuid": "48bd2ea1-667e-4bd0-b4e7-2e4dfbe141d5", "comment": "Malware payload (Formbook)", "value": "a4de9d739162b9840c6cfd684ea8d791", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050876, "uuid": "27c7ff3e-0daa-48f6-8d10-eda2a95f50be", "comment": "Malware payload (Formbook)", "value": "a56f11445182406c82a5448a978ab72faf540591e94dbecbb13237413e687bd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050876, "uuid": "ede38c55-db28-417f-b380-6b368c2ece5c", "comment": "Malware payload (Formbook)", "value": "bb43ced4c734844119ebeffba5ff960692061e0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050876, "uuid": "37c97cc1-2543-45c3-a395-a8af2ee9f39e", "comment": "Malware payload (Formbook)", "value": "9e9a6d3be5172bea1fa05bd94ed7dc6cbd18569b5a0563d4ed4f47ac45f581f3c477eb52ed84c8f73c824ae7d8aab171", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050876, "uuid": "cc4cf67f-97a8-438d-b32e-78c92c3dfebb", "value": "T15272CFB937400610C05A83779BCB29D7B8297F6158E855A32207FE39ADB0F157F3116D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050876, "uuid": "688f1f11-d076-44b5-b6db-a67642ac928a", "value": "384:Q1w/KsOS8ceLSoIF85/r0OUIFCH8zFo5AAJj/:QO1eLSoY8t0jw1Jfk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698050876, "uuid": "cf30b51a-158c-4297-ada7-4b960b547631", "value": 17463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698050876, "uuid": "29be43e8-8be9-4bd4-9217-3aedc92ddc16", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050876, "uuid": "73a34d83-effe-4965-b9bf-8b9cdb063131", "value": "Po-37485.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbc1b02-7197-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698060753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060753, "uuid": "307a1562-a423-4441-9cb6-ac5b9d8baba8", "comment": "Malware payload", "value": "0747ed43db944904fff8cde96e36a01a", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060753, "uuid": "92ab6660-641a-4b1e-ae27-18bb0443a8dd", "comment": "Malware payload", "value": "a5bd05b020638c37b67aad3cdd2525af69a2a370040cd5fdc3d6b6c47e20afac", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060753, "uuid": "29a49bf9-19f7-45ea-8bc8-d7ae36d48238", "comment": "Malware payload", "value": "dfae22d576772500316c052ac92db5e571fa88c7", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060753, "uuid": "c3823925-6f5e-4e33-ab95-162fdbc94a9a", "comment": "Malware payload", "value": "9376ae984a40737ffc235dbfdbf36a8e9ebf7f871e9b7904741d4a262cae62c9bc1864d4d91dfccb2120cd467e64548a", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060753, "uuid": "cf0df9d3-b73e-44b5-9b1c-1867f76cd6b0", "value": "T127C423123AB7B0E3689431522CF1012D70C15A8C69F657312255DB0B9DCBC779BA6FEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060753, "uuid": "3716760f-817f-4e17-b79d-5d348226218b", "value": "12288:KRbwWc894LTgfxQRy6REK4FAUL0vVaRQ0WOMiAhJm7KL9H8JtwFy:KR8P89QTgfG12K4FAt9aRQ9WAhJm7KLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060753, "uuid": "5914b6e0-7508-41b4-95fd-a4c2a40519c4", "value": 552830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060753, "uuid": "46e90468-9cc6-40d2-ba6d-61244dc9f886", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060753, "uuid": "09b17193-5fee-4c34-bb99-91a490e8019b", "value": "e-dekont_html.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f376a4ae-71a8-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698068094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068094, "uuid": "6992c6c8-4adb-46df-a7ff-c266541e9aee", "comment": "Malware payload (SnakeKeylogger)", "value": "c67b7f7552e1b08f43856b96d23276cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068094, "uuid": "ada5a44d-892e-4d6c-ba98-752dc528ef29", "comment": "Malware payload (SnakeKeylogger)", "value": "a65172838dff0b366ecc526b58f59689d1d86110dc2b949443a63ac8cd8008c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068094, "uuid": "2054f398-9b16-4604-a673-1818a3efdf26", "comment": "Malware payload (SnakeKeylogger)", "value": "ebd5998132c184fc930c764d6fc4a0477a4587b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068094, "uuid": "16d518dc-e783-430c-9d93-10cb24b2e6bf", "comment": "Malware payload (SnakeKeylogger)", "value": "c27f0bff06e9cbee95493f63ddbfd536b1f360bc3e2fa69275f3af4e714fa7676c1997b7f3f6541f2931114301f88d51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068094, "uuid": "78e61b80-a505-40d8-a66b-3ec884b6a797", "value": "T11CC412DA35A4F3FAC836DAF92861394593FE92295F07D37C0E9120CB68067118E37657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068094, "uuid": "cdbc8ac5-5671-4b40-a22c-ad7da09ee898", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068094, "uuid": "84d8a2a4-a373-4f8a-a6fa-21ed79860c26", "value": "12288:JhNh6sxTA6qNhjA0FAqyWXF+Pj01Vx7aIVq+ixOtSfoVQ2u7:JDDxs6gtAuAek01VBVqLxOtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698068094, "uuid": "9db7ccc4-8ba7-4002-87af-1a42b77824d7", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698068094, "uuid": "a9f02697-855f-47cc-a0aa-d223933d6beb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068094, "uuid": "8174363f-9aa6-47d1-8dfb-4d10198af850", "value": "SecuriteInfo.com.Win32.PWSX-gen.22532.21562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d587d0-71bc-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1698076584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076584, "uuid": "b6f7236b-ec81-481f-9cb8-e8a28a451496", "comment": "Malware payload (Tofsee)", "value": "59b2ac43d9718f6ce6f9a69aa07b5360", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076584, "uuid": "03d47f35-7729-4c4c-9b5d-692ba3d2d695", "comment": "Malware payload (Tofsee)", "value": "a715441c5e52defffaf555818298443e2be7172a9a0c7bdf2fe717b997ffc291", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076584, "uuid": "813e7b6e-4452-4586-b476-4c777cf6ff7c", "comment": "Malware payload (Tofsee)", "value": "047f12473880cf3253ceef68e3a862bd8273f2fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698076584, "uuid": "08d77c20-18ac-4ed6-80b8-d16a6d8ae2fc", "comment": "Malware payload (Tofsee)", "value": "5fa2bff57b7dfb03d20f035818e232629a992c4c13f8c76111786a7c04e01a86c7ed8c35f2e3cbe904833c64e9834d58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076584, "uuid": "9f627f00-11ad-4712-aca5-15a7d4e8f622", "value": "T1E9449E03E592FCA0E95646318D2EF6E8366EF8708E19D757321C7F6F18B01A2D263395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076584, "uuid": "4394260c-d4c0-47d5-a281-172510d3fa2f", "value": "a31d28b14a82da6e3b2b7ebbc290018e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076584, "uuid": "5101e448-4b45-4f5b-8de1-5c463af0065c", "value": "6144:RIGaCLd8hdYEDNlHYmEgp5Uki7nGVdA9w2:RHVR8hd39YwpObnGT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698076584, "uuid": "45bd0770-e5fa-4474-92ca-911778b4e4f1", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698076584, "uuid": "3d33fd85-f484-41c2-95b7-4b0d28ebd2e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698076584, "uuid": "29484552-7c80-4c1c-a65b-3f04b8776c1c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ba816a-717d-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1698049313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698049313, "uuid": "fbe77105-8f1c-4d10-a135-155f0521c16f", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "4886beb249ac4dffd6a7cad8c3f2b38a", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698049313, "uuid": "76d037c3-0c6c-4670-93d5-19e43aa537f7", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "a739fdaf9432a46f74c6e215dcc2e2c6c3de0dea1e9aa5a0e76cd6b47aca7c31", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698049313, "uuid": "41d18407-9b33-4673-804a-a14c065c26c1", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "b791c9058c34145ca940630425e0ee097f542666", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698049313, "uuid": "1296524d-baa4-4fda-bac9-e9fe6a583297", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "b270c21487ff0663b96fa32885abb9b96b9fc5068c925a8d3bfb9860974260b705d8a454d3a858808fdf91961e53ff5d", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698049313, "uuid": "3ce785aa-05a7-4834-8aff-ecd957f3400f", "value": "T10B448E03A292EC60D91647718D2AF6E87A2EF8708E59D77733186F5F1870172D2633B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698049313, "uuid": "cdc30114-cd37-41bb-8b86-e942cb0536bf", "value": "3dc5fd248fcafa52ac5c2283ccf28cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698049313, "uuid": "5ba44991-8424-442c-a5fe-8360ab25dd0d", "value": "3072:owXrq+Jjm7LK7OYv3wOkpuiHUP3A9uGBAEMkR5emfJA5UMzUbfrp:FrrJjm7Lctvg9pDHXueA3mfJRSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698049313, "uuid": "eee84175-d1b8-4a7e-b54c-0db9c139021a", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698049313, "uuid": "caed5966-a358-4b87-bce0-f2754b6d5243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698049313, "uuid": "c2bfafba-f288-414c-aace-9c3bd9b6b4d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0fbba22-71a4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698066318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066318, "uuid": "5d083e83-685e-41e5-8f47-1d212fd065b6", "comment": "Malware payload (AgentTesla)", "value": "fac38120fdd7a0f28f3bda0a3bdbfc63", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066318, "uuid": "52fa2880-4376-446f-87aa-f85024692235", "comment": "Malware payload (AgentTesla)", "value": "a830eaba9888a6fa0a3cbf85da3636f1c41ae7a0372cbc5cfab0efd197894fc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066318, "uuid": "f7d802a8-e387-40cb-b969-903e6881ec74", "comment": "Malware payload (AgentTesla)", "value": "e35676639aba9364817bf6ac5183bd74673a1a4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066318, "uuid": "a41b671b-42d8-4d2d-8e4f-87487bfb695a", "comment": "Malware payload (AgentTesla)", "value": "a180cbfe63a4a168d8631785ef7b6d7df2c78b209410adb043a43302e59434e49cf6a196b53bd2405e5c9e0432230204", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066318, "uuid": "9147735f-6202-40b4-8588-a0df6d52d013", "value": "T1998539866A7ACD22C9900737C096F2B11F5CDD86A363F21726CD7EB33DB2B569D04246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066318, "uuid": "afc1996e-c051-465a-8b83-0d27100b3b1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066318, "uuid": "688722ae-67ed-419a-9735-82d856e0e69e", "value": "49152:3XHFtpAqXyB5V+jdfiwUyz3dEluQI+Ns44c:n5AqXuVwdfiwUyREljI+N94c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698066318, "uuid": "7ca03795-69ce-40d8-87ab-2688128ec74b", "value": 1846784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698066318, "uuid": "9b2bf29b-de95-4e0a-9c4f-8a87efac894b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066318, "uuid": "e154e133-b7ed-4343-b7b4-e41ceaeca581", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8536b7a0-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698057601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057601, "uuid": "33ee8e71-0b25-49f5-b93e-c2233065b936", "comment": "Malware payload (PureCrypter)", "value": "163c5014971669c1f95a0bf3af51eb9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057601, "uuid": "d2d2e8e2-b7ef-41d1-98b2-6a6a84c0eb82", "comment": "Malware payload (PureCrypter)", "value": "a91c3bba6d4b6d2c16cdcefb9cd57bf213898cf2dd0b66c215dc0ffa3d2ca927", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057601, "uuid": "bd4b6c29-a73d-4dde-9197-36453bb1d72c", "comment": "Malware payload (PureCrypter)", "value": "c5d5453240579f3ea5ffc7573558d1d4d8046d95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057601, "uuid": "f5f385e9-ddb4-42b3-821e-9e7db009343d", "comment": "Malware payload (PureCrypter)", "value": "98adcf47f7eeb2c5813d870d530ef95c0541af8b811464b31329de9143e6db9fef3630aaddc22f457968531eb0f8d05e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057601, "uuid": "8eafbc4a-ec7b-401e-87ea-f037b13ba5a2", "value": "T167B2940673884BB2D0AE0532D44AD774E712A61C8CAB4F7AC154AB87B0CA3535D6FEE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057601, "uuid": "562f1671-dc37-485d-b153-fba9460fd453", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057601, "uuid": "ee6cab38-ad0a-4fa5-8e81-85e9cc42bb37", "value": "384:+tnekGIJA9Sd2i22i22222A222sf122WO22u02u26x2u2B+222u2R222u2ek22u4:tSVWxSHoCKbEMfnTbxBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057601, "uuid": "ec9ee07b-5740-431f-a4ef-5fb1061e5c27", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057601, "uuid": "2bdc196a-06eb-44bf-a939-a80c6af2fe53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057601, "uuid": "9d94d044-fb93-4b9e-88b9-85029efeb398", "value": "163c5014971669c1f95a0bf3af51eb9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b1e3f5-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042706, "uuid": "132106fb-bc23-4976-922f-c488663f3ce8", "comment": "Malware payload", "value": "00bafd50d935dd8f6b8d9345cec62173", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042706, "uuid": "313ec434-f1b9-42f3-a931-bce1a536c05a", "comment": "Malware payload", "value": "a9306fddb2c91dcfd03b9c9678183246e14cd7cb1267b84b5ad987404bea6ae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042706, "uuid": "05e65da0-2dc7-4519-88c4-b8ee1f0c8948", "comment": "Malware payload", "value": "ec8d992ff7dcb4f88cdc2e16b9a26160fc837a4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042706, "uuid": "65952c93-312c-4b4e-96bc-57bd2304b4f4", "comment": "Malware payload", "value": "6ba821e4f49e8773f2042bf7a0d8bdde4a1606b9082cf5dcf03a359aac70514c8d4b13e95de893cf9fd84c1ff1d1bb97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042706, "uuid": "36c5729c-58bb-4ca1-9f6b-6152e8f42b01", "value": "T18D1511873E44E555D823583C490AF88C9961FD18DA57C64B3392FFAE3BB3F205A8584E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042706, "uuid": "14f88beb-908b-4678-b562-b638297a73ab", "value": "a6ebe3d474fc415d8303e83e56699376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042706, "uuid": "a6c6f962-e295-48bc-b40a-78320f1f26d2", "value": "12288:VlrGd6xSFG5Rol03KqdDGsMh5KlK1AN0j4tRKRs/ODERPsmclvfIi7ifk3EQK9c:LadY5RAqYsMl1AO4tRKRs/eCPoifn9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042706, "uuid": "519dd74f-ae22-4756-959e-356d319acd84", "value": 906840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042706, "uuid": "9efa228c-a39e-48d2-a6ee-f9cd67f35c8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042706, "uuid": "040a08d9-edf2-4af9-8b88-defda48cae86", "value": "SecuriteInfo.com.Trojan.NtRootKit.18405.3205.9028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6916fe-718e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698056729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056729, "uuid": "abede9c4-17df-4553-bf8b-d29d3f23e169", "comment": "Malware payload (Formbook)", "value": "b394ab992ac85ab0fefc4a7d3d181bbd", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056729, "uuid": "ea5aa6d6-7c27-4015-a23a-4c2457c22ea2", "comment": "Malware payload (Formbook)", "value": "aaebb0f42353e5c2a0273728f933a0fc9f6e5bb325cde360813240b4142ece77", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056729, "uuid": "4bdfa27e-72e3-47da-b663-9e78cfc02bc7", "comment": "Malware payload (Formbook)", "value": "a67c37f7da0666d582f8a1287c4346529d78d0a8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056729, "uuid": "8161a75d-ccda-41d0-bb04-19d1764c9037", "comment": "Malware payload (Formbook)", "value": "cbbe3017003ab52664c414cecaabe3e1d778a0fb3f5e568a39dff20d9689371fbc4c023d2de152b0ec026dea707c5cc1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056729, "uuid": "718e31e8-4b6a-4dc4-9c06-28be17dc6085", "value": "T1F7C3786CD34B02A9CF5653769B2B1E0542BCBA2EF34452B1306C437533EEC39A5252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056729, "uuid": "90863508-7bb2-4799-a2fa-6b681847b0fb", "value": "768:4wAbZSibMX9gRWjArvPU4qm14xwIed+y4tPzXwmhoQBqnUSDzrK/6Y:4wAlRVUO14VedX4tEmhoQkUWKCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698056729, "uuid": "b7e3f80d-9d89-4424-b3b2-5ca94ae2b446", "value": 127607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698056729, "uuid": "01720c93-8969-4ea7-9b33-fd6bb27359c3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056729, "uuid": "b452b807-827b-4756-b627-822bdf1cde0f", "value": "b394ab992ac85ab0fefc4a7d3d181bbd.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966814fa-71af-11ee-8907-42010a9c0042", "comment": "Malware payload (Gamaredon)", "timestamp": 1698070945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698070945, "uuid": "dfadeaa8-83be-462b-b57f-60fd4762fdf0", "comment": "Malware payload (Gamaredon)", "value": "12312c74772684e970998dbd2a6e1e93", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698070945, "uuid": "ad647726-9cdf-45ff-8058-a71418f8257a", "comment": "Malware payload (Gamaredon)", "value": "abed5ead9c0bf7b23cf41a3cac841658943dd4059af3287c87e577471ecefd43", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698070945, "uuid": "f870de76-2c25-4227-9705-a9df6082db25", "comment": "Malware payload (Gamaredon)", "value": "fa0d4e11666d4ef791e652a1f7c9449a778c27c3", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698070945, "uuid": "6356ba4f-7f00-4adb-a039-17463a0b2e2e", "comment": "Malware payload (Gamaredon)", "value": "a12c2c736c47f6edbe2728738622ed8c2411ab81e20bdf625fccda325e9dfd6c8edb0a551faf396466b3f638eaff92d3", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698070945, "uuid": "a51045e2-d40b-4498-b4c8-d1e7f61df779", "value": "T10AD3CF03F99ADA13E4298A341E97D9E837243C5E4E85D35F33003F5EBD786325E5660A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698070945, "uuid": "91cdcc85-761d-4e22-9491-63a05c366533", "value": "3072:8EVZtoSJi/A/1sX7E9rkYwIV89vdkwXmVR6:/uSI/A/GFr9vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698070945, "uuid": "942cd965-0977-44ac-9b5c-3db9e2aca126", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698070945, "uuid": "32bb4e8b-7911-4a80-8f97-0a155921be63", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698070945, "uuid": "1a577097-0929-4ac3-9c58-cc099b25c7fd", "value": "12312313.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3e5f13-713f-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698023017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698023017, "uuid": "80571d7f-2f2e-4084-8483-03935612bf12", "comment": "Malware payload (Amadey)", "value": "acd0fb471ed6426517acfb32544939f3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698023017, "uuid": "3a286c18-dd92-451b-bd79-2cc042066731", "comment": "Malware payload (Amadey)", "value": "adb2e5d1c3b37f18d152194a8016eb1ada8315b3492bc633a44fabd0c65450b0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698023017, "uuid": "7817e74c-6cf3-4dab-be2b-13d13b66e9e1", "comment": "Malware payload (Amadey)", "value": "003d42bd368614a0ab24d3f500bb32d6f3b3d736", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698023017, "uuid": "d0a4c0a0-0013-40df-9402-970b172de4fc", "comment": "Malware payload (Amadey)", "value": "0fa1531899f207d37ed6a3653873dfb459d12b9de6b51df53cea273c87d379e39ebe7457433c30a4a9441c21ff6bdb62", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698023017, "uuid": "0a5bdc68-7833-45a7-983a-0ffb372a2e23", "value": "T145051296B7DC4033D9512BB058FB0183063A7DA29D38476B27C9A98E4CF26C4E63576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698023017, "uuid": "93bb820b-473b-4bf6-bbc9-b3516f2463aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698023017, "uuid": "9c399281-747f-4f6b-a4ce-8aea87539b64", "value": "12288:oMrVy906cCgALDIWlQpQ8vGWYyexBPpOnF7kbnO75WAlTQu0J1Jf2uqLTyhx8SrC:tyDLxgO4Aye4nFmq5X0xf2uqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698023017, "uuid": "dff39fcb-1d49-4a40-8c1a-a25887c5b5a2", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698023017, "uuid": "f6986f6f-62cf-4827-b733-baad486cb7a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698023017, "uuid": "1e792556-dcb8-45ca-97d7-15d834589979", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d17d955-718d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698056299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056299, "uuid": "7c3e636f-6928-42d6-833d-a44b54e00d41", "comment": "Malware payload (AgentTesla)", "value": "597902cb29a67bd8b9e032c1a6d7af22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056299, "uuid": "d96db997-0367-43fd-a05c-0fb61ff30f08", "comment": "Malware payload (AgentTesla)", "value": "adc880d534c8e69ce583abbc2db97b38cc293cfad712d166235caad0da5ef915", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056299, "uuid": "d0c677e6-bd26-435b-8a4e-a7367a458856", "comment": "Malware payload (AgentTesla)", "value": "f63163a14b2e81a96f7c6292da5558a7cd384d4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056299, "uuid": "9eca646b-0e97-4818-a001-bf879f9939e7", "comment": "Malware payload (AgentTesla)", "value": "300eea332fbe0645df94cb0ffb7828524c7b1b4c0e2f6b73de201d0cdef90bd7b1c6631ebf295e6a235869489a075074", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056299, "uuid": "28decc72-9a03-4f63-b93d-a784a819a26d", "value": "T144F412103B786792C63963FA54CAC05C6BF24B3E5363CB652CC2A1D65273B29CA50F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056299, "uuid": "ad5ad4a0-5693-4b66-9691-c1699968639b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056299, "uuid": "4d2e32c6-067b-4300-bbf0-83da4899913a", "value": "12288:aMIqM/gR/mZRM+BwVlr440P2VwbPTNp/DoEhgt8BllZ7zS8x7iONTp9YZe:OgkZR5UlPuxp/5+ufT7z1xee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698056299, "uuid": "2fa6722e-e15d-49ec-9d7a-ecf4a540b130", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698056299, "uuid": "6eb554eb-e0d6-40cc-929c-65022bff6832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056299, "uuid": "21e2924d-6842-4b6d-8d44-232fdcc94444", "value": "HSBC Payment Advice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e128df47-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042723, "uuid": "4aa49db7-8690-4de3-9dd9-e29cd51e351c", "comment": "Malware payload", "value": "98d4160558464f337348d534a7079aa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042723, "uuid": "e7607aef-f73f-4322-b649-2784fe27999b", "comment": "Malware payload", "value": "ae0ff391a1b75bbecb9c232350c1f7cb2ef4c3b6ad6e1924a01fa58ac36d5360", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042723, "uuid": "9a836fdb-ea9c-458c-b96c-435241ad5777", "comment": "Malware payload", "value": "2545a2bd3c6e7e5c94d09635719ee36a8ffd22a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042723, "uuid": "078df6c8-d26b-4f0e-900f-e102bbc4784a", "comment": "Malware payload", "value": "9a0a69a3a653874f24f81c5499d2a4fa1d7c6481ba0fc77625d3b66040e42c341b9b87214c084cdd8d463024ceb9e4ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042723, "uuid": "f3e97c5f-905d-42f5-a603-5e9f355361d5", "value": "T13A450137F6D08437C273267C9C5B92A8AC35BE503E295C4B7AE81D8C4F387913A56297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042723, "uuid": "2aade1f4-3966-4cc2-bcb0-2207bdfc60b3", "value": "49c15fba8a43442995bce0db84c22ab5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042723, "uuid": "42cb0aa6-6069-4bb7-b3e2-4abf501064ba", "value": "24576:gkqtUjQ0OZSGGUPXW6cW6BI+vprFQAv+t47SQmHRCl7B0XjGF:gO4dcVI4p2AvI47SQmx27saF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042723, "uuid": "e95ac4ed-d997-4ef2-a0a2-21c40c9e289f", "value": 1189650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042723, "uuid": "1e0c0aa2-94bd-4db1-ad0b-f55ce78f0d83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042723, "uuid": "94a36837-f512-4bd5-a415-7a7ae477f9ac", "value": "SecuriteInfo.com.not-a-virus.WebToolbar.Win32.Perion.ujb.2371.8210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8eeeb1-71a6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698067006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067006, "uuid": "5cb84588-2c6e-42d8-8c53-4c546b9a6105", "comment": "Malware payload (AgentTesla)", "value": "fd56eba296bcac1351c1752f412c971d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067006, "uuid": "9a93795e-73e3-402d-9b65-66a33552babf", "comment": "Malware payload (AgentTesla)", "value": "ae4237ed1856e85fbb153facdf9aec4bbec7e4d32bd3f22628129b886fb44acb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067006, "uuid": "c26bab58-5685-4592-873f-e5a92966f16c", "comment": "Malware payload (AgentTesla)", "value": "578dec0533b5c2f7450619b9372e0cb6702d238a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067006, "uuid": "d6eadc29-9b8f-4e55-bc82-8a7856b0a935", "comment": "Malware payload (AgentTesla)", "value": "15ec92ffabc96feb98f3466880c5a2ae0d4204144a571d0b1e619d8147efc5b8cc81c113aa36dce5855da7f416b83f49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067006, "uuid": "ff8f865f-8e6f-4aba-99b0-dcd542a2e017", "value": "T1DAE423A74831BCC26D952571BD7482CFC79CE1EA7FF29EC295EAF40B582990C9DE0850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067006, "uuid": "538f028f-3132-4107-a19b-ac08dc60f4ad", "value": "12288:AMURXc5wGk0RiycbyCtjuqsdCF4Qg3QI3gBrqSCPwQDAhqY45qqtI1wThMq3wXy+:AMUtciGzcbbtjuzIF4QgQjZqdPwQDAw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698067006, "uuid": "8b9113a7-0973-471b-9a44-b441ce277d34", "value": 680336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698067006, "uuid": "db3b2b04-8413-4d3d-b6d7-07b3ee25a36b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067006, "uuid": "4cacd4c1-d024-4398-9eb8-8bfca9fae9ae", "value": "Invoice #765400.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96274f3b-71e1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698092419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698092419, "uuid": "952e7f7d-f421-4737-a1d8-f102b0f418f1", "comment": "Malware payload", "value": "394866cc32043d6ab89773834311850e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698092419, "uuid": "35db3c40-dd4a-4dde-b8c8-be011cd7df79", "comment": "Malware payload", "value": "ae51d9016225360b75b591cef64f435cff380c0217fe50b0f06113b891c69e18", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698092419, "uuid": "42513c0e-3cff-4a04-a206-32959927f9cc", "comment": "Malware payload", "value": "200a8cff2381707b74ee092d2785ac0d9eb1180c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698092419, "uuid": "eef4d72d-207f-485d-a165-dd11e8db3e9f", "comment": "Malware payload", "value": "41b0a0e337161c5a88d1720f850a219da2832cc3a39701f7a375bfe7ba0ec9fab332a704df7ec5ff1cef8949e2556fa7", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698092419, "uuid": "ec205a7c-3274-4fbd-a9a9-8cfbc2934963", "value": "T1B874D0040BD54B31E3B7873A58B6AF1386B1BC42DD7A8F5E06C502990816101F9A5F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698092419, "uuid": "abb0caf2-9455-45dd-b334-d0c18c32486c", "value": "24:8n1uYqnlw6cQt0cXXks+/4d5ws40maSnW2W4/FYXm:81UnlfX8L0mLnBxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698092419, "uuid": "df400e47-76bb-429b-9645-debd361df4a0", "value": 355148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698092419, "uuid": "16880d26-e0e1-4395-b861-4358ce83f818", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698092419, "uuid": "bb69e146-aff6-45bc-988a-e67ad33a7e52", "value": "1bc6a8ea97fa19773248a797c331e290ad07b0b09d3c37ecd7a1d8e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166a922a-719b-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698062140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062140, "uuid": "04cfbe09-d852-48ca-be6f-3c4ac8de8e3c", "comment": "Malware payload (Amadey)", "value": "8b902f7094766ae9c84ccb3f09e2cf33", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062140, "uuid": "01593a6f-e354-4fe0-a098-7c499358be87", "comment": "Malware payload (Amadey)", "value": "af57e0f87312aedf0fe588dc08e4f5453b5ce31bbaa64b9f7b4033261e279a9e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062140, "uuid": "4879359d-cf84-490a-9a0b-76f997341c1c", "comment": "Malware payload (Amadey)", "value": "41585744f2ca4361b7b8afcf0f838a3623afe1b1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062140, "uuid": "289e022a-96f4-4a5d-91fb-56f89b006c39", "comment": "Malware payload (Amadey)", "value": "c01ba0871cbbc85e4ce531aeaf51198285588101dda999d511a19a1d059afb4593e71a22fdbbbe4399e895d8e57b3f7a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062140, "uuid": "e505702e-9470-42cd-9f0d-6ad376542add", "value": "T14C953323B9E40172ECA517F009FB56471E323CB54EA6831B6796E40B4DA3FD58831F6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062140, "uuid": "37935fcd-bd1a-405d-b864-f5d8c01abaf0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062140, "uuid": "4c5f2991-52cf-45fa-a098-44a1733a0b95", "value": "49152:Pk/Q6lu0Wsd7OBor82Bq0PYsRW8uUwlUD9U183Hr:8o6s0ddSor87BYCmDWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698062140, "uuid": "48404498-321a-426d-992b-8aeb9274b75e", "value": 1946624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698062140, "uuid": "430886b4-5b06-4eeb-80f1-b8802ba2e9b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062140, "uuid": "dae08453-a2de-461b-94be-32ee054839dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fd3c6c-71b7-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698074351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074351, "uuid": "0ca27bdb-82f7-48df-b238-47b5ff6c2bab", "comment": "Malware payload (Formbook)", "value": "b3a6049df6caece43dfe7484f80519c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074351, "uuid": "ee8b78fd-5360-49a3-ac32-4a733729b5c2", "comment": "Malware payload (Formbook)", "value": "afbcc4589635ef9e83579c9865d99e7b454f827e5ae02b8248db0fc73d9553c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074351, "uuid": "374270e3-40ea-4a43-aae2-c9210dd40aab", "comment": "Malware payload (Formbook)", "value": "a491ba22cc0b212d40596b0e55c94cd91b21c1f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074351, "uuid": "c477c5fb-d2d1-4b6a-9eba-a2d804b7c0a0", "comment": "Malware payload (Formbook)", "value": "dcbeecafd84b5779b55ddf05757093c27c128f453223866dd8bf73910aed88bb63a5aa5428296354e3e055ec95cb4ac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074351, "uuid": "fd835cbe-2da5-46f9-8351-62faf681541b", "value": "T1A4D4125823A9D72ED4792FF68461E7A0CBF9F806A922D60A1CC510DD4B37FA45460FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074351, "uuid": "c6197fec-5549-4688-b915-46a59ec1684a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074351, "uuid": "4aeebc6f-6d28-445d-85c8-6661f1afcbd0", "value": "12288:ozfqBAfWF5ImLXVo3BHl2hHmR/nt/UjxnOCNW8VIHxCkD:oT6GWFOmLFoRF2hHmBnVUNOf8VIHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698074351, "uuid": "d76bf20a-b523-4801-848a-c741c9fc6b4e", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698074351, "uuid": "fa7f7f2f-e464-4501-b1cf-7313ad533bee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074351, "uuid": "fa030b10-329d-4a63-aea0-66835bdb626b", "value": "FINAL SELECTION SAMPLE QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbd47c8-7175-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698046076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046076, "uuid": "cdf44686-c3dd-42a6-8afe-1ea236600304", "comment": "Malware payload (AgentTesla)", "value": "a9a5b873924e4dafbf75aba10576db82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046076, "uuid": "75b0f8e1-2bd5-41c2-9ca6-a5f1fb8ff759", "comment": "Malware payload (AgentTesla)", "value": "b0263b853a41b44ff76512bf8aca16905b8fab1940b77dfb0b38401c9d6221c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046076, "uuid": "9d5451d8-d9d9-475c-9641-aba617f8884a", "comment": "Malware payload (AgentTesla)", "value": "c9fcf03a028f4f2bd89552291e66fdddfe38ee13", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046076, "uuid": "eb103597-a046-46ee-80e4-efb43a88b163", "comment": "Malware payload (AgentTesla)", "value": "527f96710dafb303bb7615cd0003b7ce10bb7615352545749ec44e9c24bd7947120ae06968ffbc04db538bde3ad3ba77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046076, "uuid": "93d6be2d-3892-4fec-b7d3-8bc77f636ea5", "value": "T13C2523749BA62DBC9E28C0B0656F2F0D3A634DEDC02BC7D5425024D31A5E5588BB7BCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046076, "uuid": "4b0694be-0890-4400-9459-680353c904fb", "value": "24576:LctqulaF9HlgtI7movnLwNqYW8L//T3ET8JnFL:Lumb6Qz8LnGwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698046076, "uuid": "f2f396aa-6530-46c6-9d07-afd11877dc47", "value": 1037360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698046076, "uuid": "f352955a-0b4f-43ce-b314-1cd140fec504", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046076, "uuid": "6366112e-1ffa-4e51-9b55-1449e6a5de89", "value": "Quotation 22001625_REV00193066.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf37f82-717f-11ee-8907-42010a9c0042", "comment": "Malware payload (VenomRat)", "timestamp": 1698050395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050395, "uuid": "85573032-4b90-4626-a945-eefcfcc65473", "comment": "Malware payload (VenomRat)", "value": "d88a06a393582a79ab6da48982ec87ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050395, "uuid": "883bc67d-5c15-4648-b1eb-52b05d1696e8", "comment": "Malware payload (VenomRat)", "value": "b037843ef212f9907c4c2f22167379db44aa02d7c647c53278b4d8d784343537", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050395, "uuid": "d23499eb-d1cb-465f-9e41-1690a15d0f49", "comment": "Malware payload (VenomRat)", "value": "e5cc4271431fa138f4594847c20a5be3f6c919e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050395, "uuid": "a0db5597-06b8-4c2d-8f53-af961e8f5456", "comment": "Malware payload (VenomRat)", "value": "d1738f64e6c6d08da57083abb0c6adba3590388a9af0e3982e757fae924721708e090efd74685a01bff090880b660e76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050395, "uuid": "28a83dbe-ef05-4bee-a33c-728b7648859e", "value": "T1FD348D113A00C036F8A7187988EE9FB9B6ADB861037565C37BE80A7DDF117E36675206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050395, "uuid": "7f819f69-cea8-4992-8a24-1910999f2b23", "value": "46e4333691e6901e3051f6d7de5959d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050395, "uuid": "6bece0d5-fe10-414a-b924-42906ec0557b", "value": "3072:KHkVhd52JYWsfVrhbjAY1GSEuywqamd/4bWSHqYubGtHshmRgSPG9oMNLxb:KHkVhd52JdYhbt1GCE2bUwZe+PElNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698050395, "uuid": "fc9ff254-d41a-4abc-af20-09f2f069ab37", "value": 249416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698050395, "uuid": "60646fe5-d406-45b8-8f91-03883a56565b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050395, "uuid": "c9c412da-21a8-4003-a3da-2b97f55debc2", "value": "d88a06a393582a79ab6da48982ec87ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8921a4-7190-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698057771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057771, "uuid": "1bb8d45c-3d16-4c9c-b3ed-e58725d9b40f", "comment": "Malware payload", "value": "32071d1ebdd06da71897974bf4e20b0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057771, "uuid": "503e4bbb-c6de-4c18-88b2-6700a078fbad", "comment": "Malware payload", "value": "b12d110773746a514cab208fffe8d07d789879702546b688dafad122c4c06a4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057771, "uuid": "0b54ca6a-8e00-480c-9575-c4ed160ebd9b", "comment": "Malware payload", "value": "09928ea3f1856d7ebd7765f668fe19f453116315", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057771, "uuid": "c88b7e08-8829-44ff-aa78-44bdeb5b68a9", "comment": "Malware payload", "value": "e7ef335d17ae25fab0346479bda554899983a2a789dfecb16c10783a73b3cc99e8dfdbb1061672980af3735cf6d03102", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057771, "uuid": "6262482b-35e3-49af-8777-e5bd7aa91691", "value": "T11E248346F68492A9CC18A3B07932DA7007167EABED74645E5ADD3E273FB74F30066843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057771, "uuid": "b32e6c0a-732f-4f3d-9ccb-ef22662a450d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057771, "uuid": "cba54ed3-d8df-4510-9657-97bbbf065276", "value": "3072:UFt8fPl67SQzNMbu3zbxSY7KZnS/KzJBLY:UFOl67SQzNMbu3zbL7qS/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057771, "uuid": "03559b65-7a5c-4348-a1a1-219b283c8b71", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057771, "uuid": "ec0041a8-10d9-4868-bb9b-865d1e96fda3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057771, "uuid": "e72c67ab-232b-46b5-94f5-c61784f917b5", "value": "SHKX2023082813.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d8e867-7190-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698057759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057759, "uuid": "8b8fbda7-bd36-4d8d-a24a-2ad6ece7d7c6", "comment": "Malware payload", "value": "1cff43b0c5a22e40ae85fa881ca7fc8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057759, "uuid": "ce4747f8-b115-403d-8cfe-ef5291503ff7", "comment": "Malware payload", "value": "b151e278a9a7831cae3b778f064a6e9e7afcb5dd4a91d01efa70ba8132570f96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057759, "uuid": "5167c30c-363f-434d-b0d1-2e00c2cc4933", "comment": "Malware payload", "value": "6c271809d815359fcd8ba01923bbb968d88abed0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057759, "uuid": "e4a00c22-a473-4fe5-aead-df0c88911d43", "comment": "Malware payload", "value": "a9a8ef64e9a12c093a38cd927e6ce03e3241c0c446e25e318f939022abb4b52b9d315c2af2c86bc0eb9b9d656af90e3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057759, "uuid": "d280c168-d079-4693-83a9-06106caba8ff", "value": "T13A347346F68452A9CC18A3B07932CE7007167EABED74645E5ADD3E273FB78F20066843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057759, "uuid": "ccbc9030-fb18-4228-800d-704432e121f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057759, "uuid": "6905e76a-4b7b-44df-a6b2-badd98d27ccc", "value": "3072:lxt8fPl67SQzNMbu3zbxSY7KZnS/KzJBLu:lxOl67SQzNMbu3zbL7qS/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057759, "uuid": "6aeb967a-1105-4cc5-9f65-667fcc2392fb", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057759, "uuid": "403abb36-12b8-4b37-a225-dcb6638eb6fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057759, "uuid": "a766ec0d-b6c5-40b6-a351-191b4c79baae", "value": "FNSS KAPLAN PARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bc4b03-7197-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698060708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060708, "uuid": "adaac817-2447-418c-8b0c-804085987181", "comment": "Malware payload (AgentTesla)", "value": "3f7eb2440f6c27a171e9d5fd850dc7b8", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060708, "uuid": "42c2149b-ca51-4dc5-a208-1c09388abb95", "comment": "Malware payload (AgentTesla)", "value": "b1d08bbbd6ff671fb7e1de15c13d35429e99c66cd5ecd0dca910edff33f765ae", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060708, "uuid": "b0e331d1-918d-471f-832b-8274014431af", "comment": "Malware payload (AgentTesla)", "value": "8d7c5cb64975470a3cbb039a4db39384a6043eef", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060708, "uuid": "7fcf3ae4-0499-43e1-ac85-072f5b796606", "comment": "Malware payload (AgentTesla)", "value": "4679560f4f198b49d47bbce74d9b5bfd0d2c8fbde5b66c948e2eb2ea0d4688cb36aa71b4491f87a25908df193db965e0", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060708, "uuid": "aae7cd68-9c59-431f-8fd1-8041faee7385", "value": "T117A423E73CE1D41D22CBDE2816B2D5618A7DB49D2C6FFC311742C41A8AAF9AC1BD2D05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060708, "uuid": "c32241d1-7100-4abc-be61-48edf3925330", "value": "12288:bdak4bno6yTY9yRsMCsh6JVSqlmrQ1x87Nqk/Q3EjLuP1ZJl:R1Cn99yRsMhcrSq9rc/MEc5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060708, "uuid": "c0fca5d5-c524-405f-ad8a-de977f549865", "value": 489305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060708, "uuid": "ce6b9230-aed5-4a78-9785-075e59025486", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060708, "uuid": "1448ad9a-cf07-48d2-ada4-fecb8b9d5395", "value": "SC.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbb78e3-71a4-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1698065994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065994, "uuid": "e4ffb182-a7a9-48c4-8d94-d3f5bdd3315b", "comment": "Malware payload (MysticStealer)", "value": "0e5e7da39bcd6310211bd83eca5cbfd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065994, "uuid": "415dfcbd-cfad-4d26-919c-2c3ddaf6779b", "comment": "Malware payload (MysticStealer)", "value": "b224a6c44c1ba5e49b40fc9f5176d6ad1719031f0312d85650174dc29c88276e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065994, "uuid": "302fda7e-4754-48d9-a2bc-cd2ff3d4a2c7", "comment": "Malware payload (MysticStealer)", "value": "49de8afad3ea0ff58ef987d4866fc36781092808", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698065994, "uuid": "a7d34bbc-1346-41a1-b587-9a0f80677f48", "comment": "Malware payload (MysticStealer)", "value": "52e7c8a257f924a88ab22c014000a3be6aad4159d1a354e99564f9ed60c1505b01cce5fdb08c44ffaf50b272fccdd9aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065994, "uuid": "8c79a495-787c-477e-92f4-ec26ead4769a", "value": "T18A952C1176F94B59FAF30FB85ABA6612087AFC698F11CADF1251508E0D31AD09970F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065994, "uuid": "dc3bd24f-c673-415c-ba76-211c8213e476", "value": "037522269f8348aa17add864631a3f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065994, "uuid": "2bda6826-7cd1-43c2-bdc7-7bba82a237af", "value": "24576:jrAAfSYqe7E9k7d+WNO6a9DhvhDyg3fI:jRqe7E9rW06a3v8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698065994, "uuid": "09effd06-5ba3-4200-bc82-16d7a34bbb77", "value": 1909248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698065994, "uuid": "384a8849-e52c-4514-94a0-11833bd975c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698065994, "uuid": "e3b57efe-e9a0-48f5-b0c0-075e0222f36d", "value": "0e5e7da39bcd6310211bd83eca5cbfd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4cd402-7193-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698059038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059038, "uuid": "c9694cce-04b3-4e9b-911c-7d5cfb6568ce", "comment": "Malware payload (AgentTesla)", "value": "c4203585abc41a4512c542b5361b973f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059038, "uuid": "93549493-20f5-4023-b1a9-6216f6842efa", "comment": "Malware payload (AgentTesla)", "value": "b27bf88f70f1113d1a13e2e004f976b0884c6915cee41bc751d6064cf8350098", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059038, "uuid": "b273745d-e55c-4cb3-a1c9-368fbbdf9b94", "comment": "Malware payload (AgentTesla)", "value": "cf069564bb8b3c8f68958aa180cecdf17b78ae69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059038, "uuid": "4a60f5cf-76fc-486b-a820-71beb471738a", "comment": "Malware payload (AgentTesla)", "value": "3e11c61ccdd41cb0978ba4dd7de7ee11f551ceaa3328140be0e20ccde53990509b0da4a95b3002e54f04566c79e09e44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059038, "uuid": "4f33d135-5730-436e-8613-6e4206d244d6", "value": "T195D42253B244815BC5DFC3FB5CA219772EB456821624D6CD9CFE34DAE8A6F6008E2933", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059038, "uuid": "ab512613-60d7-44cd-a34b-068f571e671e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059038, "uuid": "23ceae64-64a2-458a-8db1-71cb8a39b125", "value": "12288:MOCvomAsXi4pn5GBzsvZigvxZi9Dc70tkbm1p04Hn6MrDFvomyfW4lEY+:MOCvomxyqe+IgTCDcPbm1pzn5rDF9ylO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698059038, "uuid": "d8993a6e-6a97-4ad4-ae54-d5b25c72a7e0", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698059038, "uuid": "db082d11-a5f0-465f-b97e-f5428e5db04c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059038, "uuid": "89ee2a85-25f5-400b-a7a9-e5f1a8f1f890", "value": "PO_21099.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6e170a-71a8-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698068114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068114, "uuid": "46e9b105-0426-427f-8728-9ab6bfbde601", "comment": "Malware payload (Formbook)", "value": "a5bd6cf1b7bcd6874a0b76b394f883ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068114, "uuid": "4e3715d2-7045-47f7-89d4-be5dec6d4c4f", "comment": "Malware payload (Formbook)", "value": "b2fb84296e18a15142d74712866c5f253513ac062242b2613d7c2ce8bc48d618", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068114, "uuid": "050c3c45-d72c-434a-ba12-fccd4839204a", "comment": "Malware payload (Formbook)", "value": "b94129bcdf30745ac2706a54b4339b6331c17ce5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068114, "uuid": "fb3144b0-986a-4b05-818e-42480b4dccbe", "comment": "Malware payload (Formbook)", "value": "a7cf5a495d24c573f7b4cb0fd29207e651eaf14f1ab3851c6e00d6e7e31e5bd1008a6500508e3afa87f641d4ad4b38ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068114, "uuid": "3ab2cd60-63c9-4d8e-86da-d6c096f11f01", "value": "T189F42212E7E95576EAB533B018F606C31A3DBCE51CB483672B015C8E0CB37996A32767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068114, "uuid": "6eef79a7-37a1-4b61-b9fc-1c5dc445c133", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068114, "uuid": "a62c59f2-9373-4781-97cf-c3c32f71987f", "value": "12288:tMrjy90b1ia8ha389z2lXtR9TyafmV+9W++6H5EPMtcTrOn634h45WsEhf:KyiMa6Kw0safFvB57cTrO634PsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698068114, "uuid": "b3de9930-21ee-48a4-b6d4-0ed87d3d0d70", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698068114, "uuid": "99312dee-4909-4362-9f31-18e4b02a08be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068114, "uuid": "d8bd3553-8383-4c4b-b4e3-9aa07eb04385", "value": "a5bd6cf1b7bcd6874a0b76b394f883ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc89be99-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042716, "uuid": "6ec263c4-6e93-4f89-95ed-908e330bc396", "comment": "Malware payload", "value": "9d9d376ea78a25e6e67f2fea0275f271", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042716, "uuid": "fa6d082e-95da-46b0-883b-d98b50ad3b59", "comment": "Malware payload", "value": "b2ff7ceeb95855266f83e24c4f733d4c01f8ed9a83448d9aa7a5b0bed1ceabbe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042716, "uuid": "ab01128f-0bf0-40da-b461-65c1f80efc21", "comment": "Malware payload", "value": "96571dcd80bd3786e0faf72590e82eb4cf3a2a6c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042716, "uuid": "602136fa-9a60-491a-9b08-3d39a6590112", "comment": "Malware payload", "value": "8d80ccb49f8e7c96c116d3061d827409137734d07a8934e5415d18955d72c02705968718218cb44671f44e369348711f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042716, "uuid": "cbcc5976-a8d9-4fa9-a104-1a5b136f0260", "value": "T1F8657CCA37D8C951D2F82B304E099DD29E2E4C61BD8A4122BE6C765F5F379E09732D60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042716, "uuid": "f2caee42-498c-4110-ae46-3764eff5205f", "value": "c98b300117c3dc40526363b5a46a524d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042716, "uuid": "caa455b5-4f3a-4958-a477-c22b09c4ee28", "value": "24576:yWHEdVpbdGgFcrb8+E4yLuSs9+3GX6Uv:zkdXdnas1yPsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042716, "uuid": "05515965-360e-474b-84e5-93388545f8cb", "value": 1519451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042716, "uuid": "37ec7f97-bcd1-4a35-a1e0-9cb2f184b864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042716, "uuid": "1b29cb32-b7fb-4d65-b294-a3df5998ac7e", "value": "SecuriteInfo.com.Trojan.TR.Black.Gen2.2258.28712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c032bb3e-71fa-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698103227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103227, "uuid": "b81a0a1b-893e-44f7-803f-d43862acb5e9", "comment": "Malware payload (Amadey)", "value": "07a33fe13e68334d7f4559b9212e2c6a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103227, "uuid": "0dcfbd2c-05fe-45c1-ac4d-dd64071b24c4", "comment": "Malware payload (Amadey)", "value": "b34a85e9379d7b57570c0ffc353d754c51879da12c5acb3d8771450d5e37839b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103227, "uuid": "bceff35f-cb0f-4670-8e85-b0948dca99e6", "comment": "Malware payload (Amadey)", "value": "348a92b9852c04417f5485cd3731ec8dcb3a646c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103227, "uuid": "b1663c73-d1f9-4512-98a5-9088e9407500", "comment": "Malware payload (Amadey)", "value": "b69819aa13ee44adb320d2ee8f8ab0652eb2ec065078283f1c683bb618b48f759e6fff197b8bf7438a6c67e6cd75ddc5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103227, "uuid": "975af5b7-1af0-408e-9d8d-d2cef3610d45", "value": "T18585338367D8C536CAA22FF0AAFF139708323D554E29825D334696790E72784ED21F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103227, "uuid": "db12dae7-187c-463b-a153-3d3d4828952a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103227, "uuid": "f9415489-a119-44c8-a65e-79a1b7542e2d", "value": "24576:cyxRBodF+/a1+JwTmN+SGlmUL1qduEcsy4Qy1qqq9EWl0Zl+urRPXidf67rNrD2L:LOCbJfgb0uzdj2qLWWyZz5GWmME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698103227, "uuid": "455fe301-73c7-4510-a4d4-25601a8ed405", "value": 1761792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698103227, "uuid": "85a58197-4743-4348-99aa-b10370bb7b9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103227, "uuid": "c99209b0-588b-45bb-8065-f7df6cef38ef", "value": "07a33fe13e68334d7f4559b9212e2c6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d350a1e-7180-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698050662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050662, "uuid": "559b11b5-d71c-4fc4-91ec-ea7d347c6e4b", "comment": "Malware payload", "value": "63040b0834c2ea15ab5f44cb9a3766c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050662, "uuid": "73102919-fabf-4019-bda9-7ae33b697ded", "comment": "Malware payload", "value": "b360ae5494c828e3be4033e3cb57f5a1f2ccb52229f928896ad8c917561b8ed7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050662, "uuid": "d714e9c7-ead4-4f52-b45e-6355779e76a2", "comment": "Malware payload", "value": "8fb82571c2c990694fa9cdaee9b7faef325670e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050662, "uuid": "0bfe1601-4ec6-4ff9-bed1-7856915d279b", "comment": "Malware payload", "value": "570c89486d470399b538ee73bb4dd74a301c3892d3cd62e236934a652e0c62dab24cc6dd06ce9156c96b7a72b1310646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050662, "uuid": "b11409f0-4f21-4dc6-9265-a0f10a59dcb8", "value": "T12AC1A41693A89736DB3247B9ACB353011370F3568D97DB5F38C8160F6D163A44962FB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050662, "uuid": "f157fbdc-bd4d-49b5-a546-6cd74e201146", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050662, "uuid": "8b61d283-6c1c-4534-907b-6d1a49cd8e84", "value": "48:6hMHXwbWCT0lUfrvxIo3+UWfzwh6euBesFTR5o9DNszIC1lAOatlitiOlfeqF4vY:mWCT++eo3Bb34tq9DN/CvAnUt6BzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698050662, "uuid": "2eca1059-54f5-4191-992e-3987da092fb9", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698050662, "uuid": "2c9f23ec-51bf-4d89-82a2-f70559707a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050662, "uuid": "4c3b0fd1-739a-4837-99cd-d099763aa7ef", "value": "Jqdai.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8de4704-7197-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698060748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060748, "uuid": "2cc53e17-9239-49de-8655-d2180178db4c", "comment": "Malware payload (Formbook)", "value": "736944b735f67fcd564149bf82ff4127", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060748, "uuid": "f2675e8a-6818-4d5b-a177-5021f8dc6ede", "comment": "Malware payload (Formbook)", "value": "b3b9ce5bdb8e99a149c06df8f09c2809a42b6ad7b251356fd6f4c42cf8214c7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060748, "uuid": "3385201e-4b08-457f-9f44-5aabcdcbdad6", "comment": "Malware payload (Formbook)", "value": "01a9b6c49789cb7f862d6b1b8b1fd41757ba1314", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060748, "uuid": "f3a68b75-7884-443b-b521-3d6d93d706c6", "comment": "Malware payload (Formbook)", "value": "dac50ba4c2f505df165760b2003a0c427af50b4c16e763b23cf9aff9c6245a80b60ccb9ddd6d99ad776409fbfba55089", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060748, "uuid": "f3051fb1-4012-4b29-853b-eda822a0176a", "value": "T17AB42262F7A0C9A6C0A2BEF21E391D632AE15D545E48A65217407FAE31F21C3583ED4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060748, "uuid": "75a0bc70-1a60-4c93-9399-eeca8f6468ce", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060748, "uuid": "dcbc9e33-a23e-4d69-ae73-88dcfc7eb677", "value": "12288:zfLCv9EZ2isRiYGcW4AQYnpnn72PjRqxZ9BKCZm+IJm2+ZZO:zfLCeZ2is/kPVpnn7eiXZmwZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060748, "uuid": "cafe9862-fc9f-41a1-8d05-78d29b8b9fd7", "value": 500318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060748, "uuid": "475bd4bd-c15f-4134-9b36-38c6a8f437cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060748, "uuid": "1bf3b604-0cde-455d-ab9f-f084ce5c1768", "value": "Balance Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894e36b3-7177-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698046871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046871, "uuid": "33852dce-4f8e-4e54-835f-d9d28b081c2b", "comment": "Malware payload (Formbook)", "value": "cf82029b15abf43124821b4756266f59", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046871, "uuid": "acd2dcc1-674e-4c3b-97b0-fb76496f3a82", "comment": "Malware payload (Formbook)", "value": "b3cd06f0db928bf1457c9646e2f65f1a497164b837bf839ddadd94de7fde757a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046871, "uuid": "b2096888-466d-4551-9e85-9c84ef28770e", "comment": "Malware payload (Formbook)", "value": "a7bd0b47243ba08b1b986254fc27d801ad1128d1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046871, "uuid": "ba0d70af-d4c1-4902-997d-728588b2fe45", "comment": "Malware payload (Formbook)", "value": "ee8f7accbef076a6b4a07716a29380dbc8aabd0505a38fde9ae60c085ab853f560ea1d33b47cb690b4d58026f67dc08a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046871, "uuid": "3e9b0e80-b289-432f-af05-21c3eb275a34", "value": "T15672AE7D97E484EFC30754BC11261050FBEC9EA7B1A29A3B9610B618C2B66DECB407DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046871, "uuid": "4b51e069-f8ff-4ef9-a002-5ff503820028", "value": "384:iyXewPiWKs8PL8wi4OEwH8TIbE91r2fROJY1vib8QJIbgrt:icePt5P3DOqnYJoYvm8QJqut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698046871, "uuid": "c1753592-a2d9-46c9-b8b5-29ff4b604288", "value": 16435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698046871, "uuid": "e0216227-d01e-410e-bfc1-dea983fe0e56", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046871, "uuid": "27f04d6e-bfa5-4915-b3b9-e00515efda26", "value": "TotalXTunisiaXRFQ.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddcc9ca3-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042718, "uuid": "3909690a-419f-4fbe-858c-0bbc653e43b9", "comment": "Malware payload", "value": "9dd6701f22459a9cf2d5167e3651e3e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042718, "uuid": "319a92b4-fb1d-4001-aab6-ff36bf63d6a1", "comment": "Malware payload", "value": "b3d5cef964d5819ffe6d2025e6c42261b0d81ac9bef4b058a96f091287510f31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042718, "uuid": "abc7e563-16fb-45c0-8fe3-4404947c042e", "comment": "Malware payload", "value": "1d52a514db992db3d0a3cca99dd0cca96d4a9416", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042718, "uuid": "e8326b8a-cee8-4ca3-b772-47836da645a4", "comment": "Malware payload", "value": "af932b02d5425800d6b3fbf2b2b38eb60adbde7678bf1489edce16d5bcbda1afbc1d28583d127b95cb686639ca3bdfe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042718, "uuid": "3ccf867d-c5e7-4507-a91a-1eb4e7d30bf2", "value": "T134D4235E2E5C9CA0CA8316F699576C3CF1222EA370D087468F465D0F7F76A3924B730A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042718, "uuid": "e725971c-4318-474c-8724-5136ec6083ef", "value": "98e2cb887af2243f07bef2d3b9f072d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042718, "uuid": "7cad0a27-a81c-473f-8a17-d2c21772154c", "value": "12288:vqjVS+UaJTbBqlwXO3IQOSgrEAUXm1PmXHgPAC+jTplLe2YnOaDQFIgcMlvYMaa3:vV+UaJTbQ6XHAtePmQPOjTpheJOsQFIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042718, "uuid": "2a056605-b251-4194-8dab-a921ac98d00e", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042718, "uuid": "052af5d2-980c-476a-99c3-ac88846101cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042718, "uuid": "fa5ef41b-295f-4e4c-96f5-d11206edb02f", "value": "SecuriteInfo.com.FileRepMalware.23217.5081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e0a1df-7178-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698047484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047484, "uuid": "9fb5200d-4a0f-4b30-a591-f985ef13b13d", "comment": "Malware payload (AgentTesla)", "value": "cbef1fc77f8092b7f45d1ce80d6c8a08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047484, "uuid": "f4ee7b90-aa8c-4028-9841-70da55893ca9", "comment": "Malware payload (AgentTesla)", "value": "b416c66b28f7f50e2e31831f024c9554aa1e14530563e31dc254f209f5bbf3d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047484, "uuid": "0c7ea51d-e55d-4fd4-b258-3a1f2cb6d28f", "comment": "Malware payload (AgentTesla)", "value": "e7a33bc33ea0eca8bfdae6a3e7f04707ef5a676c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047484, "uuid": "c77c52e2-0cae-4fda-816f-7fc16ae18a02", "comment": "Malware payload (AgentTesla)", "value": "ef6d20c79e076c6d6f78e0b16092dbb9da0012b803fb79a0aca33b607aafa0cc00f60519c8255c5e20bb61b178b434e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047484, "uuid": "61a46cb5-1d22-4fce-b5db-479a5457052b", "value": "T1DEC3896CD34B02A98F52933A9B2B0E4442BDBB2EF34551B5306C937533EAC3D952627D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047484, "uuid": "c7d30c05-8745-4dc1-a0e1-9bed592e434b", "value": "768:dwAbZSibMX9gRWj4i0yccX+un1aFDL92GdKEBdb7T:dwAlRYX+yarNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047484, "uuid": "540079e0-43bc-4db7-a9ad-c3af1e963966", "value": 123839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047484, "uuid": "3e4432bf-4378-435c-97f7-e61fba32d88d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047484, "uuid": "be0d3789-d49e-4361-b3a0-2134d6cdecbe", "value": "Sheet 2.A.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2617646c-7178-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698047134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047134, "uuid": "8a33cb06-3a62-491e-be1e-3e336cff47e5", "comment": "Malware payload (Formbook)", "value": "c7c202bb096e38bd3f2cde910b9ceb09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047134, "uuid": "ceff096e-0bb7-4271-b04a-f994808912e4", "comment": "Malware payload (Formbook)", "value": "b42c818a346f33a7778116691ce0910250824d60e07df5472e6b9a4da2e04af6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047134, "uuid": "af681690-433b-4d7c-bbb8-6a7e0d3bfe15", "comment": "Malware payload (Formbook)", "value": "3e1ea7690bc7758381ed2c65e4f26d3b6964c561", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047134, "uuid": "a86aa19a-e24a-4378-9580-ef43e2ab3268", "comment": "Malware payload (Formbook)", "value": "394a9d0948e8850aae2333e13eded12e447ba3b03722fd5fdf3ee5fd5996b4b5305e724e4290e891e97b166dbe652826", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047134, "uuid": "28fb73f8-3d40-44bd-9167-560faebf700c", "value": "T156752343E7D8C173EE6253B15AFB12435A6978A64C3442AF2396D94D0CB2788F474B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047134, "uuid": "8693f86d-f606-4381-bceb-bc1099f37364", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047134, "uuid": "3d32f982-8367-4157-a97e-feaf6f949559", "value": "24576:vyr6YuDJ66ydKR4oAC62EFPV5lmJW1PnAixHahOROPUZqmoZ9BUiXcXIVVVZbNjA:6r6YuQ6SK0hn91PAqIwOI7s8kVVZnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047134, "uuid": "72bcd06c-8862-44bb-88ce-016f9340c899", "value": 1590272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047134, "uuid": "b6914f5d-63c7-401a-b06d-196a7a3ce657", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047134, "uuid": "8629d796-4ed2-45b2-8fb6-262639e0a478", "value": "c7c202bb096e38bd3f2cde910b9ceb09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3381ba2-7183-11ee-8907-42010a9c0042", "comment": "Malware payload (RisePro)", "timestamp": 1698052149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052149, "uuid": "195cbce6-6724-40c7-831a-363884c311d6", "comment": "Malware payload (RisePro)", "value": "40dd3dfcf8db69acb95007fd2dae46d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052149, "uuid": "71778be2-19ba-4689-a388-a2ea03824d42", "comment": "Malware payload (RisePro)", "value": "b45cf2386ead3e4664e4e3e1e324ae9e87034e9a6a612ffc76482fe777b507b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052149, "uuid": "e19d8701-fcfc-496d-8467-200b580c4340", "comment": "Malware payload (RisePro)", "value": "cc5332794bb85ef7a7ca47a8fa58bacebf612f7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052149, "uuid": "d19cde59-c530-4f72-8532-10dc1f454fa4", "comment": "Malware payload (RisePro)", "value": "c5ac50ed5dbc4131753108b0157187a0bf3cc14415cb877b4aad91dc35c31ec0b75096335fc9bbcd12d3014db28da4a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052149, "uuid": "8686c06f-8789-4746-be00-bb90e75b312b", "value": "T13C2633C3F306999BDC2911B0D81AC93107156C88AAF6E243B5E87E1FEDF31C319A565B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052149, "uuid": "19cee6c5-69be-4fc4-97aa-abd7dd7f1eef", "value": "3562b05481ebc174ad5134fe30b344c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052149, "uuid": "a87dab7e-f15a-4b5c-9087-bf6637357680", "value": "98304:fwLorNVPoicjrLSjJ2maNKGLRxKv2Xi6PYK7uDM1alI:fh5VgicvLZbKv2y677uyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698052149, "uuid": "d0c1228d-97ee-44c5-9701-ebaa483493a5", "value": 4686848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698052149, "uuid": "582f1efd-dce5-4da6-b2e0-4a1110b1db4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052149, "uuid": "03e6d486-a210-4b8b-96ea-375bfe363f94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780fb0e8-718c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698055861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055861, "uuid": "b40cf155-bb03-44df-91d9-1f18ad18f2fe", "comment": "Malware payload", "value": "d1ce22c68110a372348e79246f8bce7c", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055861, "uuid": "c4e81933-29d8-438a-9024-746a6fb91644", "comment": "Malware payload", "value": "b520328bdc0dc605282af946a42395c65bb75296b9190036dcf03fb9fdc8c36a", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055861, "uuid": "dd5a635a-e648-48a6-94af-c1ebea0be3f4", "comment": "Malware payload", "value": "6d611e5de8fc30f626451bf9f3d6e2bd10c32ede", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055861, "uuid": "684273a3-950b-4a2f-a6ed-cf3cc1b6de4d", "comment": "Malware payload", "value": "eb08685e6296b1b23213908dc431fe97ffc2c9c9d892ccd084fe4ae521d97cb63fc3dd9ebce4f295e530e667f651700c", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055861, "uuid": "afbeca91-f77d-4ea9-ab78-d4ba92f94675", "value": "T10BA312510FC9B536BCF0FB0A63E2E12E05B0C0B14A67A5F675589854BD34E8F6887DA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055861, "uuid": "b87bcdaf-0971-4cf9-92f2-06691c6ab711", "value": "3072:53F7pfRh1MTyj6KLVwVRleXMG2cRy9zOgp:53F79Bmy1L38G3ytLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698055861, "uuid": "c89ac5f4-27ae-4020-96e3-5340df4d00d4", "value": 103102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698055861, "uuid": "2cca8b4b-b69a-44ce-88fb-ededb046592a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055861, "uuid": "30ff2131-eebc-4b12-a88b-1d1a45ebf737", "value": "SWIFT COPY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0866f8-7199-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698061369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698061369, "uuid": "1eee8aff-762e-46b1-9975-8ebd37e681fe", "comment": "Malware payload (AgentTesla)", "value": "cada74f7a9863be3584acf8933b92a80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698061369, "uuid": "edc4dcb6-d486-4486-ac08-e3251af23500", "comment": "Malware payload (AgentTesla)", "value": "b52be0c527cd2f67b3c88472a02fbb50a194db1a0b00eaeadd446554f1247e47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698061369, "uuid": "3c924076-fca8-4ca6-8f92-3704b905c43a", "comment": "Malware payload (AgentTesla)", "value": "c168cc46d7dfab86341316a3cbaa6b2a0e626bfb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698061369, "uuid": "47e7dd23-f6a6-41d6-9ced-00b71afb547f", "comment": "Malware payload (AgentTesla)", "value": "0e9d4ed0f95a90ba228232ced6bd29fe08623a94b67dc13a5c4aafa02a07c649ca115c814a966d8f94c7c2857fc262a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698061369, "uuid": "47402202-39bd-4ad1-9139-b2ef427527e9", "value": "T19ED423EBFB17FB60459A1A55EE852357B9ACCE0B4A7630115332DFFE099EC80841624F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698061369, "uuid": "fb7b9ff8-700d-4c96-8f0b-ae33a9bbc1c1", "value": "12288:RDKlkffkvmwkvNfXPBGs/ZubJnTnQAhOKGUnSe/vbj+YptlniWbEINn9d:RDaVYXgZbJnbWDUSeX33niWIaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698061369, "uuid": "c7902924-6d78-486d-8c07-de7eaae9d895", "value": 632113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698061369, "uuid": "d93009f6-7d6b-438e-8f20-3c41a40f661b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698061369, "uuid": "b5065f66-91b4-40ad-ba50-26ce48e7da1c", "value": "Purchase Order,doc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b46c93-71b5-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698073601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073601, "uuid": "8247f8ec-6ac5-46d9-b45d-e3ba171a8865", "comment": "Malware payload (GuLoader)", "value": "aa9c44eda9af9222c5cab2466bc44f5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073601, "uuid": "cd3c1a1d-1c35-4e81-bfab-064988f33fc0", "comment": "Malware payload (GuLoader)", "value": "b58a548a509a5a2453800587352c8a7ff970dba696e82a69343738ef94073a8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073601, "uuid": "62ddb1db-d4e7-4201-833c-4eb185108c93", "comment": "Malware payload (GuLoader)", "value": "b5d7bcdf2637cee61c36d7a50d628288c3c5401e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073601, "uuid": "920e8932-8cf1-433a-81b8-d329948b5937", "comment": "Malware payload (GuLoader)", "value": "a3b369a8f5130bb75732b4a4f583ab0a0e438241bbc4e3e263fed650e784b98569a6b2b71f51739e3457c7cb61199688", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073601, "uuid": "a80ac990-5a89-4814-b43c-51aa004ca1c4", "value": "T10CC5236DD214C0A3E65015345EE7DF316F269C5494604AA627F8BE1F3DBE3037C2A2EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073601, "uuid": "ecdf0fdd-9018-4507-b041-3984b3bcb116", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073601, "uuid": "d03e0147-c185-4ca7-b6d6-1fec810a4dbc", "value": "49152:cRqw2aja8QnXN81nUCV5VliUYmuyKLbokCQf8TlJoT9ESCPRGT8PsJ:cxPen9+n3r5YcsboCc29DKGYsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698073601, "uuid": "307afcae-8c26-4196-b124-3ba3febc9ffb", "value": 2716872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698073601, "uuid": "8c262042-e2a3-4f46-910a-addd4b466ae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073601, "uuid": "a54f6fec-c9eb-4e0b-945c-f9b40d9c320e", "value": "RC_S23_3274 Or_amento ADP 231019_5_5009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6790709-71c9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698082273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082273, "uuid": "3bce6a97-de1a-4ae3-ac5a-7988f198dfcd", "comment": "Malware payload", "value": "1fad63557ed5c2529d69737f9298d5dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082273, "uuid": "d36a3121-2fff-47b7-9850-cbac45fb3704", "comment": "Malware payload", "value": "b5bdfbfabf3f0cf50f7f1fcd0d69c88ad2ee3794f3e48fa0ca4d0911549431bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082273, "uuid": "e54bc254-1887-4847-b968-b3cda3ff5de7", "comment": "Malware payload", "value": "f70eb8121522e63f230fe7c2d6bf6d1696cd246f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082273, "uuid": "c9365685-0dd4-4e1e-9739-7f89a1afde67", "comment": "Malware payload", "value": "effa8ee0b2b364f7e40a9880d27836510b57beba93a0b89f78c2e900b682758747aeba1ccfa06e45140013c67e6a0772", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082273, "uuid": "800f1797-f382-49ba-aa0b-4e94710b3fbf", "value": "T14D952C1176F95759FAF30BB85ABA7612087AFC6A8F11C2DF1290944E0D31AD09970F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082273, "uuid": "5e3d9eb8-9f57-4762-be65-66fe07444b70", "value": "037522269f8348aa17add864631a3f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082273, "uuid": "f25a9bb0-f3e9-46c1-978f-14dd401aa1e6", "value": "24576:zriAfSYqe7E9ErdW+NG6a9DhvhJCvx3V+k48I:z3qe7E9D+06a3vox3Akj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698082273, "uuid": "f6cf01c1-e324-47ff-8494-929f1581493a", "value": 1909248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698082273, "uuid": "531eff40-bb5c-4b74-83f2-7342ffed3bd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082273, "uuid": "06a4a68a-ea3c-4a12-995a-960d37a04e44", "value": "SecuriteInfo.com.Win32.PWSX-gen.25137.3296", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb15bf37-7137-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698019467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698019467, "uuid": "48bc1f71-b632-4aa9-8988-6fa975a813db", "comment": "Malware payload (Formbook)", "value": "91fd4dc78b8e1d15445cd547a9d2a2d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698019467, "uuid": "0a849ac0-122b-4ac6-8e31-d644b745fd67", "comment": "Malware payload (Formbook)", "value": "b5c273380d3d481436acdaa6ec1e0ecd4eacb874b9ffd920b9a78cb5ac617a6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698019467, "uuid": "88904f7f-6089-439f-80ff-fa92d032bece", "comment": "Malware payload (Formbook)", "value": "2e7fda91b1e1510c71986d58f892c616a196f9d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698019467, "uuid": "f2336eac-a507-4ac3-b84f-9ecfdd82960a", "comment": "Malware payload (Formbook)", "value": "b0cab6d9fd15515428906e4e8c1f45e6a8a0dfc3cb6ed4b56bdf2888efb6868af9800fc2ffdc297a90ed6f896ef2c169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698019467, "uuid": "28f55768-793c-4bbc-84b3-b4aff97f8475", "value": "T15585235AE2D94422D8741B73AEF7039317397EB04E3C412B2796C9179DA2260F0B676F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698019467, "uuid": "9ceb6e13-0aeb-4624-8324-ee8ca43535bb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698019467, "uuid": "34eac110-9a2e-475e-845f-3311cefb185d", "value": "49152:3Dwv0ht46BUetxfgOK2lGywxCWFZjlkpd8:Ty0ht46jgGlfwr3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698019467, "uuid": "91402921-af3a-47e2-b562-d7ef1a5e0cdb", "value": 1827328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698019467, "uuid": "b23a7159-afac-4469-98c3-f45600f6dde6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698019467, "uuid": "1a678250-cbfe-4383-92b6-9b7102471f66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036c28ac-7176-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698046217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046217, "uuid": "49553a74-a790-4c90-9a85-ea9c16d7f69f", "comment": "Malware payload (AgentTesla)", "value": "4235c2b4dac9a55f060f5f66a747c9c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046217, "uuid": "65df7f23-a91b-4b74-bc90-351947cbc347", "comment": "Malware payload (AgentTesla)", "value": "b62200d6871b5f2343d407fa822c9fea82b9c28d7414b088e1a56160bf3706b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046217, "uuid": "e2da9ab2-42e4-4449-9e88-a5bcccf82fab", "comment": "Malware payload (AgentTesla)", "value": "3520c48250c375f3f1b50539fc009e99af7bc75a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046217, "uuid": "be6b0f1b-fcb0-4117-a9db-8e0cb498782d", "comment": "Malware payload (AgentTesla)", "value": "195b5d69593618b6d4f331aae5d44c077e744aeb9b61f611ac68a06365d7c8c5afbfb52f43b48e8fbc21a8c5e268cdfa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046217, "uuid": "6566392b-b9f6-4855-9f7e-46fcfe75df62", "value": "T1D5E4225667A8CB73C15D9BFE041495D813B92F923201EBEDAE8172ED23B47021D39B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046217, "uuid": "7f6347a8-ee29-428c-9889-ebba06e5ff2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046217, "uuid": "9cf92010-d840-4e4b-89fd-41383fda8680", "value": "12288:9b5yzvbYmBHfuK3vMqVfp47FuNfdjOTTFcWwZg4AhWZDFQzrRBIhneSE:nebY0/uhqVB0IyTmg4AHzrRBIgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698046217, "uuid": "e37812da-d29a-4b22-84d5-b6ba6c942ce7", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698046217, "uuid": "5de0e34f-569d-4648-9b5e-2cd3e6be35ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046217, "uuid": "d019fa03-93e4-4d03-b021-83bbbd13e695", "value": "product may.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885e77f3-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698057607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057607, "uuid": "123691a8-5a6e-4b89-bcd2-0ba42301b812", "comment": "Malware payload (PureCrypter)", "value": "8b20912a9f5468e02c9ae8e518d3b843", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057607, "uuid": "19bf4149-f914-44a1-ab62-b4f26f8e4d7a", "comment": "Malware payload (PureCrypter)", "value": "b622bd6adc986ca0a50bdff2a2a2e5e4bc95fe07956faf162003d4c2d0b82aef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057607, "uuid": "d3db7962-f181-447d-bf59-14bf9c1169d8", "comment": "Malware payload (PureCrypter)", "value": "23da305832a5210b76c568e65c8d7199bb772bee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057607, "uuid": "5c2265c7-ce4f-4f53-893f-5f0fe658425e", "comment": "Malware payload (PureCrypter)", "value": "98d37edeb3075d834167d6c93d34ff83e7627fd2f2312c6f0b5eaf58bff81ada3484317dc224301c4b5f276dac6ff6b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057607, "uuid": "b30d9794-508c-47bb-95e2-c5b38d75d25f", "value": "T1C9B2840623480BB2D0AE0572D446E770D712A61D8CA78F39C450AB87B1DA3535DAFEE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057607, "uuid": "939775c8-1f91-4c10-bede-3cd211cdd66a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057607, "uuid": "9ca90c1a-afef-4906-9f40-03d34f982f8e", "value": "384:/GDFV8wnob59h28Shnd2i22i22222A222sf122WO22u02u26x2u2B+222u2R222i:/UFKb59M9zxSHoCKbEMfnTbxB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057607, "uuid": "5687e324-3afe-4084-8f89-0c5e1a096442", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057607, "uuid": "88f1fc42-8a3d-411e-8973-a01b682caedd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057607, "uuid": "747f9122-9eaa-4678-86e9-65135a4a0742", "value": "8b20912a9f5468e02c9ae8e518d3b843.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd61b65-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042721, "uuid": "45e1d64d-eab3-48eb-ae6b-0b1e35e47d20", "comment": "Malware payload", "value": "1f711bc2a200b3ffae1a44837e5744e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042721, "uuid": "f788e357-c672-4385-8917-6740cc15b5a9", "comment": "Malware payload", "value": "b657876051d49ce5b36e456b5fc8a330d196cf75fabec0d56ab158c4d298b265", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042721, "uuid": "d01d7316-664b-4855-9f59-48ecde69238b", "comment": "Malware payload", "value": "16e6964582f0a1ba2be6714f181fcd865db084c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042721, "uuid": "b41520ae-4a3f-4562-99d1-94c252955805", "comment": "Malware payload", "value": "9e7ca3aad6383ac12a95b50813d6b217a8d0520d85078db73ae81e85cac07e626cc125ac97f3be10c821a6c961545fd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042721, "uuid": "a1751dbb-9f57-4da6-9efe-3a7584859640", "value": "T18055D617E740602AF45300326A64AA77696E3C351448DD4BF747BBB835B46E3A9FE30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042721, "uuid": "56061e79-d543-4108-ba91-86c0a670e874", "value": "456998f0f1bd77fdd28e8ead84ce6be4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042721, "uuid": "1e329d4a-62a8-4f07-b65d-97fed76209e5", "value": "24576:jNomOpw087bdeo0bOCnrSEEisXgQgiaaqxHp/qmNcPMEcUfmwrx9KufcCSDu0zMP:jmmOpw087bdeo0ZCIkx3UW/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042721, "uuid": "b770830e-7d8d-4dcf-a64c-2be3151784e6", "value": 1335296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042721, "uuid": "2ffade67-0519-41d6-b0d1-818a58149459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042721, "uuid": "107f9a43-bb20-468f-a35c-14e9ecc069c9", "value": "SecuriteInfo.com.BACKDOOR.Trojan.11737.12197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ebf3df-71e5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698094273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698094273, "uuid": "7cd45812-73ae-4640-b6bc-e66d1f5cd6cc", "comment": "Malware payload", "value": "c5be9c39afdf0da89b281f61e8f5e721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698094273, "uuid": "50a05313-08de-411e-840d-6b22e4f97cfe", "comment": "Malware payload", "value": "b67634b988dfb1f43e7ecd30579fe285e1e57740d646f6896b4f6a0d13cfb9dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698094273, "uuid": "bff982ab-2143-40de-86fa-25e997458324", "comment": "Malware payload", "value": "e20cb14555c8ad7bf9af5c6f2354e7fecc32b489", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698094273, "uuid": "cf744669-1b63-49c4-93dc-64d01e03ce48", "comment": "Malware payload", "value": "2140324bce0120b99bd633cd678f6fcac417e39d471004c7edca0aab2610c15b5ca219229229f6d3914a2cebfaa94605", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698094273, "uuid": "2a7ebd00-4a5f-4206-95cd-705055e28a9c", "value": "T1703401177E48EB91D6583E3B83DF2D2413F1A0C70673960BAF48AFA529412476D6E36C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698094273, "uuid": "c4670587-0aff-40b3-be70-a9164f7892a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698094273, "uuid": "03f891f8-be56-4950-ab2f-7350a49a930b", "value": "3072:VjmNKp01Ld0unr8xjQwzFW54DXnogD0WjPB8:5kKp01LeI4xjQwk4k60wB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698094273, "uuid": "489f2461-5a9a-4b7b-8464-846fd04b2719", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698094273, "uuid": "88b80045-6e6f-4781-810f-b42fa7ac72b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698094273, "uuid": "5af7f80b-5884-4f02-83a3-49a68af0e3e7", "value": "out1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42587f26-7196-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698060066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060066, "uuid": "87ae0d83-d6f3-47ca-b9b1-b5d66adeaa74", "comment": "Malware payload", "value": "98be36c080296477289f03058c8074af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060066, "uuid": "40bd475e-045f-4b89-8140-b4d37f6b641c", "comment": "Malware payload", "value": "b6a2fdb5b60afe99a042d62c4363e7dbbfcaa7f30e4ef1397e265ef1576e7455", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060066, "uuid": "8a1e4cb9-5930-4a51-bd15-1bf412d6db31", "comment": "Malware payload", "value": "a4cbde5df861d84516355821549f75e921ccc50b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060066, "uuid": "71c3f91d-5651-485e-836e-1fc9855a59c7", "comment": "Malware payload", "value": "6b489e0cba1f76129eded926bf0b4cf36fb75cc9ecc20098d518b92a698422685279967f634da1233ad2e9836eab61fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060066, "uuid": "1107c909-0eaf-4ae8-8d78-8378a76e582e", "value": "T130658603BA978BA1D19D2736C5EB08B44363D9817623F60A758B235A09437B76F4DF0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060066, "uuid": "a57ae5d1-c72a-4855-af28-d019626aebae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060066, "uuid": "6987b718-9435-4bf0-9bb6-e3dfb22b9b2f", "value": "24576:/0fM6EOnD2b5GeweuMuLFWrfauQtQWIQpWK5R:uncOGNpWIQpWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060066, "uuid": "ee37dd86-ea5c-4a41-b3bb-558e9038d696", "value": 1492480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060066, "uuid": "9b842d89-1e67-4028-864a-93fd7823d36a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060066, "uuid": "3ecb243e-cb89-4804-884d-f61085ccf8b3", "value": "EACTS sample product requirement 23rd october 2023 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58427d27-7180-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698050654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050654, "uuid": "2c878c47-d33f-43aa-8620-e45602558e1c", "comment": "Malware payload", "value": "a0c78d347dbbc5d0f7f2fc295f05b6cb", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050654, "uuid": "7190d082-8d27-4c8e-b9c5-bc89dbb39dd3", "comment": "Malware payload", "value": "b797d44d4993111fec98209b4c9dc6788581d142e438cd349bfb185b2577d8ff", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050654, "uuid": "c35a2970-7459-4998-99a0-346e3f84821f", "comment": "Malware payload", "value": "a895d35d103f979cfb18621d4806620ef794f87a", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050654, "uuid": "b74cd355-4d65-4c8b-ad8b-f63e45e4be35", "comment": "Malware payload", "value": "58cb84909dd656372f38bbc6805b2fd5bbaa362f600d6300d6b21bac3ca8aafb8f26cd23b56a29efff162636a57b7f4d", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050654, "uuid": "2e751ef9-632d-448e-9997-6bd862037ad4", "value": "T1A3413B63FC478851CEB0D0421AAB426750594B5EB9312BF2A194932EC7CCCD6B861405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050654, "uuid": "a86b961f-839f-49ad-91af-23d34377859d", "value": "48:ZSBB3NQX18XzufH1u5Q+jg0tFbyyrrouRe3dajYHHYHTIkg4VW5ylQho:ZSBB3INQ4oFbyyfo+e3dacYHTA4VugWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698050654, "uuid": "c8a1d243-e4c1-40b8-b6f7-0a63a59c961b", "value": 2419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698050654, "uuid": "bc3253ef-4ae8-429c-b9cf-1326bc7731e6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050654, "uuid": "9e3a36f7-3078-4cc1-9d93-1756cd1d3319", "value": "01-Final Payment-INVOICE-8901741.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6964b93-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042732, "uuid": "df3cff95-c1a6-413d-a374-d1f36b49fba6", "comment": "Malware payload", "value": "7249150e1c21a696a96d47b9d5f5a8b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042732, "uuid": "513ea410-c268-4244-bf01-b4b9470e5de0", "comment": "Malware payload", "value": "b7d23e6b3d4be7cf280bb7a92b168c1772f62d526ce6fff8181216c502097d45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042732, "uuid": "95fdf1f5-c808-4165-abfc-deb3a0de2f44", "comment": "Malware payload", "value": "57b747083dc2296cdcc13cfbe41f1831f0cc08c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042732, "uuid": "aea2fb5a-9400-45e4-9c90-ae236c3fb6b9", "comment": "Malware payload", "value": "c31e78bbceed7138592918f6888ac9a355a57681068831ed5f98a744784c1af471a83126af5628e7ae33afed63431583", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042732, "uuid": "e56423e9-5c88-41e6-8a94-c023f3f52176", "value": "T1DE1512567F50D485C52A553C5E4EF99CA620EE08D68BC62B3342FFAE37B3F24168148E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042732, "uuid": "a363ab61-ee4b-4eb8-877a-7fa82071f043", "value": "3afa0128ae02a17fcb85db61f9975222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042732, "uuid": "e21522d1-5ed5-4b5a-8cc1-baaa5a72f357", "value": "24576:ha4sfDzTE4oKlIWlMKb77WPjZQmfUoSegeWdYPYc:haXw45pqbQ/oSegLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042732, "uuid": "e0077bc4-58f7-45cf-96f5-4ec9ca07789e", "value": 923224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042732, "uuid": "4a32ac05-19f3-4d4a-9a11-e4d2efc4f735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042732, "uuid": "89598591-c71e-4839-b55b-21cfc6951d9f", "value": "SecuriteInfo.com.Trojan.NtRootKit.18405.10613.28961", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e79e32-7175-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698046031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046031, "uuid": "61f7be8c-e6a3-4bd3-8be9-8f9928cb7bf0", "comment": "Malware payload (AgentTesla)", "value": "6a12107cdf1c1e85cc069f83f8b0aefd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046031, "uuid": "bdd4a02d-8953-4fc3-8868-abbece1e5c38", "comment": "Malware payload (AgentTesla)", "value": "b7d6a1034526c45dcdd4f88061de0b13047d330a97ed1d5466d7717190db8ccd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046031, "uuid": "f492334a-8e6a-477d-ac07-c1d1aaca8c55", "comment": "Malware payload (AgentTesla)", "value": "0da84696fbe9e607085f52760ab8bf673f9f7c77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046031, "uuid": "66f8de08-c7d8-4331-b326-e7a6613ebd5f", "comment": "Malware payload (AgentTesla)", "value": "4be26c0033354c18d1a63ca40377427780f31163d8b013af0675e01ef95165ab74d7792f7669c89a38dcd0dc9b3c99ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046031, "uuid": "b3d20aa3-0f65-4736-b269-e4c99c77d1f6", "value": "T17CE42359BB948333C14F03F9406192854B78BE265105DBEE8EC530EDA5F7342BE98A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046031, "uuid": "9bd6f878-7bd7-4c24-9342-fbeacc6a5ab9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046031, "uuid": "035cee23-3853-4672-94f3-26de07d4a2f5", "value": "12288:Wb5yzvbYmBH0en6afT/YtoTjupVUrh8iFt6nnPgiQuTLw2kSLwffgPqmqMG:kebY096iME2sFt8PgiQuTc2kwwAqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698046031, "uuid": "d4df1cd0-ff70-4746-9065-83ee4c60b5ce", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698046031, "uuid": "539b491c-d7ab-4fd8-afc3-5d1f544691d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046031, "uuid": "c9b5c5d4-28c5-485a-a113-6e0e6e2a86be", "value": "order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e5c922-719c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698062790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062790, "uuid": "a4b0a51a-81bb-4f64-96fc-2c797db05a6f", "comment": "Malware payload (RedLineStealer)", "value": "71d44827ec90d6ffe31666374d8df814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062790, "uuid": "8a57080f-2347-478b-8dcb-f721e346d9b5", "comment": "Malware payload (RedLineStealer)", "value": "b857534dee49e9485913b54161cfd20ce3a26ebb1b4d4d73a13d88d94bbe017b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062790, "uuid": "659692d0-acfd-4c16-9b7b-e1ba4d91f36d", "comment": "Malware payload (RedLineStealer)", "value": "5e0a5516d2df1d5e1f84d466bf460beafc74a2c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062790, "uuid": "9e27e67b-7a31-419d-b604-77011e995bb7", "comment": "Malware payload (RedLineStealer)", "value": "c6fe74594408985016fd219d21709f141716b54fa6123f655a6b5c8c5ef732e1f68a8bcc96dce0886216a201863d8cf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062790, "uuid": "ccb79c7f-1717-45a1-acd3-2d4a2029f6aa", "value": "T1527523526AE51075D8702B702AFA13C78E353CF31A7407172AA5D91F6EB32ED983136E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062790, "uuid": "3e4232b7-56e5-48c1-ae89-6f03886e4489", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062790, "uuid": "2d115b08-df62-46f8-9f01-4cfb9fea0f98", "value": "24576:YycMa9WPRTSi774M13w5LMXOEQqr4cP9r2kAKwtYtYOESaj0X7rS6IAPNPG:fVa9sSiQMNwNhqrT12kAKvtYj09lP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698062790, "uuid": "e484da36-dec3-4686-8ac0-dc7b4ede76c0", "value": 1583616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698062790, "uuid": "6489837b-b924-40ef-b3cb-66ab688ba6fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062790, "uuid": "8ef82694-b525-40e4-9437-8eb72283c6d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79249fb5-71a7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698067460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067460, "uuid": "38ade3b8-5ce5-477b-a18f-0570331c15e2", "comment": "Malware payload (AgentTesla)", "value": "bd136d61e094dd46fae5f3fda5d18d48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067460, "uuid": "6fa1c1f2-de29-49d1-bec7-bf801597dc02", "comment": "Malware payload (AgentTesla)", "value": "b868d7a2a78e9436fc3675c1ddbcfa1eda4d73926a856acd36e54f9e5b09fba5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067460, "uuid": "c249d365-3dc3-4c90-acb0-17a2e9f7fb42", "comment": "Malware payload (AgentTesla)", "value": "06e2050d0803a5dfdc9ba0f34200f3943efa9e86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067460, "uuid": "0064164c-c7bc-4eaf-9c1d-4f38a3ed45de", "comment": "Malware payload (AgentTesla)", "value": "9ae5fc457503600bef33b06af325752621aa96cd49596764cdfe3858a0e5569409f451cfb92281051907ed94644d733e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067460, "uuid": "e128ff6b-e1fd-4d4c-b416-741516392ba6", "value": "T1F10501207B586B40D63E67B9449DEA1003B78F3A2332D6184DE17CD33673B868D92E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067460, "uuid": "afc18636-a057-410e-9bed-59134dd1fe7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067460, "uuid": "f4b1fc28-c3e2-467c-823d-1dbb664b7e81", "value": "12288:VMjfMqgR/mZRM+BJ+Pe9X7/euLQD6uxUMNAdY+HP4l64ZdQVEyl1z6JddtR2k:4gkZR5uaXL4HAdj41ZdAEKd6nl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698067460, "uuid": "1c70a1ec-e3a6-4b97-9892-4a87ed933c12", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698067460, "uuid": "c9246ce8-7be8-48a2-9753-76419688d0f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067460, "uuid": "87d8a1a6-41f9-42dc-959f-63a448d23b0f", "value": "snow.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b59f33-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042709, "uuid": "1921c0fe-4393-4dc5-80d9-2fa2106e82de", "comment": "Malware payload", "value": "d24656b8e542726fdc71c581563b0b10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042709, "uuid": "9dac63b2-24b4-443a-9ba9-c47cbb8d710a", "comment": "Malware payload", "value": "b906c519158f682edb25fe85ecae35a1a2799612f718fff98ad0ca84e4d2375f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042709, "uuid": "9a04c5e3-8aa5-48e7-9899-360d8c485350", "comment": "Malware payload", "value": "ebdb1c7f52200acb11f3c6b11aa85aa2af67812b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042709, "uuid": "8696ec59-eb3f-4825-9b74-e6f00e01494d", "comment": "Malware payload", "value": "aaeccacd40446add9d2edc16342f599832252e3399b93ebca9f941eda79a9624bc8275480f96c003e63ef9eb0ae9f45b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042709, "uuid": "df1b5ec8-5e74-4219-b76f-5725e0a60c00", "value": "T1F0E4E0F5F9054BF6DD23E071F07ACCA096A76E6EA854A58521E2F24A4FE3437903B413", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042709, "uuid": "6f00a624-227a-4aad-9d76-406c2d1a46e7", "value": "70fdb1cc5a7f08af3dc8a9d56cb41801", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042709, "uuid": "9c22ebe3-66d7-421d-ab05-08454e52d4d9", "value": "12288:COtNrR+gEYus8kYdZjgahNr0G+CE1+D0Y0PKq6OI/s6hkE0M9fNJwke:C0NrR+2ugaX+DEgY0POEGn0M9fNGke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042709, "uuid": "9307796a-774b-44b1-9b68-396d7d914399", "value": 716109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042709, "uuid": "e9a67471-7f7e-442a-b46d-dd8d46f14bf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042709, "uuid": "2d42ce3c-759e-4523-b20f-36ec7473baaf", "value": "SecuriteInfo.com.PUA.Tool.Siggen.9393.4377.14161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51072d8-71d1-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698085626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698085626, "uuid": "0f0d0252-1d8c-41b1-a923-d19ea715a662", "comment": "Malware payload (GuLoader)", "value": "b434372e36a7d17bc61c8062bbc14015", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698085626, "uuid": "bc967440-c324-4706-9083-4074a2986b61", "comment": "Malware payload (GuLoader)", "value": "b94541afbfc65ad19aa72f3c547c65c0e0e6e706c7cd18c31c80efe501d28346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698085626, "uuid": "5dd08c7f-9403-4423-9488-8181ed9abd60", "comment": "Malware payload (GuLoader)", "value": "1e28e9114efdf6bd2a9e0e96cd69b046abf94315", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698085626, "uuid": "271c24cc-d4fd-4307-a784-d0820f2982d0", "comment": "Malware payload (GuLoader)", "value": "b8f626a2fca589d852ca399ee19123b72b91c00cef3364fd9195ecc9b251c063f0e941b502d8cd2e80cb417f841c746c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698085626, "uuid": "f2923f9a-5713-490e-80a9-c99d75e4b201", "value": "T1BFC5236AD244D0A3E65004345EE7DF319F269C549460469A27F8BE1F3DBE3137C2A2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698085626, "uuid": "db9d1287-e160-437a-bebd-c064000bde2d", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698085626, "uuid": "15f15f00-1fed-4efc-8cde-ba1d3baaff9a", "value": "49152:VM18QnXN81BUCV5VliUYmuyKLbokCQf8TlJoT9ESCPRGT8Ps+:Van9+B3r5YcsboCc29DKGYs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698085626, "uuid": "d1a42416-3805-40ee-9192-9341434ace05", "value": 2729832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698085626, "uuid": "92f68ac7-9512-4446-8cef-789a6b0344cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698085626, "uuid": "4a20d5c8-2894-4307-8cef-b6e1aa052443", "value": "SMGS-RCDU5010031.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd311c0-71a5-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698066608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066608, "uuid": "e3c1dd71-91ef-49c5-97ec-6a2ea2c534ca", "comment": "Malware payload (RedLineStealer)", "value": "9635eea0816a4a40675fe696b7c47798", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066608, "uuid": "b83ebf84-ed7d-4094-bda1-a7374c4e84e5", "comment": "Malware payload (RedLineStealer)", "value": "b95f9c74d005d952597370d43ee2b1305ac8395be659b03e47b5ef08030a0763", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066608, "uuid": "28c7f475-4849-4df6-b5db-d93b145bf7c5", "comment": "Malware payload (RedLineStealer)", "value": "9c1c31a44d93dafe5a0a32b6e0fa451111743f16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066608, "uuid": "3f6c0ced-c05f-45ba-b2eb-72872f044b2a", "comment": "Malware payload (RedLineStealer)", "value": "76ba7a977f4f33d281cee3c7f026551dfe55e72f4428eece314f8e26527ce2fe31f01483d1d827a16841d3783d0c998d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066608, "uuid": "81aede73-f0cf-43df-80e4-4d6a19f6e031", "value": "T191752301A6E545B2DCB9077011EB23D347313C718D795B73AAA6A91B0DF3B48A136B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066608, "uuid": "d9ef66c2-f811-4a13-970d-e1a9214e67be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066608, "uuid": "c1235d5c-2409-4158-ad06-efd956e0be17", "value": "24576:+yI0qcn05J/DUnlyWO0UoC/wP5o+Xn22cDOTVL3CdJiPEOWut14wDF/8eQJ8g2sD:NIjJ/onoWYoC/wPPNcDGbCdQMVpJFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698066608, "uuid": "a737781d-a7ec-40a3-b49c-d26ac42eee85", "value": 1577984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698066608, "uuid": "daef127d-2ef8-4502-ace7-95b475aed17c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066608, "uuid": "ff806a19-eeec-4652-b447-b413240bf2be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc61ec8-71c6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698080621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698080621, "uuid": "4c6a0e5b-e5e5-455e-9e11-1509942a1420", "comment": "Malware payload", "value": "6b32f7aabb31b102d98a69bbcfde0bac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698080621, "uuid": "5dc5b344-3e18-498a-8aa6-031e4740c08f", "comment": "Malware payload", "value": "b983faf575bfae3a6a10bcfde6fe7e7ecc0716ae285723e01876fe48faeb100f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698080621, "uuid": "4a83921e-4d7b-4290-a664-87f5452b032f", "comment": "Malware payload", "value": "f1e27b42f8369dcfc08de3b2f4a340100a889f0b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698080621, "uuid": "54b5b3ec-686c-4134-98af-ad00b4d55734", "comment": "Malware payload", "value": "f42f7951234a369b678187f3a30dd8ed0cdc102adc849b9c7812b57c028bfb5dc446a492bab4bee61b04b7c95b7c284b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698080621, "uuid": "f002a821-83ba-42e7-8bed-cf55370e58f1", "value": "T14835236CA74BDBAAD8EC28F668E27F940374C877D78BE3572DC945E108223E7581051B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698080621, "uuid": "ca426507-5ba4-4b85-86ba-562c1bd33410", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698080621, "uuid": "30883ac2-a1ce-4022-abc4-bd065fdf345e", "value": "24576:AQV0Gf28ZeqiJtlOMDAMDqJVuuvYnsz27rsvIx8qu7a:ANGe8wqiNLDqWuvYswme8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698080621, "uuid": "41aaba4a-74d8-4830-94ca-88b64b2eac88", "value": 1083392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698080621, "uuid": "463bdd95-3a54-4ebd-b389-7cffb18a4a0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698080621, "uuid": "aa299791-3784-4546-82e8-554e9ab0ae7b", "value": "Irdnrzdakhk.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2af3e3-7180-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698050902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050902, "uuid": "58ac1472-f830-404b-9357-fb0f376fef4f", "comment": "Malware payload", "value": "7f0e5ce72fd84a16d95905c058eb20a8", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050902, "uuid": "f9666e7c-5e33-4a93-8ff7-f34d3c5d97b7", "comment": "Malware payload", "value": "ba976592a25557addf40df73421d0d9f4999084ef2b39f7505f20dfb55c2d3fd", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050902, "uuid": "577cd81f-d79a-44c0-a588-86e20c3991fe", "comment": "Malware payload", "value": "badd6038eff3e732907b55413cbc1e5033c0922f", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698050902, "uuid": "02b47b96-fe35-471c-9eb9-b569d7c5faa8", "comment": "Malware payload", "value": "527525e06952d797057677c7e1b24264a6113d61e123c6b9ba8ca76690d4eb075bbc3672b84a64dc4f4b41e3b0020a5d", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050902, "uuid": "3ea28583-d55f-46be-b912-4705b4ec9248", "value": "T1D9E423A64FE71A10BA4F033CBC684AC2C213C7547C7681D2EE573F12968BA857975D8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050902, "uuid": "4f7621e5-063f-4ef1-850b-e79af60495a9", "value": "12288:RCkZkBn/RDoDzpP34sL5NAUG9hMToqq6A/rEbRT+68BRymYIUK82YqX4H8XU:RCkZkFRWdbJG3tqq6MCdCRvd98U4H/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698050902, "uuid": "3c7e5c83-3550-4509-a3a5-bd4b3b988f3d", "value": 676433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698050902, "uuid": "99256386-7ae4-47d4-b8b4-06d840252526", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698050902, "uuid": "ebd89773-bc9d-41b5-8c83-d85ade406e5a", "value": "PROFORMA INVOICE.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa12761-71ce-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698084025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084025, "uuid": "08a62b3c-4756-4940-a05d-661e3565a1e6", "comment": "Malware payload (RedLineStealer)", "value": "43f9796b60642430d7dfc4567f1a6681", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084025, "uuid": "4f569c2e-a7d6-4eca-9fb1-70fa49a0e150", "comment": "Malware payload (RedLineStealer)", "value": "bcd6049754df54d8d9d7ee272b934db97400e53e719b1970afd6e4b5bb7fde61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084025, "uuid": "b926a049-37aa-4d51-a1eb-c7ebe53143b0", "comment": "Malware payload (RedLineStealer)", "value": "87576f4d876ef911fcc35831a700b17b6bc3316b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084025, "uuid": "c167c9e9-5b41-4df6-b5de-4385946183e3", "comment": "Malware payload (RedLineStealer)", "value": "97351de7de5ad4bba5d71e46688d00a65364ca36ba5cb655c7c612cd96152db6c593dbe0dd3f6fae7816306a72363013", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084025, "uuid": "1f7b720a-5c2d-42c7-88f7-f448e2b4896c", "value": "T128852302F9D98071D4B013B13DFA17D322763D848EB857BB1044E89B59B2799AA7633F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084025, "uuid": "15eced80-bd94-42ec-8a2d-b2823266d57a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084025, "uuid": "e63acae0-71f6-41ad-89f2-99f3b34e80a1", "value": "49152:qYoTlqDzTfgGiY20x6JzVqgmJ/IYqmayAgz:fo5qPTfZiPO6vqgmJ/nak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698084025, "uuid": "6f43aaf9-6c94-4f41-b5ff-1c1a64d25f45", "value": 1766400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698084025, "uuid": "1e5ee81f-c30c-4e9b-86ba-de8b69a80a85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084025, "uuid": "1e6ddf71-fe8f-4db5-a892-1007359d9d40", "value": "43f9796b60642430d7dfc4567f1a6681.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ea5946-7187-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698053683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053683, "uuid": "0d36351b-1f67-4ec3-af45-3c04276c71b2", "comment": "Malware payload (AgentTesla)", "value": "bb8ce37cb22c0a4612de8eb18ff149e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053683, "uuid": "09283a07-8d82-449a-b8c9-6eb9815a1307", "comment": "Malware payload (AgentTesla)", "value": "bd277cc3bc8b85f61276d9d3d175a9cac0d492f5d12e125f8576abc3fad84e7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053683, "uuid": "219cbf24-c146-4df8-b5a0-2bd4cfc4d5e4", "comment": "Malware payload (AgentTesla)", "value": "a335f9e173bb8585d9a4cf20e4e63969b01adea3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053683, "uuid": "2deba4dc-2be9-4dc0-b29d-3360a9f293e6", "comment": "Malware payload (AgentTesla)", "value": "a5bf5f00fbc116dd1fd892c372f714713121a849cf3dbe537223da6e83c6d9575aa188cc3cd690326e2ba2ab2f3330f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053683, "uuid": "f1175b21-52ee-4a4a-adbd-112079a96599", "value": "T13EE4339D9B307FAA45BC063FCABCD4492691578B03BCA1EC412E59F717E10836E22D57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053683, "uuid": "77bcfeb1-98f7-4a75-996f-640e1ed843cf", "value": "12288:aFuiaHcEFkey4FzNBadIdKIgCaSK6jA3FuY90KEOFrgic4nUQU0BIh75:Quia8EFkeBBMlR4vA3FuYOKEOxgi1UQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698053683, "uuid": "78b4146f-6e5b-4682-8b25-18445d01198d", "value": 657374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698053683, "uuid": "a668fa03-28ec-4f20-8a32-f97bdeac52c9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053683, "uuid": "73879e81-d7ff-4a1b-898f-dad595d4a063", "value": "SOA pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77aa7934-71b9-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698075188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075188, "uuid": "7a09c2d4-dc8a-4df7-b9c3-4c5c80a223c6", "comment": "Malware payload (MarsStealer)", "value": "4f534315af7606bace395b502486911d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075188, "uuid": "20425057-fffd-4ff5-827b-453303aae412", "comment": "Malware payload (MarsStealer)", "value": "bd4f2112c8555f34e4f11805e37895615d3212e9cb3b118611399071b8cda156", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075188, "uuid": "d9254cee-f090-4985-9009-bdb714d92473", "comment": "Malware payload (MarsStealer)", "value": "079ffa41d325415b860176c7c3c82ccd2982298c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075188, "uuid": "831c14c0-386b-4312-b3b0-4b360e298afd", "comment": "Malware payload (MarsStealer)", "value": "586e819ec98e9be2ff12292d688a3cfaba469b1c3dd02af8f03995f720dbd4332737d93377c662a2a7735bb4c8bbcd1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075188, "uuid": "4bf64025-7d50-4998-b667-266e0f4c7e92", "value": "T12C650613A1CE8D36E33E35386AF701B448983D80B664A8467FD87ECB0721A7965DD35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075188, "uuid": "ab1acd91-ffe8-42f0-b16f-dfc45f87d10a", "value": "f5fcef2eacb86c1adad598b65c67a3ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075188, "uuid": "7e5305bf-8f6e-45b7-8187-d5b5007ebb49", "value": "12288:bRgcdrhCHwfbv7rHMUtXe44LzyneLtxn+9WXH3ML:bmqewfbv7IwOlLzyneLtxmWXH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698075188, "uuid": "16a4efd5-377b-49d3-821a-43ea5c0da906", "value": 1433088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698075188, "uuid": "d6f8f4f8-8b4f-4a5f-9664-6e09ba8d0189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075188, "uuid": "6e4c7197-7201-41d5-a4ff-12dd3f3f32ee", "value": "SecuriteInfo.com.Win32.PWSX-gen.1876.13047", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd5c073-71c8-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698081483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081483, "uuid": "074054ee-9750-4843-8e5b-aa6bce9813bb", "comment": "Malware payload (Stealc)", "value": "bbc415a3561feb571eff62fa56af570a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081483, "uuid": "cb63e8e2-7139-409d-8ba8-7c1be873b4ff", "comment": "Malware payload (Stealc)", "value": "be0f8bea0bdf21c3ae70c3786c42427a6365882cd37d403a80d15f7615240702", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081483, "uuid": "9dac0a53-d4b1-41ab-bce8-768d14b1592f", "comment": "Malware payload (Stealc)", "value": "823fa765e59fb46056856f7956ee36f8d5e64283", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698081483, "uuid": "1268430f-9635-4c34-a969-53e95c02b314", "comment": "Malware payload (Stealc)", "value": "0cb8236dca84037853bfede094bc8903c69eb73fa5bdaba4d80090099c4c6b71c5fe0ccc64b6a84787a3e621a58eeee8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081483, "uuid": "12e5ae16-fe68-408a-b5a6-372884cbd8d6", "value": "T1C4449D12A291FC60D9564A318D2DF6E93A2EB8718F19E75732287F1F18701B1DBB3391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081483, "uuid": "9e6662e0-e369-4a34-9387-971c3b86a9e6", "value": "8c07249af3e9a51b651a1c99624861e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081483, "uuid": "89325ed0-f403-415b-b9ad-1e957c400bfc", "value": "3072:vwXAGQIBLRBOEhlj9xSNNmSobZlwQKD8zZkhVS14R5d8I/OPfrAV:81QIBL39hlj9xSNZqlwQPu/SEX/Ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698081483, "uuid": "63297e24-5b08-4d23-ba09-50f21685c1a3", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698081483, "uuid": "e963a4f9-2a41-4771-af47-a14340bef694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698081483, "uuid": "9983f09c-3296-41ae-ab6a-c839bb06f027", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fda0d44-716f-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1698043339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698043339, "uuid": "80d2ee38-5b74-4f0e-b3e4-b323cf824bf3", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "380ee9a587e65797b4ceca5871ef37a5", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698043339, "uuid": "e7fd3325-f787-4996-85c9-5262773ea987", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "bfb38f4b63cad4967ed1fb59263513a57b05fa16dd1daa66887128e169a4eb03", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698043339, "uuid": "03a0f8d0-c19c-4074-9859-a6aff2d87eb5", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "aff15c787ee6fb8765730aec417bbc0a1751c4bc", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698043339, "uuid": "fdd097d3-4020-4a19-b6f6-cd0836d585cc", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "179e93831572e361ca45d7ef280af99514e42b9eece33225817d34767fbb157a030739506f6604c18862fcf14086536d", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698043339, "uuid": "26edd7a4-60eb-4df2-aa23-ab726833dfbb", "value": "T15E7523A7A7E84033CD6017B150F612872A767CB58D38125A1B99ED0F5E733C0B97276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698043339, "uuid": "581f5e41-e12a-4ea7-bcdf-c71599777c39", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698043339, "uuid": "a3198a30-5885-4306-a5ee-608034f29eff", "value": "24576:zyz3oBK18C/qnEE2+rj+RIYtLip+FxSLjps0eRcmMZ/wQR4:GzB8CVH40tOpqIJbZIQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698043339, "uuid": "7210c203-4b6e-4efd-98b1-eb943cd5019f", "value": 1591808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698043339, "uuid": "8654c400-17c1-452c-93df-63c9ebe28d03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698043339, "uuid": "2e6d3f64-aa4d-4438-8c31-39323240d750", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ccb5f20-71cd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698083760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083760, "uuid": "50b27328-2b10-47c4-84aa-6b2b828db21a", "comment": "Malware payload", "value": "43adc7314c0024e9d178f4d253041a11", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083760, "uuid": "d4f5c7c0-746d-481a-81b0-7d070853537e", "comment": "Malware payload", "value": "bfbb98db537fe8087d974d010f9a31369d755923b3eebffb1658af396769ff2d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083760, "uuid": "3908378d-577b-4406-b32f-9ec8e0cbc6db", "comment": "Malware payload", "value": "592938d9403a603df3a3c1aaf2c095516788e424", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698083760, "uuid": "099593d0-9bf4-4f3d-a471-313bb08d884d", "comment": "Malware payload", "value": "8a3f694e622fb99f81ff0c7e99118d7e8346ac89d98e9445393d62113807e3e624b84fa57677ee76fbf6d612d92f0a95", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083760, "uuid": "19594670-8448-4329-bffb-a29b6ecfd28a", "value": "T12985F167A3F0C873D1329938CC8A92D8C96B7E207D188CA669F83C8E5FB55C4395B153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083760, "uuid": "508bd141-d31d-48ce-b1d4-be46153f75cd", "value": "b6d4286731e04bdb13f3b9f51263b47f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083760, "uuid": "26db856b-3d78-4a67-81ad-54d0f65f6682", "value": "24576:XkBHomD+FDtdfE222kxVoy+OQp6DjasufyJIZlnLxGgVzwmDi1ETNay76nBWWnms:XjFDnE22efn513VzrunXxNeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698083760, "uuid": "ec1d22b3-821d-4f2f-904b-2dcff8934516", "value": 1714176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698083760, "uuid": "9627696d-8864-4f9d-9fc5-61792c926680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698083760, "uuid": "9be9949a-b126-4907-99a0-6a5a479a37b8", "value": "BCC0174237 DRAFT BL.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85176de3-71d8-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698088525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698088525, "uuid": "c5dcf343-41f5-4b08-a5de-024c0a63f74a", "comment": "Malware payload (Amadey)", "value": "036da5008bc5b80babd8769d15e71df2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698088525, "uuid": "853bf8ee-eff8-44af-9de2-f5a024c39118", "comment": "Malware payload (Amadey)", "value": "c0b315c6bdf1a347016aae16ba26417560e7cee805d22bc44676bea4017059f2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698088525, "uuid": "1117d9ee-f969-4099-aa16-a0796c9783f4", "comment": "Malware payload (Amadey)", "value": "73246b80679e22bcb5799067d4d4a8ab0d671d97", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698088525, "uuid": "e9d59bb7-fc7f-4583-a9ee-c80accb26fc9", "comment": "Malware payload (Amadey)", "value": "de5dd7fbf0b64821e0d3974444b3f28088ed42c251ade0bf5675cfc001d4bacf6caa10d63d172a66cd6449eb17ec22fc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698088525, "uuid": "93c5c2a2-2155-4d3e-bdfc-a0ea78bb47d2", "value": "T107852313B3EA94F2D0646B3058F705871A367D20D4AA83FA2B1BBDAC09716E97131777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698088525, "uuid": "e7f348ad-3bc6-46f2-992b-5e7ff1406f2f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698088525, "uuid": "01598a2c-3ba4-46ac-9fed-af5795093937", "value": "49152:I0N6zTP0DQoJTUQrIbk5dN6WOQZnYxSKi:76zTihmN4/jpYxSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698088525, "uuid": "157aefd8-1b9c-441c-9a7e-27c7aed7d821", "value": 1753600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698088525, "uuid": "5eca4560-485e-420b-bc75-25d93f8112fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698088525, "uuid": "55555ec8-3344-471e-b955-7861f46896c3", "value": "036da5008bc5b80babd8769d15e71df2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f12abbff-71fe-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698105027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698105027, "uuid": "2cbaccf5-6dee-480b-882e-dd92a7334644", "comment": "Malware payload (Amadey)", "value": "b9779f6115b4791f663215edadc0a199", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698105027, "uuid": "c527dfb4-1308-4e5a-9a93-709924e7859e", "comment": "Malware payload (Amadey)", "value": "c0f0a1b32474550eb720cc582f6b0af28a7135c52167234a102631528d331b14", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698105027, "uuid": "aad53dec-bfdd-495b-9898-468b979ee42e", "comment": "Malware payload (Amadey)", "value": "3ee21a4656ac52cda1f6e2233150066a66d4ae51", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698105027, "uuid": "563d5d3e-df99-4bdf-8f37-6edaed0e30fe", "comment": "Malware payload (Amadey)", "value": "f4a802a837856dbefe3a96deaa2a059c3cd7c1857c52466ff317a9d0b3a4573387f6d92bbd73f31e750c2e18061f68e7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698105027, "uuid": "fe1162db-4096-4fbb-8d7a-3c5086a98d9e", "value": "T178F3BE5575C0C4B2D97719360930EBB09AFEF9300E24AEEF63D8567A4F302D18A39967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698105027, "uuid": "c0be3e52-713d-464c-b741-1b40a092394e", "value": "993e953762ca135b10079a743060f9c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698105027, "uuid": "00d50d8d-2240-4f5e-b09f-6074a803a581", "value": "3072:AlLIbygBQPsQ6gty6VpdpA6JaIUgUBZKJHzlo3bNNzxfff4HiKRit5hftZl:DygBQ0x6VpdpNJCggdBxehRiPhftZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698105027, "uuid": "fb4c2ec4-e2ad-494e-b35c-c7e9af88aafb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698105027, "uuid": "897d3da1-c991-4407-8a7c-676c98ead18f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698105027, "uuid": "b1027b7c-ac5c-4218-adc5-479d5f882e9d", "value": "B9779F6115B4791F663215EDADC0A199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814be196-71df-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698091525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698091525, "uuid": "9a587524-ac7f-4a1d-9023-929f4d5cd1ff", "comment": "Malware payload (RedLineStealer)", "value": "cb490c451ee97a3de8a343a7b4df47db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698091525, "uuid": "030c7e58-ba6c-45a0-b206-941648f344f8", "comment": "Malware payload (RedLineStealer)", "value": "c1b1baf8bd98fcbe65d2ee65c7b785ebcec1f063b286bc34d2da8be7e04510c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698091525, "uuid": "aa3c9163-864f-491d-a357-9432a02bf9c8", "comment": "Malware payload (RedLineStealer)", "value": "616103b427df0214ad00619adb0be0b2d49edb21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698091525, "uuid": "2395ffc5-da0f-4662-82fb-150ed467092d", "comment": "Malware payload (RedLineStealer)", "value": "b4cfe34848041563493ca571fd03c6f9d4f2bc3fa137190de86e8bbce9df089368331cd438bcae688ffd6d828e4b6c05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698091525, "uuid": "f802ce6e-581e-44df-8e44-2a7c8b13ce31", "value": "T18675231297E915A6D9B1237128FB13530F31FDA28CB8D78F1A81A90E4CF3A91A531777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698091525, "uuid": "7a6e98a1-82e6-4ec7-8a01-567f02e0c817", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698091525, "uuid": "94e60266-b592-469b-ae3a-7b962f965340", "value": "24576:AyqWahCYoo+ET6NptOiHZZl1AtPuVsyOmVua7iEGKodh14BKVAEuSMislju4NW:HbadZJTIuiHNCyhVxiEcEcluFtjNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698091525, "uuid": "70afbea2-5652-40d3-910e-08a55fdb1d89", "value": 1587712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698091525, "uuid": "2bcf371f-10e6-41e3-a824-c69074672e0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698091525, "uuid": "58ab768e-0170-4bc6-8c5f-f0235b2f065f", "value": "cb490c451ee97a3de8a343a7b4df47db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f47fa9-7162-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698037920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037920, "uuid": "e8b031c1-263f-4446-99b6-7791d440eee0", "comment": "Malware payload (Stealc)", "value": "59ac0ffcc98ee8db55a1142eb66368ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037920, "uuid": "9f7f51e4-fee6-4812-bff4-264af2b107b2", "comment": "Malware payload (Stealc)", "value": "c39d4eaa9c88e613dd22b7e8704a584275dd0cd542d3225d4b4f16807f8307b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037920, "uuid": "4fa38505-4114-477f-95b5-47ab3dfba171", "comment": "Malware payload (Stealc)", "value": "6e035877d4a5a21e0dfc2c5d87df621fcd496dbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037920, "uuid": "56a994eb-85b2-4ddb-87d2-14095e46d83c", "comment": "Malware payload (Stealc)", "value": "78d8fab20ab8a304a33adb9b307ee5894ce09773499f219ebd45ff80ee37ffb7c6bde959723e299b076b7c9eab132f93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037920, "uuid": "6a008cb5-126f-4972-913e-921fcac542b2", "value": "T1FD448D03A6D1FCA0D9164A718D2DF5E87A6EB8708E19E7D733186F6F1870172D2A3391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037920, "uuid": "d6fc174c-db1e-44da-a287-aaf78a3eb6ad", "value": "3dc5fd248fcafa52ac5c2283ccf28cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037920, "uuid": "4087bdf5-95e9-4038-a729-ade36151fce6", "value": "3072:UwXq+0Dm7LKxOOfGKahsR71RD8yXgNrrfRu0iXOQMUVGZl25UcrA5tfrvr:hr0Dm7LCrfG/sRbiFrfcGQMUQ/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698037920, "uuid": "b9151605-02b4-4cba-8ccb-767df2b6a7db", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698037920, "uuid": "da8b8568-c336-4ce5-9d07-bc39c4dafdb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037920, "uuid": "de5f0619-14a7-43f1-a24d-da369e9c58ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a592698-7161-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698037289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037289, "uuid": "82e235eb-3852-4bc3-bf4a-1f2477cc1bb8", "comment": "Malware payload (Mirai)", "value": "0ec37600ced82ca96cff555bb884c8c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037289, "uuid": "4479a08d-e1f4-4fec-956e-c5adb9f7a68d", "comment": "Malware payload (Mirai)", "value": "c3e035805a08c6bd182ce5ffe459b047ab4dc0446c5dbba584e3b3315c185198", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037289, "uuid": "b2d12f24-7741-478a-86fe-6cb182a870f6", "comment": "Malware payload (Mirai)", "value": "b635552d5eb375e5cd4cb5e67c3ae4ad19cfb7dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037289, "uuid": "ff003ea5-cc73-4213-b914-c6a2e153d99f", "comment": "Malware payload (Mirai)", "value": "9e52bd3ae23e0798a4322bee61acf3a9a97264e336f97468c70b35785ed3227149648943cb7c69d6d63de1a73b0df6be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037289, "uuid": "37295b49-03f8-48e9-84eb-620106a0e5a9", "value": "T13E82DF3061AB75E5CBE10431EEEECEC6971A0BF8D0FC36D216587B78894210625F93CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037289, "uuid": "0fb60941-2269-4f38-972b-850c92c68151", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMa7hymdGUop5h5la:2dV0P6+kom0tVAoNvm+to17s3Uoznla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698037289, "uuid": "4d3379c3-0e60-4c12-be51-049a8ac86964", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698037289, "uuid": "f8244b15-84f2-4245-9f35-a6eeabce2c77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037289, "uuid": "fd541b40-64f7-45e7-a49b-4e2c7d9a07ef", "value": "0ec37600ced82ca96cff555bb884c8c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb1266a-7156-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698032701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032701, "uuid": "adf3acc1-038f-49ac-acee-9583edcc25db", "comment": "Malware payload", "value": "fc9d492f106f17967b23d4f0926c9b2a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032701, "uuid": "c2c57c3e-12af-4d55-b786-bc1b87688747", "comment": "Malware payload", "value": "c43ac8b3393bec98aeae1c09f84e2c304192c0cb86fdc53e36afe67b8985854c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032701, "uuid": "9b3ca980-e45b-4bce-928c-f47c264ced8e", "comment": "Malware payload", "value": "47ada06457a2fcd21244079916ae73c8baead48d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698032701, "uuid": "c361b033-46fd-4294-ab79-b54b1f203f87", "comment": "Malware payload", "value": "05186803ba9f14bc1dbac10925a729e5ba8480c8da5d78668e327674f3827b5efa71ca692a2b67012736346bc294bcf0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698032701, "uuid": "61948dc2-30bd-4430-9e6e-78672f4cb8d5", "value": "T1A06497B9A037EE8AD7370980D1403E579C198EDF6A7847F8778801D5C1AC68C9AE75F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698032701, "uuid": "0441f461-dce6-4d11-85a9-8abc2bf8f013", "value": "3072:oW39gW8qTWr4jZaeh8tC+DD88C8kerLPfUh0HlmH6tFLMm4DMoGDBVDuXV/AkCsF:x1K42tC+jPMWHlk/ZSH0svW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698032701, "uuid": "3c281466-b502-4e71-8f24-a897f79db6e5", "value": 322904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698032701, "uuid": "34a2d476-fa6c-48f6-b3a9-0309efb4ee10", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698032701, "uuid": "9fea99aa-227c-4045-8d79-97df72d7be96", "value": "b2b38c5ce36b2bd578abc469186fad5321138b660b7ec92bca604e4a.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cb12cf-71a0-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698064293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698064293, "uuid": "1f86f304-22e2-4906-9aa5-f78b925345e3", "comment": "Malware payload (Formbook)", "value": "14019875c2525c92b5c7fcfddd2a0308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698064293, "uuid": "7db3c377-7a2d-4c6d-94f3-88e3ba66b423", "comment": "Malware payload (Formbook)", "value": "c5bf13f324052f8e3240024494c7c4bf809e3c423a59fabd0cd067e01a990ee6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698064293, "uuid": "83af5f05-933f-4d53-b3fe-0f98d2ca5c51", "comment": "Malware payload (Formbook)", "value": "90b0334b31ae7c3ef26c16cfb303d26f50095942", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698064293, "uuid": "df0b86a2-05f3-448c-b936-f52d4e13848e", "comment": "Malware payload (Formbook)", "value": "e036335fa686bba101cc2d672273ca67781817809ddeead54628e42d9a19d91ff2a16395ce9cb4c5b76860c3f8f9717a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698064293, "uuid": "fb93ac09-d921-4d04-99ac-ff435655e37a", "value": "T1D765A503BA9789A1D1593737C5EF083007A4E9897623F69A758F236918433B66F4DF0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698064293, "uuid": "47bd2492-57e1-4153-9d1a-db3445180df3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698064293, "uuid": "574a8b05-33fa-493b-8b02-78b90204c410", "value": "24576:XEeTWMwg0mgNM6X/jTuX0l6GD1jckQ6Qr6owgK:UjbmijQ6Qr6oS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698064293, "uuid": "96542168-3988-47e4-9f97-d61006610c0a", "value": 1492992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698064293, "uuid": "5bf1ece3-491c-47d9-a529-86ad16af4380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698064293, "uuid": "20c750d0-86a2-44b7-a22a-1d4a72ff25bd", "value": "SecuriteInfo.com.Win32.CrypterX-gen.18668.4514", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d3f35b-71be-11ee-8907-42010a9c0042", "comment": "Malware payload (NetSupport)", "timestamp": 1698077272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077272, "uuid": "2e4f6b1a-80d9-4e0b-8389-ba39e0e0295b", "comment": "Malware payload (NetSupport)", "value": "1db10366ab5ca75cdf831099fe6ed83d", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077272, "uuid": "a50c31f4-cbbd-4c76-8263-f344d9d9f8ed", "comment": "Malware payload (NetSupport)", "value": "c5c974b3315602ffaab9066aeaac3a55510db469b483cb85f6c591e948d16cfe", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077272, "uuid": "93b92ba9-1c4d-4169-ac9e-a47ac252bf74", "comment": "Malware payload (NetSupport)", "value": "247f1ad72bfcce39b4393abf205cd58eb06d5cd7", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077272, "uuid": "f8c34665-8377-4319-8f17-616fc4fcafb9", "comment": "Malware payload (NetSupport)", "value": "e53e8ab478e4a9d2ed4803b5d75853bb8154dc5b6a3e58ace2850445eb59374934fd8ca265198e43c382eb86f56759fe", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077272, "uuid": "9d5fcee9-53f1-4cf0-983d-651d6b42aefd", "value": "T1DFC533526A83F7A7C0E2F1BBE0ACAC162E1D646CE4FB36A7093E64A3E535451C47F411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077272, "uuid": "cd36daf5-ef13-4865-aba0-a731b16dfa37", "value": "49152:UuU1Zl8lAQumelDlEDThXBJOhHLw6J6h2SFFGf0RBNTQfYc9jh23eWeB3/YSBm7N:PU1Il7/FXamhRFY89YYc9jh23redpmQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698077272, "uuid": "d58639f0-a2dc-4305-b53e-f6f8cec54340", "value": 2535356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698077272, "uuid": "e84205f2-1229-4d90-a08a-b03a1424e95b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077272, "uuid": "66fd688a-337b-434d-8236-95bb4b850782", "value": "p.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476ae230-719d-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698063081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063081, "uuid": "e04a130e-973a-42cd-aa85-bcb0a7ab5abe", "comment": "Malware payload (Smoke Loader)", "value": "2722fd6acdbf594cefb5af67ed83828f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063081, "uuid": "4f15269b-913f-46eb-a150-c9f812313a47", "comment": "Malware payload (Smoke Loader)", "value": "c6d732d8b01afa98d6bf5012c45309107f9866e63aaf7351a35240a945a20925", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063081, "uuid": "e75b8862-031a-4635-a2dd-8d01681e8e05", "comment": "Malware payload (Smoke Loader)", "value": "15ea81196eafa09d8c709cd82d73800ce6a61937", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063081, "uuid": "617709ea-2964-45e6-8309-0decb35ec1eb", "comment": "Malware payload (Smoke Loader)", "value": "e64abb19a9a491ee1771c7cc67ba26739c4d0c8c2cbeb7f61961ca1662b5abd3e5ba4d31cbf678657142015b10a578bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063081, "uuid": "c6ca8067-a5b3-40ff-bfcc-d04dde3e1270", "value": "T1D1850B1176F95B59F9F30FB85ABAA611487AFC6ACF11C2DF1250908E0D21BD09970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063081, "uuid": "7a6ca726-c617-4068-90ba-93307edbda4a", "value": "037522269f8348aa17add864631a3f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063081, "uuid": "5aa8112e-44b9-4c1c-b8ef-d472770757ca", "value": "24576:grEAfSKqe7E9xndPWNK6a9Dhvhqx7NoI:gnqe7E9/WQ6a3vQNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698063081, "uuid": "2d350a9a-7402-4c1a-9929-286b31089e0c", "value": 1724416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698063081, "uuid": "df5a30ac-da7e-4604-a504-7786cade3ad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063081, "uuid": "b8b1c66f-cbee-4d52-ba85-0319fdcf07de", "value": "2722fd6acdbf594cefb5af67ed83828f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2118749-7161-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698037598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037598, "uuid": "75790e42-bb01-450b-845d-02d5fa9b9c7d", "comment": "Malware payload (Mirai)", "value": "d628122ecd3e5d61987fc68c0c182ca9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037598, "uuid": "bba238bd-9884-4232-92f6-fbabe67e3a16", "comment": "Malware payload (Mirai)", "value": "c7681d3c481e62d02fcfc59c47c4b32104e9eb482f21b5089a8b1b382b65e272", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037598, "uuid": "8977a40e-c46c-4dd2-a483-60af49505a5b", "comment": "Malware payload (Mirai)", "value": "9103d7dda66f8852c8a01db059f8f8ac9ab21cd4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698037598, "uuid": "1cec9038-50b6-4161-9cba-71708ce9191b", "comment": "Malware payload (Mirai)", "value": "8e3907d946fafd16d7f932f40e20d7b1f61d7d242819be34dbde1bdebe443951b40600312744c5422780e1c4a2c6375b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037598, "uuid": "1e0dcdc2-9711-4692-b95a-59082239b921", "value": "T149B39CDBF24702A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037598, "uuid": "37c21211-377b-4e65-b529-9dfbd71de573", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1u/LWy:c9sSyzz36YaWWgg1uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698037598, "uuid": "935730eb-927c-44d8-9b1a-5c8d474a7d00", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698037598, "uuid": "16ee367f-661e-4adb-9cae-49e77bd80cb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698037598, "uuid": "963e84b8-1ad1-4f38-ae13-b98288547d98", "value": "d628122ecd3e5d61987fc68c0c182ca9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac16201b-719d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698063250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063250, "uuid": "693c816b-7c04-47e9-899a-a4e9211368fb", "comment": "Malware payload (AgentTesla)", "value": "f6e0a5f3785ca9b65cc4cc8733857736", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063250, "uuid": "59cf6bc1-cad8-4502-b3b5-636a1d0bbca2", "comment": "Malware payload (AgentTesla)", "value": "c8355f7c0b02898b75867bea05b5b23a2ec6ba111e5e6f36516efa6a92232e56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063250, "uuid": "503fd130-f747-46ab-aa2a-9fbdafbb1451", "comment": "Malware payload (AgentTesla)", "value": "2e4b8f18bad958cf46713222cd5016851b0a9453", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698063250, "uuid": "e17465af-2229-4d86-86b3-55fbb6536871", "comment": "Malware payload (AgentTesla)", "value": "e01e08a03d13e306a1ee14cdc326cf2798c243e46d85fb7cf83388d24113e2bbf89105733a0605caeb2e8089acfdfca8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063250, "uuid": "21806490-ccac-4ff4-8fa4-e7cfb1a62589", "value": "T1F145316C48B85913C561E07EDFE8EE23B1808CDAA14C9C9A87C55F495A23637B09FD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063250, "uuid": "c2b2e6f3-4066-434c-be5f-e8ff878f17f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063250, "uuid": "c906dbec-62b0-424d-849b-9e6ea5f5d45b", "value": "12288:lF6oXvHck20swaywUDvoRVMCdkpxhUZFjahggyOLRHxYcJ4/xnPy:D6SvHVbswaLUMRuCdk5UzYkO9HxrJwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698063250, "uuid": "296cf3b4-08ad-4365-91c7-6570e5d45c8e", "value": 1277952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698063250, "uuid": "1b101933-7cac-4add-afa4-af8e85245d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698063250, "uuid": "6de84fe1-8012-4545-a68e-8b627e79e996", "value": "IgmFZPRG8ldeeNb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74460ab5-718b-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698055426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055426, "uuid": "4eea2e12-3753-40e2-baa8-2ce033b413a5", "comment": "Malware payload (Stealc)", "value": "a3361fa95f0289a22276bae7c14a3a43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055426, "uuid": "17c83d34-dcb0-4a49-aa08-a396888fc144", "comment": "Malware payload (Stealc)", "value": "c85f912d0c565500a58ed2251222c81165a2a9a876610c80184a70fe68411e11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055426, "uuid": "35be656c-c76c-450e-ad74-a5b0b8b3a07c", "comment": "Malware payload (Stealc)", "value": "fc34b73175e335d780b3f1b06691b39e38ee9492", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055426, "uuid": "56a0ce6c-d4f1-466b-bbb9-0d9655af8280", "comment": "Malware payload (Stealc)", "value": "49e413a35456b968827f5c81c42ae3af8e1596cc20b5aea9a57c0ba4d35b5026af6e33c12c2de53120cc011d7a899110", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055426, "uuid": "03ef4013-965c-464e-87d4-67c0d4c3226c", "value": "T12A448E03A3D1AD60DA5646718D2DF6E83A3EF8718F59E75733187F2F18702A2D263291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055426, "uuid": "1e18197c-f7ae-413a-a717-a6e19a0facb2", "value": "83ea5da75a27345768c26298d1e8b469", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055426, "uuid": "65857011-fcd9-4b39-aa7e-915fab5114c8", "value": "3072:0wX2yAjDLufORAtw2Zqj+LgZ0xO+FT/gdjzNZfM9melWLB8p7F35MEKULfrA2:B7AjDL0cAYSLtxBFTGvNZErlSsGEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698055426, "uuid": "21bfa51a-cbd3-4af0-8461-af0b40f0419c", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698055426, "uuid": "a61b655f-2b46-495e-9362-ddbd5620eb7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055426, "uuid": "ff39b7c9-6f69-4235-a0e4-8f31b604086c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41dd705-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042728, "uuid": "a22a5378-f6c9-4db3-968d-c9663acad0f0", "comment": "Malware payload", "value": "457ecc396e2cc6197c223db2ffb03ba3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042728, "uuid": "139039b2-c724-440c-a951-607406ea2e39", "comment": "Malware payload", "value": "c88c58790c769627bf83eb570328100f236535e4cb11af257a3d9870fbf4b927", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042728, "uuid": "246d0250-02ff-40d4-af36-493598571858", "comment": "Malware payload", "value": "36f3ba50a5607b0a8987f86e320f8977292cb750", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042728, "uuid": "f4e6709e-d53d-4b1a-b13f-716afd9402e8", "comment": "Malware payload", "value": "d9b41365cdb809f5b80feeaa30874dec583ad13559433f9ddc4fb9bc4c95a49e1aab0d8804fae577dfa6ed1985b1cefc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042728, "uuid": "c8f3cfa8-be1b-4293-8164-22bbcb378f41", "value": "T11D44178D79728067DCCC0DB428F7DAB4FA2BB81F5C62DA3BA5D5630D1AB61711E058B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042728, "uuid": "a71475df-a06d-4753-b39c-e2519a9794a3", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042728, "uuid": "db0f7525-c952-40cc-9ad7-e2aae5061bfe", "value": "3072:0HDp7pRuKjsir5HZFQGrsUwF7hplPoutjgsFF0YMR/12RAwuo8bJgperiJc8zF:+RR5rhZFQGrsUwF7vlPoSfM7E4rij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042728, "uuid": "8cb8208f-8dde-47b2-a950-af2a2190adb8", "value": 277983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042728, "uuid": "4d643997-4927-4905-bf56-3f9e9f29888d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042728, "uuid": "8a610b61-543d-41f3-9f13-6886a14bb214", "value": "SecuriteInfo.com.W32.Agent.CE13.tr.31153.19741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0684ff6-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1698057647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057647, "uuid": "940033ea-5c19-4ae9-b76b-8efa35512af0", "comment": "Malware payload (Loki)", "value": "71169a059f615b9522cd08d681f97650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057647, "uuid": "cfab4f1c-e860-4e4e-9ab2-8ec3a09d4916", "comment": "Malware payload (Loki)", "value": "c8c6e979a74449aa456da5161a158ea813d006ef6d7d87bec938591f56d6d041", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057647, "uuid": "a3df4f24-455a-42f4-9952-02bd9cb310c1", "comment": "Malware payload (Loki)", "value": "969af939812f3c7e577c544f5ee93bfe46652f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057647, "uuid": "92433df3-ddba-4a58-a45e-b6761382d97d", "comment": "Malware payload (Loki)", "value": "c4e135d9d49bec37f24926f16059f7681ed8352ea43c44426bb0dd9961b6f1abc8dbf83d398278ce83a580c4de241efd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057647, "uuid": "dac2e169-6628-407d-b16d-41f99fb70f13", "value": "T1F6E4CF46F6849258CC18A3B0B532CA7007577E6BBD72E45E6AC93E273FB35E20166847", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057647, "uuid": "d5dc0343-1ede-4340-b2ed-f1b7a67b7096", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057647, "uuid": "bce57a8a-33f0-428e-a345-1ebeb7074a96", "value": "12288:IoJGs6Il0T+MW/eL4QQs9R4wyuM6IbMIEQ8BsG77SQzNMbu3z1i:KeATO84QQOquM6IbMIEQ8BTPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057647, "uuid": "b8fcfef7-926e-46b7-8489-46744d891a84", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057647, "uuid": "912e16cb-23af-41d3-ad45-1e791c2b8896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057647, "uuid": "1bfc7497-6f4c-482c-b9b9-e52889c428fb", "value": "192_FACT.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31546669-715c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698035127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698035127, "uuid": "70defcdb-fc37-4a8a-a633-a41199c9b6c5", "comment": "Malware payload (RedLineStealer)", "value": "d068576689bf99cd6eb2d82566a0b1aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698035127, "uuid": "4c4d5597-7918-4600-901f-fa1ff17b08e7", "comment": "Malware payload (RedLineStealer)", "value": "c98217e69b3f1908e6ee2261af10e4e3716e27314ccb5afbf1b500ee9f32358c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698035127, "uuid": "1d9d3560-d07b-41e8-95ac-ad3c85facbe2", "comment": "Malware payload (RedLineStealer)", "value": "fea5ad660d7b2785ddd80c22332ab86970df3134", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698035127, "uuid": "cda7bd09-c967-48df-8d9c-3aa71f5d3cd3", "comment": "Malware payload (RedLineStealer)", "value": "b56d5ef72f169d8b9f22fce0f5c82d2873aea66b59f42aeb028edc30123f5fa6f9e69e0f11e55ca5bbafea42f61ef60a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698035127, "uuid": "bda8d13e-8920-481d-ba02-23c3175089a7", "value": "T100752346BBE480A3C87653F148F612C31631B9A21DB8029927D8EE5A5DF31D8A53773F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698035127, "uuid": "29f36d3a-452c-4358-9206-f89dda47e0e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698035127, "uuid": "fb7d8efc-746a-4678-98c4-e3fc9169d837", "value": "24576:myyvBQ2kerm1YQ4ffPkPlGjyxjYAkwDBdn8gnUUT6a5meSWSqqh2+6qDgY:1Hf34fksO9J9CKpoeSW1qhvdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698035127, "uuid": "2097c3ff-b245-42dc-8649-efee5c1367a6", "value": 1589248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698035127, "uuid": "cbe4b48e-a978-4bdd-ae8c-67e2cefc21bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698035127, "uuid": "e07c3fc9-056e-420a-a5b1-647ff8d5bb06", "value": "d068576689bf99cd6eb2d82566a0b1aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970108f7-71a9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698068369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068369, "uuid": "33c5aa10-0e6b-485a-b899-45381f0bac76", "comment": "Malware payload (AgentTesla)", "value": "822b964b935bee7da3502f7037942d92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068369, "uuid": "7ab47658-7b9a-4629-9468-84ec4bc105e8", "comment": "Malware payload (AgentTesla)", "value": "c99a75f50b78f5735845826a15174eb80db51ef3f4149847a03b69f5d631e52e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068369, "uuid": "7b727bbb-a75a-473b-9083-fe59c1c7bb7a", "comment": "Malware payload (AgentTesla)", "value": "373ad8abc6e2b58371fb8543d7ed4d5c8bdafb36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068369, "uuid": "3e566fa8-29b1-4157-94f2-d15cf7041f59", "comment": "Malware payload (AgentTesla)", "value": "6edf56c3e940063b448382b8176d1ee443c30d040c4eb285e0bcb63bf4d9aa2c71d18122be84285025160e0a9cb1f5d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068369, "uuid": "9c245b3e-e00f-4781-8e73-b2ab265bc7ad", "value": "T19AC433CBD0EF2C96AFBC3C887D715A8A06BD04A5060A040DDD34478E55D90D7AEE9B7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068369, "uuid": "9ecc3b09-c9d2-432b-9973-0c0a169ab225", "value": "12288:LtidniG9Nnr8aANHupJC9C3uRzSJhFCUhwoi8DhJiy7IJbH:LtE3NmNHupM9IukhBhxi+DiVJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698068369, "uuid": "0f5e193b-e769-4c3d-967c-1f90dbfb5c63", "value": 554445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698068369, "uuid": "89beb03a-367e-4bd4-a7c5-524ed233f1b1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068369, "uuid": "780c50f9-c488-4240-9df4-89216fd2d3b9", "value": "PAYMENT Route.pdf____________________________________________________________________.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6823591-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698057711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057711, "uuid": "6eb8a1f0-d95b-4284-b96f-948e2a11b615", "comment": "Malware payload (AgentTesla)", "value": "6c3d5c1bde732dd0a582ee1b3cd6b5de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057711, "uuid": "5a786a93-6f7e-4e5c-9dcc-3da25f36298b", "comment": "Malware payload (AgentTesla)", "value": "c9a3f7e3e41a741616eabd502cff20db67df4ea50e00f64d268ded9b0611509f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057711, "uuid": "7f650b50-6382-4300-804b-eca29fcc7980", "comment": "Malware payload (AgentTesla)", "value": "f8b6a95a000ed0a361583466506b3d9f7f387c59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057711, "uuid": "b5df3efb-4fc9-4441-bb62-c924c390b713", "comment": "Malware payload (AgentTesla)", "value": "c4eb64f4838e0ef157a8b33d2a19a8b46d9cc986bc59a3666b4d6e33a64813612522573638bde19cedd0e5311760fea2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057711, "uuid": "b76f35d0-aec0-4267-b02f-c72ec04133ce", "value": "T1BAB423FB6A50B5A24F82D848C3061E2395B6905DD47160F72E61EF4B6EE7731BFC2908", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057711, "uuid": "7e233e45-46cf-4b1b-9787-a9a7e6e94360", "value": "12288:h2Ppvoe5A1DoElcmrFBZze3XZY+sT5XwurRt6I3M1:hEvojDoUcmrFBBemHTBzrR8I81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057711, "uuid": "22c92d20-80d7-4651-b2f0-a21d057371cd", "value": 533579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057711, "uuid": "50b69b34-1056-43b0-a4fa-581f2967596d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057711, "uuid": "5002c2d9-69d3-4402-b044-2836db7523e6", "value": "NEW PO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ad88fc-7173-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698044984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698044984, "uuid": "1a60383e-f1aa-4534-93b0-6141806ccc77", "comment": "Malware payload (AgentTesla)", "value": "d14c7b3a566713cacfc46a254d172dc2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698044984, "uuid": "56f49027-2f1f-40cf-bbcb-1add50793015", "comment": "Malware payload (AgentTesla)", "value": "ca1700973f1813f91e8e0c3eb653a52af226bafa1479a6f22e68ffde3d9946a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698044984, "uuid": "ef7fe667-c26f-4441-9545-af4cf057a1e6", "comment": "Malware payload (AgentTesla)", "value": "a22cf6a68811d373b75cfcbb79e042c37f236d09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698044984, "uuid": "5c038036-a19a-4984-afe2-68cae9e06ef4", "comment": "Malware payload (AgentTesla)", "value": "17681664178f36a9406f178c86949dcefebfc123b90c4541df88bf67acb01c369263fd1ab0d78dccd1fe70439b34bda3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698044984, "uuid": "ee182e0f-995a-495a-a42e-a7fa3377a5b6", "value": "T12AE42352B258C777C61C5BFB48A055D843BA3E234203EBBF5E84B1D662B93126D38727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698044984, "uuid": "7f4392a2-7969-4c71-9462-efeaa0697181", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698044984, "uuid": "bbc6db46-0fba-4907-8523-a2aea6c78b5f", "value": "12288:Bb5yzvbYmBHuUv2t+MEbwtfD0VzAzcbcvcib1kA988ii+ekS2Zes:rebY0OUvbWDIzAzc4vcibNabU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698044984, "uuid": "d7c2526c-682d-4bec-9b42-ef49fd404a56", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698044984, "uuid": "0544becc-599a-4d8f-933c-1b51ccf6e1ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698044984, "uuid": "d834a1a3-7c7d-448d-be9d-c95d7927d067", "value": "purchases.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad6ec1a-71b1-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698071570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071570, "uuid": "485a4c95-ea36-4ce5-81b1-54ab210c566f", "comment": "Malware payload (Stealc)", "value": "96d9720281558a0ca3bcb2745154e084", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071570, "uuid": "fa0cd354-dca6-4212-b563-58a5fc4f29bf", "comment": "Malware payload (Stealc)", "value": "ca54737de1d00552533d1eb67a6bc2af75ccba06618337e265c1a76f0d65a8ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071570, "uuid": "974b565d-de87-41f2-aa7b-0fd666136861", "comment": "Malware payload (Stealc)", "value": "391a8266b03e235d699babd9c284bedf62bd4981", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071570, "uuid": "b37dc674-399e-440a-a376-53d97ed31eec", "comment": "Malware payload (Stealc)", "value": "c90266e36475ec2b0d48ec674ab667802f0911459d84c787b03df91a235356acc0ee74e7ad9bb031a5d3b23ed795a8a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071570, "uuid": "b170d72a-a0b6-4010-a736-e945746aec03", "value": "T1A5650613A1CE8D36E33E35386AF711B448983D80B664A8467FD87ECB0721A7965DD34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071570, "uuid": "7b5ce482-c022-4758-a1c7-246786d9440e", "value": "f5fcef2eacb86c1adad598b65c67a3ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071570, "uuid": "bda864ed-a469-41bb-b0f9-111f4c1d1dd2", "value": "12288:bRgcdrhCHwfbv7rHMUtXe44Lzyneztxn+9WXH3ML:bmqewfbv7IwOlLzyneztxmWXH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698071570, "uuid": "f2af52bf-26a1-43c8-a7fb-b6c752ce0511", "value": 1433088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698071570, "uuid": "dfff738f-a190-4ffc-98ce-7bd64f56ff58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071570, "uuid": "cf9752aa-33da-41d1-9696-72396263433a", "value": "SecuriteInfo.com.Backdoor.Win32.Yobdam.16899.6551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ef0996-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042738, "uuid": "986a1747-4b3f-4b6d-bb7c-27599253f773", "comment": "Malware payload", "value": "5e2dd2233dfcc87483b6742aa3d9b3a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042738, "uuid": "5c0e751c-f306-4232-88c6-0262f5755a56", "comment": "Malware payload", "value": "cabc29f57c88e828f67147e8d67473215772f8744addee1683c3b25ee9101779", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042738, "uuid": "ab9201f5-f3ac-4e17-b6fc-5035d0793c85", "comment": "Malware payload", "value": "56c1f1556e07bc0cc59e14e59797793d972e2979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042738, "uuid": "9cbecee2-8b7c-4b57-8c10-6563bd2d4187", "comment": "Malware payload", "value": "06e96b9324a76300b5608ecf2c0fd965aacabe0f1de7fd5700dca2b54451d44c2cb7802b8acee2ea8c2ec06581f4e40b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042738, "uuid": "96b5d54b-5c38-44eb-aafd-a5f5bbe58198", "value": "T1C7D48C15FEF281F1C71625310876A736AA35EA960B15CBC35364DE6C2F333A19E3A139", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042738, "uuid": "4986ff17-d1e7-4473-b69a-9c4ccc0a724d", "value": "0745a3f36502e64a56a6b6d1443d3d83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042738, "uuid": "485c5847-7f64-4528-942e-3bab1eb6a949", "value": "6144:ikBmVICdOyAjJ4BY4+UtRI8RcZzhYTc9cesjouYlciDj3hZsngDdJNe:iMmVEyiaBY4+gRrfZYldDjx6gDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042738, "uuid": "32fe8040-0a8b-4a4b-8735-ccd683afba6e", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042738, "uuid": "fd77f600-7380-4c7a-bef2-05494d933831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042738, "uuid": "a86095b4-5b5b-4955-9965-1f7e5e06f057", "value": "SecuriteInfo.com.Win32.Evo-gen.27782.17976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8da475-7158-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698033666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033666, "uuid": "e4f752f6-6e1c-4abb-89e0-f4fc8d78bfb2", "comment": "Malware payload", "value": "d0e4672c2b7dd01c67977ed55beb55ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033666, "uuid": "13a84d23-2b3e-4774-bdf5-4c8ecee12821", "comment": "Malware payload", "value": "cb6684dc48d7acf24ccf1d55a9680bf2bda27b7fc3e877b48046a42ef6cdb209", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033666, "uuid": "cb4408ec-d40f-4d8d-b14f-a45e7b12b747", "comment": "Malware payload", "value": "5f904dd8e3d9d9a332ef97b54e7b52bb94016d4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033666, "uuid": "cf567344-61f7-4dfc-8236-4280e6df0936", "comment": "Malware payload", "value": "4d4d1017402de05fb5ade199a3d414fb34a762b931e97f34e142e41b2304835776c498cf1b32d1bd0b11e76fe55a5463", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033666, "uuid": "0b0ac653-5d25-4ab3-81f4-74ab1865833e", "value": "T10A6476FAA036ED8A87370A80D1043F579C299EDF66B887F8778805D1C19C68C5DE75B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033666, "uuid": "7745ab70-535d-4a93-bd9a-94d3cd7ecafb", "value": "3072:C6pTrQ8R4zp0woqSQt5T43Y93W71NASv813+uFGspdEi/983AuR6YGzkufL2A5dM:BrGmV3Ca5vU3XQi1k6N7ToDQde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698033666, "uuid": "dd1cd6b1-9f39-4d8f-956e-fab58f7d01f1", "value": 330412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698033666, "uuid": "60125e21-a211-4dff-9097-c1bed720ebd8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033666, "uuid": "b367c416-65e9-4e85-8ce7-252de83b0e3d", "value": "39853c403daea404f2ff655665ead744b44bc1783f4731c430023a40.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a16539b-7188-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkGate)", "timestamp": 1698054147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054147, "uuid": "903c3c9d-3589-4082-928a-8c6ea0f03e23", "comment": "Malware payload (DarkGate)", "value": "74a98a70ed0a703d4c04c57c3fdc85f6", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054147, "uuid": "e7afca56-b3ab-42d4-b679-5ea8eeb2af20", "comment": "Malware payload (DarkGate)", "value": "cb685ba5b5e7bfe686839722d96ed6b9a13b95f61902d23f7b1e27632d569f9f", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054147, "uuid": "a1b38638-b00c-4f0c-89fb-0587e34d5264", "comment": "Malware payload (DarkGate)", "value": "1e2a1f0685687ed6f623efc8af6c5a9f4d9fd0f9", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698054147, "uuid": "f2fcc654-3932-4cd0-9ac6-27913d8178cf", "comment": "Malware payload (DarkGate)", "value": "4bf7e07774e0b57d88deee17f758517ed86d0ca60796a53ead2b73b76b5cdbe8685e90ebba936a068c5392f77225f605", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054147, "uuid": "9b8a22b1-5970-4680-98ad-816a89538d02", "value": "T145831271AED91AC889D31A9AF9EA2802173C68DC4086C936FC5C64877C4FBBDF34494C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054147, "uuid": "169d4fa4-190c-45c6-9201-2fb6f6702373", "value": "1536:Z47vqAQz6v7R1azJ9kwyuLEYx71IYjv0lQBu+CdIDOW3NfhZI7ZRv9VeCNl0WA+b:W7vHzqJ+Yx5HZ/pNfjI7ZRFVe0Ri7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698054147, "uuid": "5320a1da-b8ad-424f-8e22-2cb124f4cd0b", "value": 84496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698054147, "uuid": "5934aaf4-6d21-426c-99ad-86b6c077ef86", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698054147, "uuid": "bf8367d4-893c-4c84-b04b-df3a978aaaf4", "value": "fpti.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daec3b5e-719c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698062899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062899, "uuid": "a5935cb3-ddc5-4cfd-b31c-3585c7507ca5", "comment": "Malware payload (AgentTesla)", "value": "e5697f9b2a4c59cbaaee9cfe6c73f2ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062899, "uuid": "3cec03e3-92c1-4e0b-983b-52df578c6dd6", "comment": "Malware payload (AgentTesla)", "value": "cbc632ae3dd2c72c24bd2b4ab8e53ff56aa2e742911ec9512432f0788b104e3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062899, "uuid": "9a27f4bf-749e-4679-b5a5-c6903f7cbd6d", "comment": "Malware payload (AgentTesla)", "value": "c866795f199be45b87722fbf3108cc172a7f6ee8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062899, "uuid": "b8a713d3-8b07-4b78-8b01-337afa70758f", "comment": "Malware payload (AgentTesla)", "value": "0b97678338c2beff2c875045013274b5c477c46db3eefaddb3c237fed6b8fff69e75134dfeff415c0b6bb75662a05a81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062899, "uuid": "22410fa9-5ab3-4038-8977-39e39dfdfda1", "value": "T14A25E12C0CF809124161E19EDFD8EA57B2C08CD6664C9DA687C68F995A1393BF09FD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062899, "uuid": "3365d882-7e55-486b-9916-b4388df9958e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062899, "uuid": "cbc83cf6-06e6-43e2-a327-b9119cb93fdc", "value": "6144:+3PVm4UCt+33dr36lJOL/a6RtDnD5hJSFdGSvUOcqhbVreWS8BrhPi+oZUyApCxM:gPB9PDZoc1QfO+7adU/Prky8mLcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698062899, "uuid": "b34bdd01-3d11-49d3-a80c-e14105b7f9da", "value": 1010176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698062899, "uuid": "2b697c5a-f0f9-4cf9-9863-56d05286e3ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062899, "uuid": "0471350e-027b-4c36-a316-e6eb51177df1", "value": "swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e27391-7178-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698047211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047211, "uuid": "4884a939-f8cb-416a-9173-8d1789f0fb38", "comment": "Malware payload (AgentTesla)", "value": "349d758d9c75ca6e159eb71e00c88fed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047211, "uuid": "0e2e73fa-a57a-4f24-9ad8-cf6ab9294853", "comment": "Malware payload (AgentTesla)", "value": "cd17f9d78f3c5ba82872d4f579be0ecbb0ebccaa809c89e1beb426ab01572b1f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047211, "uuid": "fcad6519-8d39-4749-ad31-f547a0784d22", "comment": "Malware payload (AgentTesla)", "value": "ab344168451e3870d59e0b76949cdb1c3539a769", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047211, "uuid": "acf6e34b-eda2-4340-9609-b19d0493c639", "comment": "Malware payload (AgentTesla)", "value": "5465bd5b4a985e3cfb453ed13dbea4edffc1e24f5372ece25a2de36bda44817db5519f8e71bf43da64ab0bccd19859a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047211, "uuid": "9682d28a-e66f-41cd-8020-413fd7d552d5", "value": "T10C15DF80E94455A1DC59ABB06A36CC3552337EFCA878E52D28DE3E6B3BFB7931025113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047211, "uuid": "0a869174-c9fb-4bdc-97ae-08848761d530", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047211, "uuid": "19531ebc-97bb-4ad5-b277-f8f222b56d71", "value": "12288:3gR/mZRM+kzMT+b1qXDN7pshBaip/h6zyKbQB2PKaq5xKX9P7r9r/+pppppppppT:3gkZR5koT+oN7psbhV4tPOm91q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047211, "uuid": "776a19d7-c087-41a5-83bf-f14fa3505462", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047211, "uuid": "789f8ab0-d098-41bc-b6e9-86692fa48641", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047211, "uuid": "0f5ff40f-6d6b-4f65-837c-4145473aa051", "value": "Order-2309053.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27882caa-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698057444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057444, "uuid": "66aa80a9-9d11-44ac-bcb0-0c8c625dcb37", "comment": "Malware payload (SnakeKeylogger)", "value": "7ec6ec001094450070a36a8a0ff1693d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057444, "uuid": "54571da5-4930-4884-8a78-e8589c7cbf63", "comment": "Malware payload (SnakeKeylogger)", "value": "cdac9bc5fd2a4de255e4256bdc0a4f5a2869c6849f71c3904c25b71e6dfac52d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057444, "uuid": "cdc68d29-d76d-470c-b0c6-9cf0a86e25cc", "comment": "Malware payload (SnakeKeylogger)", "value": "3886efa46208974cf4f84f28fe365c16fdb4edf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057444, "uuid": "9d5015e4-0a97-46de-8983-83a4259db34b", "comment": "Malware payload (SnakeKeylogger)", "value": "b813cbb8fc4ff9634150c6d420d2e2c38bc3ad0468bea5b38e86fa25a7d83ca7bd7697728265be8d04a8d691259aa819", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057444, "uuid": "c11114b5-fbf4-4485-aea2-75d756e2dc1e", "value": "T14CC41220BDB4172ECEA8A7F4EC71358A1775D12D6816F3494E6560CE8B47B1ECA04B8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057444, "uuid": "d562e83f-f69d-49cf-95bd-0a68731c6290", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057444, "uuid": "fa35fc80-674d-4554-9c89-e667b09c372b", "value": "12288:BhNh6sxTA6qNhnRUfPhb18/UEXdJ0/48ECRre5Hx5:BDDxs6gFRw1l0f/YreZx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057444, "uuid": "df1b3df5-a3c8-46fb-9ca4-1d0473116da9", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057444, "uuid": "0a5805fd-9ef5-494e-866a-773caca2a857", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057444, "uuid": "6d742a00-971e-4a8b-a5b1-262e1701508a", "value": "Hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf23b871-7194-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698059443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059443, "uuid": "cf2e0956-d137-41ab-ba59-30e4e3812ef5", "comment": "Malware payload (RemcosRAT)", "value": "23a617011a3d71135f895ed5fd643c6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059443, "uuid": "7cf0b2fc-1d85-46b3-acea-961a81989101", "comment": "Malware payload (RemcosRAT)", "value": "ce39a137b9ff86bf23d7c62480a804e8d25c8b9154e9792b669374ac7f92e192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059443, "uuid": "d117a45e-fe10-4d23-87e6-83b8bfe1f145", "comment": "Malware payload (RemcosRAT)", "value": "15b7efb6dfa050ee1892a1112329ef360bc1317c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059443, "uuid": "0549ee3d-4296-4807-b83f-95dcc9250d6e", "comment": "Malware payload (RemcosRAT)", "value": "b3fc4584ed2cd1f435cba91b334bc324fa40adc567777e2b7cd0104e8287a44393bf95461ae6b219636e7f0f054a2b06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059443, "uuid": "1c1cdb20-e6b5-4c2d-ad14-67f39f293001", "value": "T144252235B1954BFADD742BF25836688613B7BC7DA872E31C8EA630C49BB3702454254F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059443, "uuid": "804057ec-221d-4ae3-bde7-6675c548dccb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059443, "uuid": "aa968e55-f251-424e-92cb-be94e7b4ddc2", "value": "24576:tDDxs6gnAsLzJ6Wy3V6yANOVofLAw8meQcOQezIcLUCs:tDNs6gnAsL9O+gCfLAwdcOQYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698059443, "uuid": "74e15162-db38-4fa8-808d-317d479f945f", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698059443, "uuid": "d733ac45-5e65-46fc-9ad6-bf782b6a0f51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059443, "uuid": "8a6044cf-f948-430e-b563-b2c22ba42c5a", "value": "Cheque copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d968ac-71c9-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698082270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082270, "uuid": "9f5004f0-536a-41eb-b4fa-60e1028a71e6", "comment": "Malware payload (Formbook)", "value": "27b89ef405613ba9b6fdc4674b7ee714", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082270, "uuid": "fc8bfbe4-613a-497c-81ab-658bd7d0ad16", "comment": "Malware payload (Formbook)", "value": "cfa2fd086c70f7d1a3153f36e928170d97ac8ccf4a6966f74a57fe346de085ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082270, "uuid": "00026bc1-c7f7-4fee-a013-0a2cac1eff25", "comment": "Malware payload (Formbook)", "value": "964a209001eead4115d4ca7617c48501402fa659", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082270, "uuid": "d548c08a-97cf-46dd-a55c-19f649a0f3cb", "comment": "Malware payload (Formbook)", "value": "52827051c5b273a0b6691e9b5ec58a36a975f1365275436235eb4932b1d03bd822b8373d925c43d903859aa132dffc2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082270, "uuid": "f6886e03-b3c3-49dc-adce-ca48402a6c8d", "value": "T12F85FB1176F95B59F9F30FB85ABAA611487AFC6ACF11C2DF1250908E0D21BD09970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082270, "uuid": "d66aa6d7-3da7-4ed9-9a66-ca7493e8a6f5", "value": "037522269f8348aa17add864631a3f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082270, "uuid": "d6ba8bb4-2b1b-4d12-a948-1bc28b2bceb6", "value": "12288:8FV2CXJXmPAfSBsqe7E95HOfCjdHoOstzdg4yMuzzIo9X6a9DhvhVGcngI2:6ryAfSKqe7E9h/dH+N66a9DhvhIcgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698082270, "uuid": "ca0fd751-18bb-4dbe-8598-1314271e5b17", "value": 1724416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698082270, "uuid": "99aebd7a-a112-42e7-96ab-a27343debf4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082270, "uuid": "0c46905f-5359-4dd9-ad8a-b1fb53e482c8", "value": "SecuriteInfo.com.Win32.PWSX-gen.28249.10122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da07a46b-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042711, "uuid": "95eeaf96-2038-4b4c-a91b-cd7225d1b6e4", "comment": "Malware payload", "value": "220d3541ab76404977cf5b48de58516a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042711, "uuid": "284146ba-e3c3-44b4-ab17-4d03ba0894ad", "comment": "Malware payload", "value": "d04abc20fa183e1ee64b10332bfacfe265b75a5d68f9178b5450a3021b6cd57d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042711, "uuid": "b2d3549d-cb71-4f3f-acad-99bf0da39125", "comment": "Malware payload", "value": "c33151d347e1373de4b42f7b6a5bf9d146df6758", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042711, "uuid": "ee902bda-fa94-417e-9ac2-f99e4e4531de", "comment": "Malware payload", "value": "684eba329a175d249878f88c4e515db7d1504cb23deb10f8d50c7fd267cfeab762da3efede83954599912a7edbf79b72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042711, "uuid": "0a6daecd-ff4d-4cd7-84ea-58406a13bbe9", "value": "T137151242BE46E445C9679A384806FD8C9921FD08CB83C25A3397FF6E7BB3F15668144E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042711, "uuid": "f6482a44-c482-4b7a-8a3d-6f61ccca516a", "value": "dc2f52be20ce859a3f406c5323490d0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042711, "uuid": "54b69787-e1e1-45ce-815c-e90d880754bd", "value": "24576:bab8txntAoLib4Vxp6fmwEH+O2plOy6q8U3Ip6CYJO8YNEc:bab8txnmb4DwaCr9tV3gm2Sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042711, "uuid": "829e4474-3a21-4003-88b3-47e92c23a138", "value": 960088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042711, "uuid": "a8f9c5b9-190a-4a6e-ac03-eb5a144f7023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042711, "uuid": "ebb10af1-165e-42a0-b109-83b0b65bcbb2", "value": "SecuriteInfo.com.Trojan.MulDrop4.30132.1188.28769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b30e96-71aa-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698068766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068766, "uuid": "20a1270c-d7b0-4b91-a718-9c3f39fe1c86", "comment": "Malware payload (MarsStealer)", "value": "a033f2044bfa9129cf2c004380c496ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068766, "uuid": "385306cb-10b3-4004-b65b-110c9e45fe8a", "comment": "Malware payload (MarsStealer)", "value": "d08282c161ecfaecf247815f307d778cd626d0af763315e85b39b0027ed38eea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068766, "uuid": "4a00d528-1c43-4fac-9312-59a86594241d", "comment": "Malware payload (MarsStealer)", "value": "d810b26f2610a0d3cdca400bbc33a770d6829106", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068766, "uuid": "b30adf6b-925c-4c39-a41d-931b6ab7b313", "comment": "Malware payload (MarsStealer)", "value": "493d004e6feb60232bf0db176aa72b3c9a16d78defa5f40351ae77480e444e06a3a6b9d9ec66e750a016417811191ed2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068766, "uuid": "8e13fc3b-4650-452e-911e-45c16d2bd709", "value": "T1FD650613A1CE8D36E33E35386AF711B448983D80B664A8467FD87ECB0721A7965DD34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068766, "uuid": "18ac4a26-50e7-4e9e-94d9-f1e7b623aa92", "value": "f5fcef2eacb86c1adad598b65c67a3ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068766, "uuid": "60a7a883-a131-46d1-a9c2-6232bf77abb2", "value": "12288:bRgcdrhCHwfbv7rHMUtXe44Lzyne0txn+9WXH3ML:bmqewfbv7IwOlLzyne0txmWXH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698068766, "uuid": "bcbd97e7-3944-407c-af75-19cae8b978e1", "value": 1433088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698068766, "uuid": "12731e79-297f-4672-aa1c-e0f433a89abc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068766, "uuid": "e0b7b6cc-5101-4653-b2b3-23f644b1dd1b", "value": "a033f2044bfa9129cf2c004380c496ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807bbd5e-715b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698034830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698034830, "uuid": "7f100fd2-b7ac-463e-88ca-bda6a401a569", "comment": "Malware payload (RedLineStealer)", "value": "06fe71c3adc068892ccb451788a96e69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698034830, "uuid": "94828b00-89ed-45ad-9880-9fd1acd62f64", "comment": "Malware payload (RedLineStealer)", "value": "d1204f96fc377cd3efb413259900274fbaa3678aeb223ed875593ebd53bc0715", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698034830, "uuid": "defa63a0-d32f-43cb-aa1b-4c489860cb6c", "comment": "Malware payload (RedLineStealer)", "value": "9d5ad9f54fb5627e2336e5bfdbbf3ed9161a29fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698034830, "uuid": "7b7c96da-94c8-4ed0-bfe0-06981e5f892e", "comment": "Malware payload (RedLineStealer)", "value": "d6cb02192d83332d0273d5f969c1f9344c5167b0246f7c277268eec9d45330316e3cde995904e6b2fb50ae88b156afc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698034830, "uuid": "c87adbfc-0cb7-4b0e-880f-7b9c5052fda1", "value": "T175A44A90F1851312C5B2FC78CCD85DE3B5BD7C1DE916F8CADA8C806AB96418E871CD6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698034830, "uuid": "24313b91-2664-498d-bf10-3b0325aa5ce7", "value": "89b4938a013d6b8954f68c2ef1293c62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698034830, "uuid": "3907019f-2af9-4557-ac22-ea49db160dd9", "value": "6144:UkJsICnU9Q8G0DSx/pq1cYHH4R2k8BcriZQHIkEiIuiIA0lLTfTbhdBonP73Q7aW:UIsICnAOqcYHYRZ8Ts3lLTfTNdByPoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698034830, "uuid": "be551eba-8899-48a2-8982-4afac70fca88", "value": 470016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698034830, "uuid": "45b69400-3699-4bfb-a47b-0ce0aeef8a7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698034830, "uuid": "4c0be6f5-abf5-413c-8cd3-b51ce926e268", "value": "06fe71c3adc068892ccb451788a96e69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee618bc-71ce-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698084112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084112, "uuid": "14d0f6fa-064c-4b86-9f29-2da51024527e", "comment": "Malware payload", "value": "c46d33d7a47a90b790999ace9c61f463", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084112, "uuid": "ea772a55-97dc-4b19-acfc-c6c8fbe3241c", "comment": "Malware payload", "value": "d13ad19aa79e6f9781804b669fcefc3391f04993efb44326ab362b6c07037d0c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084112, "uuid": "bbee5d0d-42bd-4454-9092-7ec79b2a3b2b", "comment": "Malware payload", "value": "6bee86f44799f63a798fdd60205f1fc49e5cddf3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084112, "uuid": "fbebffb2-4eb6-4f43-8856-3519040b07ca", "comment": "Malware payload", "value": "14ee563e32d33ac8105a7a6c1d2b20ef2df3664ef9f523863183d46662653b813e741881bd1fe3437a23198e28f6b570", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084112, "uuid": "08ec4087-d2b5-49c0-87f8-bb06e77fdfd8", "value": "T1D5E43379A1D1004A926059A608C431D2DCDE95F768193711BEBABE2E7C47FB1CCFD5E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084112, "uuid": "69f254e7-354b-4d63-9596-10c377833d40", "value": "12288:/Ls7B0wRdUfOguxmIMzGvWocogQkukEXK4nTnP2zL6f7zWGCy:Q7B00PxmIwGvGjfA9WGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698084112, "uuid": "a78abcb5-e0d3-4b60-b622-ae5c0b6e3263", "value": 699029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698084112, "uuid": "15e35c22-7dea-4109-8ecb-e90cfa838127", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084112, "uuid": "78f3f84f-6812-43eb-82cc-01c3681fe511", "value": "Factura wa6792900.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8196faef-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698057595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057595, "uuid": "8a116575-1aae-458b-88a8-0914342a548c", "comment": "Malware payload (PureCrypter)", "value": "773b18116dbc17bff2c4c8959128559b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057595, "uuid": "89d0d7eb-44e1-4a9d-bbc5-a1c0045043f2", "comment": "Malware payload (PureCrypter)", "value": "d1ca1fbe7d58e4f4f4a9cf69d05e22cc786bfaadf5b2b619d44dd709039c1095", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057595, "uuid": "f0bc2a3a-f25d-4a01-9c4a-06751095b07a", "comment": "Malware payload (PureCrypter)", "value": "596d12000a43365d9ca5bd61a8e41ea2f0a817d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057595, "uuid": "73ab3db8-c8b4-4c6e-a610-a994d03d45f0", "comment": "Malware payload (PureCrypter)", "value": "ba3f535a047e0679c251e418393d395e750499d8b82a56d7d03515b215b58d190deec1933b19084ac65e89523775d649", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057595, "uuid": "3db069cf-50ef-48e2-b5ff-2037e4ec4a7c", "value": "T167B2A40663480BB3D0AE0976D44ADB70D712661C8CA78F7AC440AB87B4D63535D6FEE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057595, "uuid": "edf0b72f-864a-417b-9bc5-f3f8780ce3a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057595, "uuid": "88b9e2fd-d1b5-408e-9f06-a67bcc06f20e", "value": "384:UK6zYga5C2z09ExbxvqNBNJnd2i22i22222A222sf122WO22u02u26x2u2B+222n:u81bkzxSHoCKbEMfnTbxBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057595, "uuid": "7e15c6a1-6b59-4c29-8633-7efe4729a0b4", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057595, "uuid": "5af51b02-b007-46fd-a3af-0363df7599e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057595, "uuid": "48054612-7c0b-4386-8b4a-ab2f13c78412", "value": "Halkbank_Ekstre_20220630_082357_541079.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5639278-7178-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1698047374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047374, "uuid": "7c827dc6-6467-4a2b-97c8-d0d6f73c341e", "comment": "Malware payload (Tofsee)", "value": "b2933ef82916fec5e6f0ee39c3c841f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047374, "uuid": "e61967f5-8455-45f8-bf28-a9e87c48d658", "comment": "Malware payload (Tofsee)", "value": "d1fff136ec7275abf03329073902d880ab2b69e5ea965730f24513567bb15c26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047374, "uuid": "291461b6-04bd-4306-a926-f8f724a78e7c", "comment": "Malware payload (Tofsee)", "value": "3067c44740171605f63aacbf8a12566ccc6c3df1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047374, "uuid": "d459bae8-a499-47bd-b11c-e0a19ceb9559", "comment": "Malware payload (Tofsee)", "value": "c266cbedcb91bba81e8865b9fbf900517abe6f508bd68bb4ab43171e6b563878d5a2dc904d7932b0ea5b2e709d280a0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047374, "uuid": "aa61235a-bedd-4d02-a39d-cc354bde2a8c", "value": "T1CA449E03A691ECE0DA1646718D2DF6E836EEB8704E59E75733187F1F2870272D26B391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047374, "uuid": "e35dd65b-83f7-4391-9291-6f4c96dc6321", "value": "3dc5fd248fcafa52ac5c2283ccf28cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047374, "uuid": "5aa3afc9-9c72-430d-888f-0e02ba612aaa", "value": "3072:pwXi+WJKuLKUOS80SXz7Phqw5PSCncE+feoZps/TXr4uyz5UcK124frpr:WTWJKuLfL80O75/5PZnH+fejj8ubB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047374, "uuid": "49ee5676-5585-447b-b3a1-e20385a8df9a", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047374, "uuid": "2240a2f9-5d68-4e66-bcd9-64ed0d17a74a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047374, "uuid": "a98af51b-d2c4-4876-850a-cc27c975eb4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058b3130-71a7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698067266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067266, "uuid": "05b7f234-bf8f-4a70-8948-93a48394e7df", "comment": "Malware payload (AgentTesla)", "value": "ca654d2e18e712e8208131d398cf577e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067266, "uuid": "f691a01c-627e-4131-8ebe-8675b5e37ba5", "comment": "Malware payload (AgentTesla)", "value": "d228edad00c7342f36732017beec3c7ea9057b6ff8c527198ab29d9eefcee645", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067266, "uuid": "c010fa7d-c157-4b38-8c7a-0f185fb7632a", "comment": "Malware payload (AgentTesla)", "value": "745220418b2c4be9e1cd5b6fd87176aeaf24e92b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698067266, "uuid": "956a3925-bd8f-4cab-a259-c919aad06bba", "comment": "Malware payload (AgentTesla)", "value": "ef12cbd5cdad9aa8a0f39022c4cef31e0005a7b26d47b155ee7f9a82fcd047528293af6bdcd39e1f2c025ed64db50bd6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067266, "uuid": "5e13dc02-5286-42de-8720-c6d1584c35ab", "value": "T14345F1E9B4F790C5F82286B6D7803F71D9E7BCFA596D35152C8662128133803EB26637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067266, "uuid": "1f2f7db2-14f3-4432-bbf5-6720c8789ce1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067266, "uuid": "eeab45fa-b4b4-4789-8390-8f8c1736830a", "value": "24576:mCCa6JHRST4mTB3YL1JirG4bxrhnt7E+jeUZGrUmx7LYf7t:mNRRzmTB3+JIbxrht7E+jnGrh745", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698067266, "uuid": "079a9b65-706a-476a-a613-09f04621bcb7", "value": 1236480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698067266, "uuid": "bef44f8c-c6d6-49eb-85e8-259bc3fc373d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698067266, "uuid": "25b8d49f-8162-4f41-9479-361f4905a631", "value": "M231747-1793247750-PO-K04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf3a594-71a9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698068377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068377, "uuid": "6a7e9f85-3f5d-4f97-b735-522a550ee264", "comment": "Malware payload (AgentTesla)", "value": "28707370a3fb75269da8a9da30960505", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068377, "uuid": "0c62634b-3296-4b4d-9abb-b99b5d95bfc5", "comment": "Malware payload (AgentTesla)", "value": "d49cff946605d03af069b896354b114d8a4b87313c1aa7fcac9fbf71bb39f8c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068377, "uuid": "a83af850-8a92-4b87-bf40-c05426ada6c2", "comment": "Malware payload (AgentTesla)", "value": "9c900e8ca6595599e922bce6f3255f29063d6212", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068377, "uuid": "8fde7834-831a-4733-9d29-b23124107291", "comment": "Malware payload (AgentTesla)", "value": "033dff48e224f24b028b887fb4a1b75ecee7176524e3f18078bacdf5d433b2693d0bab595ea3b060a006004177a9d157", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068377, "uuid": "97dabe77-8526-4084-99a2-8cbf90366f97", "value": "T15A25F22C0CF809124161E1AEDFD8EA57B2C08CD6664C9DA687C68F595A1393BF09FD3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068377, "uuid": "bf41d62e-4082-4edb-8ea7-f12d6f8d74ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068377, "uuid": "148cb9a4-6452-473e-a42f-475af9f78062", "value": "12288:uF0rdOBhhxlh/VJ1euMQd+S8Q/ZNt4/NpUH:00QdxTVJEuMPSDxNt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698068377, "uuid": "d4d16583-a323-47a5-bdac-ba31957d022a", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698068377, "uuid": "11157dda-dd3b-4775-b507-bb435a31253a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068377, "uuid": "821c78c3-a2c6-41b3-90fe-f7024089581d", "value": "PAYMENT COPY.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f41a54f-715a-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698034372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698034372, "uuid": "acb048e3-e0d8-40ad-8221-b9ca79cdb3e3", "comment": "Malware payload (RedLineStealer)", "value": "2c69d39dadd8b2a35fc51a9eaa4b834b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698034372, "uuid": "64156cf4-79f5-44d1-996f-e1d4e37cf140", "comment": "Malware payload (RedLineStealer)", "value": "d4a426fc37ab2a952e1fe7eb9ef1b18aada18418d5e5f6cc321106feff3bf343", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698034372, "uuid": "4e0e6210-2b40-4109-acbe-1c07a99dcf35", "comment": "Malware payload (RedLineStealer)", "value": "d2e0ec064a92b038513f4057b0cef9c4658f4d35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698034372, "uuid": "deb8ac26-d99e-4f71-917a-edf2647d19aa", "comment": "Malware payload (RedLineStealer)", "value": "e77461b2eb1de4cff7ce8da36829bcf189123b631fa84df9480973af7f1b162a830d15bdc0ba337b9a1c4cec096704fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698034372, "uuid": "d01741ff-5714-47d0-8846-f01f0f96a39c", "value": "T15A75234177E84433EDA62B7129FA03C37F3A7EA60C3447032646D6854DE1296F9BA74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698034372, "uuid": "e68c208f-e330-4c7d-a423-b7d12e0ff883", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698034372, "uuid": "75df0f1f-e087-4889-a160-064a6b30fd59", "value": "24576:ky+w8EjBbPoIU+6dmEEy0fu7iKF3P6PvAy8QVZYsLDdzCdMGJzmtP1ztksvJ:z+w5j1wIlCKDmRBGD8QocJZkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698034372, "uuid": "f61f909c-d5c7-4405-afb6-674ad098a469", "value": 1591296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698034372, "uuid": "2d934d74-e03c-411b-8c3a-5d7a5a553f39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698034372, "uuid": "e90a6ebd-7e20-4999-868f-f72b810ceb64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051a93f2-71a9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698068124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068124, "uuid": "12ba86dd-9659-4b2a-9f6c-60c5c934bce8", "comment": "Malware payload (AgentTesla)", "value": "fb454917f7014634810d1ef7c083b663", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068124, "uuid": "bc2b70a7-6cb3-40f6-b4c3-d4ac5132e449", "comment": "Malware payload (AgentTesla)", "value": "d683eb7b2ffb8b8e7131a4e135273eca2c8c8fe04a20eb76ec079a6266c7b690", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068124, "uuid": "1d1a5420-abe5-4e94-aa81-7c1dd8a07019", "comment": "Malware payload (AgentTesla)", "value": "29772a1a255d327f3443cc98ceca6e973b9afcfc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068124, "uuid": "520f8725-d9c4-4116-903c-325bfbc3e956", "comment": "Malware payload (AgentTesla)", "value": "a1168fde7fdffe8b41c3ebb4a9ddc4680cc391c734724109631ec6df4ea7aed60a6069dcb760f2c6374901402677ced0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068124, "uuid": "e08292f3-bf77-4731-801e-ae59a6605a99", "value": "T1AAF412203BA5BB92D37D27F684C59410977392690732E79E3DD2A0CA26B670CCE91F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068124, "uuid": "d1353868-b176-4227-9975-9e41021a9b34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068124, "uuid": "c0b7ed30-bd29-49d1-8d83-fbab0b1071da", "value": "12288:dMrHMAgR/mZRM+BAuci1VFA8a6Yd/PwDBejxZL45LqAOlTB:kgkZR5uATA8a6yPV9WN96TB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698068124, "uuid": "e3b08c8c-7c22-45cc-a48a-36db0f9e0c77", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698068124, "uuid": "07adbb57-c58d-48ce-84e0-08c726dad874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068124, "uuid": "71cb2f19-e5a8-429a-9a4a-487d363dee69", "value": "arinzezx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe88f4f8-71a5-11ee-8907-42010a9c0042", "comment": "Malware payload (NetSupport)", "timestamp": 1698066824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066824, "uuid": "cdd2ae35-ea2d-45d2-b7a5-bc804ec4573d", "comment": "Malware payload (NetSupport)", "value": "14f9e585b26beb2b7384ff31ba44f360", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066824, "uuid": "33449fdb-d949-4c20-922a-47b02217238e", "comment": "Malware payload (NetSupport)", "value": "d6b08eed85874488ff24640c9d2460d364d0e175f664418e5e3fdecd98fe1fa9", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066824, "uuid": "b0c882b1-10b6-4d98-abfd-fe15216f6876", "comment": "Malware payload (NetSupport)", "value": "caf90c4675232fd7f39792a782e972523ea85eb4", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066824, "uuid": "b1278b8f-8de5-45f7-bbf5-25b05601c614", "comment": "Malware payload (NetSupport)", "value": "357a3a71618d8e097f07507e09d4cfab6ece398a5b4b16a8f67509cb1f623fa37f3a60bcfc70ae6b7b05e7ab4ef6a1a8", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066824, "uuid": "df2a2a12-05d6-40fd-8f67-ed7a450e397d", "value": "T1D9C533526A92FBA7C0E2F1BBE0ACAC165D2D7478E4FB36A70D3E64A2D539450C47F011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066824, "uuid": "746ca474-dab0-485c-badc-c669855cc80a", "value": "49152:UuS1Zl8lAQumelDlEDThXBJOhHLw6J6h2SFFGf0RBNTQfYc9jh23eWeB3/YSBm7n:PS1Il7/FXamhRFY89YYc9jh23redpmQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698066824, "uuid": "316ae4a2-df6e-4ccc-a66d-baffdd9d9fda", "value": 2522292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698066824, "uuid": "133f7f2e-a5a8-4fc7-9594-6ded158c10af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066824, "uuid": "3330d607-ab23-4484-9bd1-de20dce66fbd", "value": "p.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8032cc90-715d-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698035689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698035689, "uuid": "01fc4d7e-75ac-4fff-8e79-b7caac919b12", "comment": "Malware payload (MarsStealer)", "value": "6157fb913b1e40626c2720afe8776a83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698035689, "uuid": "0b74a674-e2ce-41a3-a62b-c9203f8a476d", "comment": "Malware payload (MarsStealer)", "value": "d6bc2b0f5899b66f3e21c6f8616c02aa218b6fbf292e9131da0414badacfe62e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698035689, "uuid": "31f18652-1c25-4408-99b6-721267e6e61d", "comment": "Malware payload (MarsStealer)", "value": "0ceb60a16d50e62d6f39b41535cfbf11c21b02f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698035689, "uuid": "b8d77764-bc35-4b07-b16c-fd6a1f1679fa", "comment": "Malware payload (MarsStealer)", "value": "239030d569113d19a0290d8d81715c975e3cb49e645d0da09ff105fe9b9f31ac1b4cbbb6dd74642da8540304b6986684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698035689, "uuid": "cb7e2a79-1fad-4b45-9914-628eb9cd5f39", "value": "T16904BE2172D0D032E1A759311930C6A21E7BBDB2AB7940CB37943A3EAE713E16B75753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698035689, "uuid": "2952796f-804d-47e4-b899-405f8605d428", "value": "8ea5db4b889f56362e73547d3beef0d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698035689, "uuid": "3ef5fce6-aedf-4048-b445-7c562a31efd0", "value": "3072:jyBNbfK6eAucOTXxZVVBkK7hHpxUkrOj9qdkoMuBX:iMnAunTX/VVjvxUW/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698035689, "uuid": "b4b0c3c0-b8e8-4d8d-a5b5-4b783bddc335", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698035689, "uuid": "1c68e40e-4dce-469e-b644-635698bc9616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698035689, "uuid": "46c80f13-e3e6-4cc0-9247-f773fa0ea0b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db424f2d-716d-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1698042713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042713, "uuid": "b9955896-f3d4-45f3-9b5f-dc67173e8edd", "comment": "Malware payload (Adware.FileTour)", "value": "dd7f049cbce2dd902089a4975e745840", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042713, "uuid": "6b3c94f4-afaa-4ee5-b9de-2954d55c76f9", "comment": "Malware payload (Adware.FileTour)", "value": "d6e0cc68fa8dfa2c88e99869e277878e5889f083b8af884eea9c267abab47d7b", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042713, "uuid": "9fba1362-908d-44a1-9fa2-345805c11f94", "comment": "Malware payload (Adware.FileTour)", "value": "01c0e61a5e07853b618ac053895901ffb9b866e3", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042713, "uuid": "cbe61a7f-b810-47a2-979e-184858d8fdd3", "comment": "Malware payload (Adware.FileTour)", "value": "8cc2125774fbc4e71b73f631e16e081c09b7a5eeb11e30d71fe19c6c9335398b844e811409b16f11aa7a1c700157adcd", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042713, "uuid": "832b79b0-ae8c-44cb-90db-923f93f012cf", "value": "T158E423435BE00578E8A14A319D75A771AEB37D328CB3A14A32AD3D4DEE33643C515F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042713, "uuid": "c2e0502f-01f0-42b8-9400-182cad0a6f78", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042713, "uuid": "c102b1f8-8e8d-47d7-88ea-d5c0f1e15400", "value": "12288:ana9YDEpUsUssBRgfL8gM5EbX0PvkLMK83ekQhytBuEDbS+7hWVAbL:analUnDgw6MN3ekmoiiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042713, "uuid": "5adcb955-576a-40c1-a951-e10b7bb91f86", "value": 658080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042713, "uuid": "b899d99b-5005-41d3-bbdf-ed5965c09679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042713, "uuid": "5415b3b2-4881-4602-a0e3-2b308c648610", "value": "SecuriteInfo.com.Adware.Relevant.189.32383.31454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dff0300-718c-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1698055844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055844, "uuid": "c301a46a-d968-4938-b8a2-69fac6f6fd94", "comment": "Malware payload (RecordBreaker)", "value": "7433b3c6d87afab51114173b1f4d01f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055844, "uuid": "4a4f6e0f-8524-43da-9132-f030c37e3d36", "comment": "Malware payload (RecordBreaker)", "value": "d76df701163b0b995555b2991d93a430ab566eefed370d57a69a49debd93135b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055844, "uuid": "36b45577-7e9b-413f-bd7e-3f97786ca10c", "comment": "Malware payload (RecordBreaker)", "value": "dd03908587d6f22291bc0085c5a3eec28e487681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055844, "uuid": "93200979-20ad-44e7-b077-db2f3579bdcf", "comment": "Malware payload (RecordBreaker)", "value": "e45650360e5d0baeaa5e21c41ca00d2cc90b394647e9a49bd4c7123cded2d1c51d9fd518ea057cc47abbb523a3e0cf3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055844, "uuid": "ba13b540-de70-4eb3-898f-3082d1cb71fa", "value": "T16BA3C6D34278A302EB94187316D3EE737A59DC3E1D25BED3AE51CA5381EE45009DA2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055844, "uuid": "e35feb5d-4c20-413a-80ec-bc8a93d6cf1e", "value": "0fcb7632c48018563e5af2f63681ece5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055844, "uuid": "78927edf-2682-4ea9-99f9-20a85102a470", "value": "3072:VANfQKMuflyKX9FBFya6mob2loL6RJ//5O:60O9FBn6pb+HRJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698055844, "uuid": "93a100ee-88fb-4027-8a85-420e12be2474", "value": 99840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698055844, "uuid": "383ebd8e-43f6-4530-9359-8d7ab6dd97ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055844, "uuid": "3f80304e-fe33-463a-8792-93506fbf0731", "value": "7433B3C6D87AFAB51114173B1F4D01F6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1413423d-71a4-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698066002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066002, "uuid": "732d6283-7816-44cd-8516-72676b1375d8", "comment": "Malware payload (MarsStealer)", "value": "92a2082d67f69c8e80597d3c51b00ae4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066002, "uuid": "2a24b01a-1a68-44b3-b207-47cc091f0b19", "comment": "Malware payload (MarsStealer)", "value": "d7d6d726d736d44b2e6f4ba70c0bf07e4400f2c91b4e79fb497ac8ebc6795774", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066002, "uuid": "d3acb46a-7aa4-4e77-b58c-02ec262041db", "comment": "Malware payload (MarsStealer)", "value": "20c8315e06d6b12897fb87dcae36d9563e26ab73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698066002, "uuid": "31eb9879-2c87-4068-a91f-3be05b3b4dcb", "comment": "Malware payload (MarsStealer)", "value": "613fa2300424e738c82b8d083b6dbaeb6e51881bf108ebdbb263f453b5680c3619df2244597b83009a32fe1b663020fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066002, "uuid": "191cecd5-251e-4a9c-842c-87dc8ab945e1", "value": "T1CF650613A1CE8D36E33E35386AF711B448983D80B664A8467FD87ECB0721A7965DD34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066002, "uuid": "48beaf70-6d76-4f31-b149-9e5be8f783df", "value": "f5fcef2eacb86c1adad598b65c67a3ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066002, "uuid": "31858ab0-e402-4e2f-839f-bc35d0140fa4", "value": "12288:bRgcdrhCHwfbv7rHMUtXe44Lzynemtxn+9WXH3ML:bmqewfbv7IwOlLzynemtxmWXH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698066002, "uuid": "ff555930-b2dc-45d7-b030-89f68934d795", "value": 1433088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698066002, "uuid": "8647ddf7-8580-478f-8681-d5b0e27dd867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698066002, "uuid": "8d228b7d-e963-4095-ad31-dd85c264e622", "value": "92a2082d67f69c8e80597d3c51b00ae4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f87cc3d-7177-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698046747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046747, "uuid": "13b8e751-6498-452c-9d66-37adfcfe3bf9", "comment": "Malware payload (AgentTesla)", "value": "8c74d2eb3a9e417ccbd4d0f02db47c52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046747, "uuid": "3e153e24-55aa-47ce-b52a-b360d879e9b1", "comment": "Malware payload (AgentTesla)", "value": "d80fada7b74a6cea6b45162c128492c9a4848ae9ae2dccb12e05401f8e50195f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046747, "uuid": "9cd3bd1e-cd7f-4fa4-864b-154e45f05ead", "comment": "Malware payload (AgentTesla)", "value": "f0285cceef17c588281701f1ddb8d6c534b1ee8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046747, "uuid": "1924f9dd-5308-42e6-acc6-777d81fb56c5", "comment": "Malware payload (AgentTesla)", "value": "6466d759e8eb21f914e5344a9ea75514b046aea5e754f06a083596d201a2dcc948c03c1d97d502e9a49ddb81097615c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046747, "uuid": "8241d85b-803a-43d7-9760-e0dd38d251ce", "value": "T1F225BE84F54061ADCC1ADB319A36CC3092227DBE9636D51E24DF3D6B7BBF69385201A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046747, "uuid": "a0de53e9-f250-4c2e-9af1-48f2466d4a3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046747, "uuid": "b3a074d9-d9ca-4c96-84ab-f7c7d94f29c7", "value": "24576:UoHfgkZR5kWD9otRJZXkI+rglQjTjcDOEfGFXZQPB1q:j/tZsWD9KRJH+r8JGpgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698046747, "uuid": "4bd3111e-8420-4d7e-b5e4-8558f5af122e", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698046747, "uuid": "3ec17093-483b-4e42-a03a-3e9a313dddde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046747, "uuid": "b3293356-d82b-44c8-be5f-cc3f9bf8dba4", "value": "PO-2309053.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095b43a9-71b1-11ee-8907-42010a9c0042", "comment": "Malware payload (MysticStealer)", "timestamp": 1698071567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071567, "uuid": "4c377c14-e0e3-47f5-9b68-93e4c1c206ca", "comment": "Malware payload (MysticStealer)", "value": "6e49cb293e808839133a52a6c7d3c651", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071567, "uuid": "a28850ef-7be2-4d02-bab6-a1728d72cd29", "comment": "Malware payload (MysticStealer)", "value": "d820b4666b8bfc15c045d4552f5820ed815f2030dea7c8c117660a994745321f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071567, "uuid": "32542e42-dae1-4bb9-905d-81f1e0c6cba4", "comment": "Malware payload (MysticStealer)", "value": "f0197a1f3ec92bff0c6cac6bb465131a823012be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071567, "uuid": "654b29c4-578b-4d05-9f82-6c1910218ac9", "comment": "Malware payload (MysticStealer)", "value": "11ff7b137d5124d76b10acf2ca374c95db951f4f622cba333ec8b6ee7d2b39d45478bad7739a7add7d8e8b81a3977b8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071567, "uuid": "3966455f-1dbd-4080-b206-8d3473371f8e", "value": "T122953D2177F94B59FAF30BB86ABA6611087AFC69CF11C2DF1251584E0D31AD09970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071567, "uuid": "e5e07c41-1579-4898-9310-800dc9523fc4", "value": "037522269f8348aa17add864631a3f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071567, "uuid": "f6066640-89c8-43d2-a7db-f0d687e813fa", "value": "49152:Jnqe7E9DW06a3vxpsDOOZkDmGYahfFi9O1eSM1X8:JWWT4psDOOZkDmGYaNFi9O1eSM1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698071567, "uuid": "82495875-d519-476a-8126-be5ee607cc49", "value": 1909248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698071567, "uuid": "4283327e-e0ac-4b09-9022-1b0430a0b242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071567, "uuid": "0627b696-7acf-4615-a28c-f83a4629210e", "value": "SecuriteInfo.com.Win32.PWSX-gen.25144.30122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f7605b-71b6-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1698073865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073865, "uuid": "4c6c189e-d007-473e-9e0c-45a4010a6b26", "comment": "Malware payload (Pikabot)", "value": "d895b647324b5cb0bb4969b37b0439fc", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073865, "uuid": "31fa6c25-bb6f-4a10-a33e-ed1dd9b49c59", "comment": "Malware payload (Pikabot)", "value": "d951ee151a21ee3c2ea6c56c07e01cebd069caba16d41bf0ca45c66a1e45054d", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073865, "uuid": "b585d5d8-78d4-47c5-94b7-5145051d2452", "comment": "Malware payload (Pikabot)", "value": "cf8812f30dd79dcaf4d1b1355bbe3c3a2b2bcc85", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698073865, "uuid": "4620d5f4-c222-4b57-ad1a-dea9c47a386b", "comment": "Malware payload (Pikabot)", "value": "555c631d7d61ecb7ae807de5f8b4d63d89cab4c5355f5408a4676bbc5055c6289cd7ea262d129d1f83f7de7be78529fc", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073865, "uuid": "092649c7-522b-4a28-9a45-bbb3117f6d49", "value": "T16783128182EE86CBC377AA7919DAD1125022F7BEA03650D443561217FA17FE82C5F3E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073865, "uuid": "44d40bd3-ea7e-4cca-83b2-716c9257160a", "value": "1536:Gf67vh1ofhBY+xClPEFySVGwpy2dz/0QFrp03/teq3UW1x2RkBU6bwzK+O/uNdtp:Gy7vh1WPF8SVBy2dbFFu/3fTjio+O/0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698073865, "uuid": "6340ea8a-0fde-486f-9a4c-a8d0933e41a8", "value": 85584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698073865, "uuid": "157bd8e3-45b0-4bf5-9f6b-d07c2c21621c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698073865, "uuid": "454330be-bec0-4ca3-87c6-46dadb5380bf", "value": "edma.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27adaeaa-7176-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698046278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046278, "uuid": "46881bb3-7840-4348-b16d-b2c3a935b2f8", "comment": "Malware payload", "value": "3bb8815287a32459d5bfdf98564065a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046278, "uuid": "4cd0a8cf-5ff9-464c-af53-196fe354acb2", "comment": "Malware payload", "value": "d9a270b2acb2c42995d6619ccf6feca53130f6159419d1ce9fda92986f6271fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046278, "uuid": "33ef6e30-de0d-4050-9c99-16bb2143005f", "comment": "Malware payload", "value": "0157be8bcb87e4c3f912ef8f47504f806e7d2bfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046278, "uuid": "c1881e63-83f9-424f-a161-d1ca55ee299c", "comment": "Malware payload", "value": "3c393c08ef900a6387777cc372d8318f5a12b56c472ebb8555771f7d45f178aaf28d81ed4fd1d50e87cd33f96f197d7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046278, "uuid": "ff05dc71-4e24-47fe-b570-145486e1a6cb", "value": "T103851251E2F1534DF5EA863A8E7026E06B323413AA17E75ECD00D2997C6D7D7C9C0AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046278, "uuid": "a9634ae6-60c6-44ab-8099-59e62eb1a20f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046278, "uuid": "9b300b09-0fb9-4ded-9276-83cc0989888b", "value": "24576:eH7PftKQS3RBAG+VU05VtPIoskKi11K0KljsU7CWLPyXpDmJzJGcO4ctsR47EY:epKR3/CP5VtPIospi1w0CrfnzVwtuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698046278, "uuid": "fc0efb2f-d565-4d0f-a39c-b9c75bb4be42", "value": 1800600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698046278, "uuid": "b0f63adf-4316-43c6-ba94-a8206080d280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046278, "uuid": "019691dc-5c64-427a-a51d-2905de7ce293", "value": "IOYrh1ua8V.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd9d4a6-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042714, "uuid": "cc37bd47-7bcc-4009-8a17-135eeed02dde", "comment": "Malware payload", "value": "e1ffa38a9a4ae801376552872819826a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042714, "uuid": "860e99fa-3d70-4e00-ba67-1cb42fcd7ee3", "comment": "Malware payload", "value": "da032cfbbf608c1b5ef0b7c44640fff54b038d1eeea3701240191323e5e70e9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042714, "uuid": "44dd935d-7bf8-4403-8d09-58bac6c90f9f", "comment": "Malware payload", "value": "e0af2cfa997806ab0fb864d54fe7e125c9a64a5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042714, "uuid": "da04bf0f-d313-4967-b1a5-16728a7c2859", "comment": "Malware payload", "value": "4c0cf2ca63acd25435b84226453e34324efc6f751a2e2a786fc1c3fcdd1d66fd96691caab6a928a422d5c4d50bd51567", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042714, "uuid": "ef66d83d-82bf-4770-96ae-61a7a80567e3", "value": "T103F2E126B9AEE035F4E381F40C7CF7495613E2AFB96B5950E9189D4DDDB2A0E90C41C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042714, "uuid": "b62379ad-2294-419c-9c01-2fa83d294596", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042714, "uuid": "789652bb-4f07-47a4-8c01-88d20c2c6559", "value": "768:eQZskz/lL60jhoqJT4hUHtStIETc141ADsf7TXrg:7sko0xJTCCoNuuTXrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042714, "uuid": "9798c7ed-7efb-4980-8e74-33118ba273d8", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042714, "uuid": "65f07c75-76b0-4252-88e0-e80755750a71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042714, "uuid": "6e2078da-1e73-4b7a-827f-51e8527133df", "value": "SecuriteInfo.com.FileRepMalware.31392.32372", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6187fa1-7146-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698025901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698025901, "uuid": "f3d38389-946e-485a-a764-dc5d62769004", "comment": "Malware payload (RedLineStealer)", "value": "20fad6ba0eadd133e057fe2caeb0e594", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698025901, "uuid": "a363139f-7a3f-467a-b7fb-f70d4ce5eaba", "comment": "Malware payload (RedLineStealer)", "value": "da8d3d346875b8581ce71d16decb70b904a5ae1163f68d62f6e258220644e72f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698025901, "uuid": "f17d2109-dbcc-4375-8d81-b1edd3714e68", "comment": "Malware payload (RedLineStealer)", "value": "221d7eced8c7033f6961c7a1c23989bb23addfe2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698025901, "uuid": "a8a42c73-fe19-49cf-aa18-6ef1cea2e579", "comment": "Malware payload (RedLineStealer)", "value": "54b69fe2e735f0cfffa4411219f671a74c7f8dd1a898555d6e39780b21d81887083bb00b568a9a48c26906b39e5d64df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698025901, "uuid": "59337dbb-e943-4095-a4f1-203a078b5226", "value": "T11C643A229682291EFB9611FA2419D1DCD045AB881E7FCBB69FCD4181D36CF786332D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698025901, "uuid": "7f4de1c7-243b-47a1-a9f3-16c906870de5", "value": "74b0d004a012cef41e106f80a1b919df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698025901, "uuid": "0e16c024-4e91-4d71-8052-e6ee9476d886", "value": "6144:C2HPkx/DKCUb1JSeR/F0zwQEHpOxG7lNoFop:C2HkADmz/EQM7ToFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698025901, "uuid": "74135e97-5d83-4d38-afeb-92fa5e04f118", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698025901, "uuid": "40151a57-7633-4b6c-8a50-159c23b68ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698025901, "uuid": "3f26c672-0123-4aaa-967b-dab32b0d4ebe", "value": "20fad6ba0eadd133e057fe2caeb0e594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97a4a0c-7179-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698047891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047891, "uuid": "aa058f2c-0709-4fef-b11d-bf9abcbc1c0f", "comment": "Malware payload", "value": "1dc239e160bf4cc0667793606033ce57", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047891, "uuid": "a0aaf811-f21a-44e1-9d26-c35bda1c1bcf", "comment": "Malware payload", "value": "da9a261660eaf29d2f1aebb3fd62a28bf43a92857fbd2d5eb3ae154ca9c742ef", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047891, "uuid": "c9a9ecb3-5bce-423e-b9a8-bcd86409b3bf", "comment": "Malware payload", "value": "685590ba1f960c947f0ae93b651b82b5b3ce8e30", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047891, "uuid": "8c56df75-1461-45dd-83f2-12b2b62edb0e", "comment": "Malware payload", "value": "7a4ff1ee50f496455aeb21db128a2e6f06f25d954e39a89f8b267dde0e2372d7d478e7043e4380d974970be329bd630f", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047891, "uuid": "cc1064c1-746e-4a66-928d-8cabc37ce7ca", "value": "T1DFF4233C7C84A05685BB46573C8BBCB8E0CA44D1D9E0DA19F2E484A7CA5F76DC5B270D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047891, "uuid": "ebc431dd-dd30-4366-996d-51f42d000ba9", "value": "12288:dp/YPF79cEv46apuuD7UFvbeTUEr+MkhI1v0Kp2q01sVbtjZn4VTcEvS1UwU:dp/YPFfv46apua7Sv6Xr+N20m2q0UbTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047891, "uuid": "fbea02d9-5cfd-4e42-9a9f-edf6d983ac80", "value": 756558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047891, "uuid": "dc6d7231-bffc-4801-9754-1871e02f75ee", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047891, "uuid": "6d295df8-27a1-4429-9bad-b69debc8a2bf", "value": "Sipari\u015f onaylamak.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53cffca9-716a-11ee-8907-42010a9c0042", "comment": "Malware payload (STRRAT)", "timestamp": 1698041198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698041198, "uuid": "35eb030a-2e9d-435c-acb6-9af05c9cc2b4", "comment": "Malware payload (STRRAT)", "value": "f78161b469e2aceb6fd94b097a5d32c6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698041198, "uuid": "6a5e7424-7434-476d-9e38-0e25887c6d07", "comment": "Malware payload (STRRAT)", "value": "dab63f2dbddb3c2a7b960644781a372a6623e53dc5cf007b45ba44e6d007b178", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698041198, "uuid": "4587b0cd-1004-45c8-aeab-8314706d272d", "comment": "Malware payload (STRRAT)", "value": "cb1cfadcee9d701b4e87ddebba4e6b1d60db8712", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698041198, "uuid": "32df268d-1a3f-46e2-8b56-d91d45831653", "comment": "Malware payload (STRRAT)", "value": "8bc5d3272ccede6b2a8285a2dc0b1c92e0978c7572274ded98803d2403969f07ef911428f50d2b45f1ca424505a6bac8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698041198, "uuid": "c78a371b-835f-4a66-8488-d0ca967ea3d6", "value": "T1192423DBBCE65A8FE1659701E34036BC745ACBC90D1229A9E5FF8505C82AF72C5EF006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698041198, "uuid": "814b405c-2bfb-4853-b853-09a8c734c172", "value": "6144:sZ97Gbn0DxOIdSrd40x3TPrAJhnjWlrw7S1g5/PfAIPyt6:QqbnJ20xDPsJZMc7Og5H3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698041198, "uuid": "0194c8dd-47d3-4b64-afd9-a06c4f8922f0", "value": 222232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698041198, "uuid": "fecf416e-08aa-440d-803a-2bb60555db79", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698041198, "uuid": "e1ea9d62-64e6-41d9-908f-594329577fd5", "value": "INV-220054120230921.doc.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52724ae0-71b7-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1698074267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074267, "uuid": "617f97b2-20e5-4d00-ad41-18360215b048", "comment": "Malware payload (CoinMiner)", "value": "f14fc4a357f7a9712ad9c32ffa9bc323", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074267, "uuid": "0ef15de5-4436-4475-a610-4a56c4aaf8c7", "comment": "Malware payload (CoinMiner)", "value": "db7fd782938292ae6d3e1ae892a1a1cfe84f5edca5bb99adc212710c41ec13b7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074267, "uuid": "21ad5845-bc8e-4add-ac13-726b924a4cf7", "comment": "Malware payload (CoinMiner)", "value": "65c4861e22b535f8878dfebd3462ca1d8d453c8a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074267, "uuid": "6e453a3a-86e3-4ec8-8cf1-03937c3497a1", "comment": "Malware payload (CoinMiner)", "value": "ea2321447f0bdbb57a3dbede8b88f79d626459668d1103d7c0ebe6bc2582ccdeb41248f869afeef301ba7e9791b2a9c5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074267, "uuid": "a95582df-3498-46e7-ae92-d99e37b824d7", "value": "T193448F13A2D1EC61DA2646718E2DF6E8362EF8708F58E657331C7F5F18701A2D2673A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074267, "uuid": "063cd088-c80b-4bbb-9424-f6c7bb1c2eef", "value": "780437e8c81fd22a5669fb9201842564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074267, "uuid": "8f283ded-4548-4e4c-94f8-652358f877b3", "value": "3072:6wX1qutTlLFYOr1M2uWAvbAAudTAxzBuUf2rN6roLiAgXFN/d5k6suBfrA:3UutTlLq21Mjvb9GSyrN6u+J06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698074267, "uuid": "51388c77-0894-4a80-806d-ae5771e4c76c", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698074267, "uuid": "9d145cf0-19c6-4d6d-a0cd-3dc3e64b7206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074267, "uuid": "0a270ae5-aa6b-40b0-86d4-d213313e3bdd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5badd9d-71be-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698077467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077467, "uuid": "9d9ead77-bffc-4aef-88cb-526edf601d01", "comment": "Malware payload (Smoke Loader)", "value": "cf605d075af19da664ac856ad3995e28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077467, "uuid": "858a4898-2483-4f3c-bfbe-ef1a9b33be58", "comment": "Malware payload (Smoke Loader)", "value": "dc0ba06fd4c66426d51e8dbe8f024cbaabac21d6562caa3eb13b550bbd79dcad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077467, "uuid": "ef0e75a7-7ffa-406c-8842-9005777805a5", "comment": "Malware payload (Smoke Loader)", "value": "b381ae007ca1ef55dbbf40cebced8e4eceb1ba78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077467, "uuid": "349de62d-e4a5-4789-8d6a-a3a4c221bca6", "comment": "Malware payload (Smoke Loader)", "value": "dfd881739d0c5b0881065eba4c33c53b838e132a8741b580f352373479f756acca2ed31d4d7cd359788e37a0f49a9459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077467, "uuid": "aab38a67-31f3-4e9b-80b4-35bc1c592fd8", "value": "T197448E53A691FC60D9564A328D2DF6E83A6EF8708E18EB573318AF5F18701A1D2733D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077467, "uuid": "26722b62-cd30-4470-8a97-99499a58c97e", "value": "a31d28b14a82da6e3b2b7ebbc290018e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077467, "uuid": "2b3eeea1-c24f-4b69-9a87-a20ef99569d1", "value": "3072:GwXtaOm9HLdvOrhNsDwz6eEHNyzblYQ23npt7vmN+RcPGv6palC50h1frA:zxm9HLNShNsUGA9YQ23pt7vYO6eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698077467, "uuid": "f97fc2ea-a16f-4858-a3e6-676877263571", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698077467, "uuid": "dd475c3e-7f0a-4c31-a672-b0cd24f4ca27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077467, "uuid": "4b701836-5fe1-4d25-b3bc-13cda3ad0103", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb1e45a-719c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698062718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062718, "uuid": "3838b556-00af-40b9-879d-7197dcc6e87d", "comment": "Malware payload (AgentTesla)", "value": "9ba8c55fd8dadc7b74062e737b652f38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062718, "uuid": "c0efdfa9-3262-4887-8c79-0ae938863d9a", "comment": "Malware payload (AgentTesla)", "value": "dc282458b7f95a4b266a3ad70bc379f56aa3b4ebaa830524d15f6ea61c2c48aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062718, "uuid": "3c943a2d-a0df-4cfc-871e-ac4402ade958", "comment": "Malware payload (AgentTesla)", "value": "c67bf0b24fa4c056dc958e11fb38c639066e53f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062718, "uuid": "90927782-6f5a-4ef7-b981-d52c9e445df8", "comment": "Malware payload (AgentTesla)", "value": "6f59afcf15e28eba5f3e3ee7fcabcc896fd597cc62c9fa2e5dd0def155965f9c3f50c9eeb7c769bb3ac23f1c4c1faee7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062718, "uuid": "761395e6-cb0d-4eac-ba56-b438cd9bd76b", "value": "T117E4222C63D80F7AC46C17F6ECA268AA1765F42E4C13FB4C4E4535CF1A06F56868539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062718, "uuid": "3c60226f-373e-40d6-a74f-0e3f3ef90793", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062718, "uuid": "85ca8561-af6e-4053-82db-d74fb3d308a7", "value": "12288:5hNh6sxTA6qNhkAc7gxwTV2Fin91Fh0ncgqMw/Q3OPbCKyfh:5DDxs6gD8gxwT40nLYckw/ocyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698062718, "uuid": "35f1d0ac-7626-4388-a6c5-4223b9ed9673", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698062718, "uuid": "3894d3d8-aec6-4888-8768-bd64384195d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062718, "uuid": "4e92432d-544c-43fe-b07c-d4e1e44c298f", "value": "rPO88537.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203bac8d-7177-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698046695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046695, "uuid": "635cacea-8add-4618-8b07-ac20d8b41a9a", "comment": "Malware payload (AgentTesla)", "value": "caad5207eb8bfab56ad24ec7c62faa86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046695, "uuid": "143e30ad-d759-40f5-a1af-84240e0b5aeb", "comment": "Malware payload (AgentTesla)", "value": "dcac4f40795aa0a02090728eb6b23f0429c260455e59d0ea062f44dc740cb6bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046695, "uuid": "f73b1c2d-18fb-4d9c-ad29-f86f9854ad89", "comment": "Malware payload (AgentTesla)", "value": "c66e8ddfa956bb583ace67aa3bb74f5f756b4875", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046695, "uuid": "86ebbae8-c42f-42c6-b9f2-af32a7c93a78", "comment": "Malware payload (AgentTesla)", "value": "1af7df6522532ed01f33aa4f2e820ca62ad486e4e1db5b80fd4a6a563ab622f0903e022925efb66c1a5edfb3843e8293", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046695, "uuid": "36df3e45-2478-464a-96ae-c10b3a388ee1", "value": "T19CF4F19C325071DFC52BDA729E682C64E6617577571FD207A06302AD9E0EADBCF202F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046695, "uuid": "e755ba81-15c1-4304-ab17-55a1ad7bbbb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046695, "uuid": "a0a5f7ce-829b-4caa-8fd5-de7096f2b4a5", "value": "12288:x6NZZgR/mZRM+k1BT5wQ4XVILkILX1kCi6/tDVsQiNvUFxfx83lnyAvsqChMzlra:xKgkZR5kPTmQpLLi6xVLiybyZtsthMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698046695, "uuid": "466382d1-2baf-4676-8276-6ecd7c0f7c2e", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698046695, "uuid": "bbd3c19b-c21f-467c-a93e-fb52dfe4ae58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046695, "uuid": "133acde2-bbe1-40de-9ab4-9e4637a3e473", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7856c439-71ba-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1698075619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075619, "uuid": "dc0d7d30-1f76-4288-8964-336d28e22bf5", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "fd45c562fc5eff907cbae20788720546", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075619, "uuid": "261fb35b-02fe-4e7f-8ce2-da2912e9720e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "dd133a65296d0f9bbd09f6de5a9fa143d25eb7b45c84832e20538c7ae064fc77", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075619, "uuid": "0c7a46ad-98ba-45e9-8b53-c9ecb3cfb8dd", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9c71ba1b2de29f03ab533ffd08d0bb2e9a0ae667", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075619, "uuid": "4a7b0e1d-66ee-420e-80d6-a672ef686020", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "7f1f823006e3d680adefe8f4a49a3a93e09ffbb7949026f4c5ae996f0b312958f14504fb7ec38c7cdefd261f9f676ab4", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075619, "uuid": "0b11c08e-8cfd-45f1-aaf2-5c29ae4f6322", "value": "T16285FB1176F95B59F9F30FB85ABAA611487AFC6ACF11C2DF1250908E0D21BD09970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075619, "uuid": "f70a6fb6-b87b-4091-8eb3-c2c253a32ede", "value": "037522269f8348aa17add864631a3f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075619, "uuid": "b71b59e0-44b4-4b53-913b-3370b2f1e03b", "value": "12288:NFV2CBJgmPAfSBsqe7E95HOfCjdHoOstzdg4yMuzzIo9X6a9DhvhVMAJk6vgI2:Dr7AfSKqe7E9h/dH+N66a9DhvhGAGFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698075619, "uuid": "ae89b715-18ef-432f-99ff-c1f793239f9a", "value": 1724416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698075619, "uuid": "cd2d11ad-e2cc-4416-ae6f-197ae531f80c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075619, "uuid": "d843b16c-092b-464a-966f-b7957dbc19be", "value": "fd45c562fc5eff907cbae20788720546.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6f9940-7159-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698033990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033990, "uuid": "a6a646b7-28af-4a1e-ad55-80dbaed30119", "comment": "Malware payload (AgentTesla)", "value": "53e7ff417abe87f64279f3372d5867a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033990, "uuid": "23a65c73-3397-4a36-a9c6-c7168cf0b9b0", "comment": "Malware payload (AgentTesla)", "value": "dd4a6bb436e33a55b18f88a38f23ea82b1f4d80cb170eeb7e1de6797b9ce59dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033990, "uuid": "365d6549-6944-40a3-bea2-fc187f928e2f", "comment": "Malware payload (AgentTesla)", "value": "f73db63b367fa65f0f18c16b486cbe1fb7a09175", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698033990, "uuid": "8a757988-a460-421c-865c-3f3a1b7f6d3f", "comment": "Malware payload (AgentTesla)", "value": "1fc7292ae38e82aa2cc9671ac2cc3439ad17cd072699d2e13a269b9b04d99d0a02f3e04b1f4151d71be2a783ffd3a8ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033990, "uuid": "f9962a54-b886-4791-be72-4acc23dfb1af", "value": "T181842A2435EF640C72B37F621FE8B9D94EAFFBA11A2A655E215407078A53D40CFA1732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033990, "uuid": "257bb52c-c677-4b29-aba2-142fb2cdaebc", "value": "12288:0m6ieTpk4K282PPNbs5ySqa5ssHaXTVUibX5Sqa5IEfpQBSoX6c6Z+Q:v6ieTHK282Nbs5yBa5ssHaXT5bX5Ba5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698033990, "uuid": "0e107f15-885b-4dec-9ae2-9313a13b6331", "value": 397380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698033990, "uuid": "1445fc62-45b8-49e6-a765-2c2179c821cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698033990, "uuid": "5442bcc9-4372-4afe-8a2f-49163a559a7b", "value": "a5735832824ae3edccb33bcf84be65e24a7cd74c9b4f809bb6544a74.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88137c3f-71ca-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698082517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082517, "uuid": "2e5fa2ef-d6cb-4652-8cf6-98c256aba410", "comment": "Malware payload (RedLineStealer)", "value": "70a7e037e54128ff83a8d734cd5c8fab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082517, "uuid": "c10cfd0b-d9ba-46d4-a38c-a5477ed17d31", "comment": "Malware payload (RedLineStealer)", "value": "ddc60eaa7659f391221ecde591a8caa09618df4fe3ddb1e5b37c27662577e669", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082517, "uuid": "4459b8c0-f9e8-4f3b-ad32-9c307ec6995c", "comment": "Malware payload (RedLineStealer)", "value": "a229224bea942b929dfea7e138ed1fa602a40168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082517, "uuid": "2b33a0f3-5a41-43e6-b953-cbb29aeef9ad", "comment": "Malware payload (RedLineStealer)", "value": "7d360f1c5def91a787052637ad1b841e727b9bdf0ad5b6707eba489dff729a1569a39002329da805e1af6e44f47d5187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082517, "uuid": "0de5ec90-fc27-415e-8be2-bc3f0123099c", "value": "T1377429C033C494DDCC5E88F9A9311E748670DA52A2CB7B537C8AACF6386E3595B051E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082517, "uuid": "73c1240b-e2c5-4d60-b590-09c6afcc6134", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082517, "uuid": "bcd9c36f-2646-49fb-bbcb-fd360c968d57", "value": "6144:p4ZY8qXiRhZuTv1+3RAL0I2lnap792YzUBBbvG2N1KyNTi:OZrqSk1+zIh+BbvGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698082517, "uuid": "7957763a-3f3e-48f9-bfdf-41e3cf4747b9", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698082517, "uuid": "f7af05c2-d45d-4d4a-be97-84e05ddaf46b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082517, "uuid": "69af0229-16c0-4daa-825e-2df085a0b9b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f871c0-71d3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698086535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698086535, "uuid": "eb3aa4c9-0566-46c5-a380-84a2fdb0e5ba", "comment": "Malware payload", "value": "6f761d5816c0434b920cd6ae8cd0539e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698086535, "uuid": "085a9fc8-c0aa-4490-a22c-1f01c9165335", "comment": "Malware payload", "value": "de080488de6cb4a9876c5f7e77f819c549e23e03128552b533b7d735646d45ca", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698086535, "uuid": "ef31926a-8014-4e68-9f1b-5a761f890379", "comment": "Malware payload", "value": "dac460b64e53f9afac455e99c6a9e8f6f97025c8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698086535, "uuid": "8e213285-2fc2-4831-974e-ac6991a1526d", "comment": "Malware payload", "value": "6b9003413e67de334b987f7f1725e6bfb9cd75c91af928b07c5ac38b50bf2b40ce78b43c7d9795c7d8367e3cecc255eb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698086535, "uuid": "a4fdea1f-13c6-469b-910b-aec8e2bd2e1b", "value": "T186D423B48270562DA6B35C3F5D092B93FD6BF9204E23A1B8CA60C34D98753EFE556483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698086535, "uuid": "e572f161-ee0a-409e-9fbc-61d936729e70", "value": "12288:bAHVZu8rLVp90LHQLmUpTPVyLLqN9uCsaQv2mSgNliqXhb:MHVM6p9KHQ7TdrbuCsaoagNlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698086535, "uuid": "797489ed-4438-4704-a503-ef0a2e036dff", "value": 621814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698086535, "uuid": "961b9c6a-3e53-47d7-b51b-9faf2af156ef", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698086535, "uuid": "06d4a5f8-d356-4173-9efe-5d474ed5fb9c", "value": "PI NXC009695.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0cd670-71ec-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698096917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698096917, "uuid": "d2b3d7ed-7518-49ab-a074-92673477a5c8", "comment": "Malware payload (Stealc)", "value": "7a3b5adbd68c3ff1bdec9611a06ed6ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698096917, "uuid": "51e1b823-1031-4f99-a116-adc5c29ff8c6", "comment": "Malware payload (Stealc)", "value": "dea85df755f9b6e7e483c5920de559cbe42ec34ea528037ebde0d627e40c0ed9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698096917, "uuid": "5a8757e7-3a75-4a09-bf08-b4e063e1bd2e", "comment": "Malware payload (Stealc)", "value": "79787897ae3b6607c3bacc40f82b10e16412b22a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698096917, "uuid": "4cfc0886-6f2d-4393-be0d-a742616bc169", "comment": "Malware payload (Stealc)", "value": "f90bc873d6db0069c4c5bb1423ff2748382df929b437d8e7fb00322d9c2352884a5d456c84529a4f7ebd426b30b105bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698096917, "uuid": "1c5cefd4-11e1-488a-b372-797cb2b36deb", "value": "T196448E026AD5FCA0E51649718D29D6E8362EB861BF19EF6733187F1F98703A1D363213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698096917, "uuid": "b02d0f71-92ae-491e-977a-c00af7166039", "value": "8476da44cd20575d5795ed699abb22f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698096917, "uuid": "3db42a1d-aa56-4af9-94b5-3975d5709224", "value": "6144:e7bkPVL2ZdZkBCmYdp4yn4ORxsnRLealfdB:e09iZdZkxY8i4Cxslec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698096917, "uuid": "3419f507-1deb-4207-a419-fb640e6f6e2a", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698096917, "uuid": "d74d3343-bc16-47f4-9d06-71c0f42a3d9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698096917, "uuid": "0343678f-8e95-47ad-9073-321da727aac6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f261285-71fb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698103547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103547, "uuid": "f62cfb0c-a2ef-4232-9f7f-4a8257b9889b", "comment": "Malware payload", "value": "cb621e1daa5f7f43aa0f89d7b602b047", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103547, "uuid": "ab97d951-bbab-4ccb-9e35-a5b6f7edfe4f", "comment": "Malware payload", "value": "df5dfb2bd88b1e44ea496d6f948271524efa9cef99285eeb9840b02d81bcaeb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103547, "uuid": "011a2304-fd94-43e1-afa8-d60c5147d6b8", "comment": "Malware payload", "value": "1edec40d7c07a8642839db8d5c42ed2a9a6019ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103547, "uuid": "0ab89f74-ea2b-4d16-a75b-16a1f4ef56e7", "comment": "Malware payload", "value": "eb004ead2e84c1121f9efeea60d8a6662cec264ef4a2b3be16d180923be316519e5cd6cd42b698d1f4a4a9943a4a9471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103547, "uuid": "fb41b37c-605e-4357-93cb-2a80b7be5d5d", "value": "T1B4530913BB9F85A2C354573AC6E7A1148F34D581F613D60EB98EE34A980B7F6C94270B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103547, "uuid": "80e3c554-70a3-4697-9c5d-2a8b01bac040", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103547, "uuid": "b65f1dab-9e0a-4ab1-b3c3-196c39356305", "value": "1536:pdY0Ka77qRjKeIoVk3SfraKZRl4Bxv4BxQ/sSV:UoqRFVkCfrxSBxv7/xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698103547, "uuid": "72f74337-2846-4823-af7e-de3d1250cc1d", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698103547, "uuid": "35ea2538-8c7f-4de5-905f-a62864ba797e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103547, "uuid": "9de40db1-cb43-4a89-8332-9461c2fe3c23", "value": "ryyy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65200e24-713d-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698021899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698021899, "uuid": "2f83514c-6d20-44c2-986f-bcb15b691219", "comment": "Malware payload (RedLineStealer)", "value": "e27130f8063f5254139884dfea6e03eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698021899, "uuid": "ce9818aa-d439-4328-bd7b-682575119446", "comment": "Malware payload (RedLineStealer)", "value": "e0f8898a3b8a28586efe65e9afa0c08e252d3b41f1380ebbb93d3226dc5eae34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698021899, "uuid": "30b7cc92-84e6-475d-93b7-842d907f4f48", "comment": "Malware payload (RedLineStealer)", "value": "91734b4bf7920e68c4d48fdeff7cba47fc561e7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698021899, "uuid": "efe04f5f-5556-4f87-8e9a-645e7efd3f96", "comment": "Malware payload (RedLineStealer)", "value": "046095509fd1e9fb35dec7dce3a6ed623a22955d2654e429efffbdb32e7f75f63ff28fafb6c9df44ef4a822279c527a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698021899, "uuid": "3d016df7-ebd2-4174-a465-86203f30d722", "value": "T120B48DAEF5D0F831C077C572C81F6B28D4939E788B0617E77EA1C56D16882E2BA764C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698021899, "uuid": "1a2bbd80-fa8d-4ba8-aca6-5513904aec87", "value": "d52ccff4f325ce6b295038c3a3f9150f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698021899, "uuid": "9dec1494-8022-42b7-ae8c-26740f90d7ae", "value": "6144:w/HGQrV8JDPMT2/vpUOXia60CoOO5R2ZnxQdLTJFb246eQB8ApxANh:uGQCLMUvpUOXia60C3O5R2sdLu4uBPCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698021899, "uuid": "3c1c318b-d985-4136-9fad-8fd5c5a266d7", "value": 509512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698021899, "uuid": "34315c44-631f-4e98-8ee5-80017d8f045b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698021899, "uuid": "c2146016-e0dc-4c2d-bd56-2283e1143b7e", "value": "SecuriteInfo.com.Win32.PWSX-gen.10927.6350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0b6189-71ba-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698075622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075622, "uuid": "5b932a5b-d719-4bc0-9368-d16705626853", "comment": "Malware payload (Stealc)", "value": "9d706a80bab58922abcbc35284853f2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075622, "uuid": "165b05a1-3130-46e2-ac1e-d1adfe796e43", "comment": "Malware payload (Stealc)", "value": "e196ac0a3565ccfb4ca1668d436db83b5b94e0b37864be7b66e0c54701446b84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075622, "uuid": "0f5483fb-026f-41a2-83d7-6a5c80c0c5cb", "comment": "Malware payload (Stealc)", "value": "82e685d0703263d8a90aa2f22379a18cd86a1d85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698075622, "uuid": "de29a8e7-e80e-4317-b6c4-bd8d51476ac2", "comment": "Malware payload (Stealc)", "value": "b4dd72427f6f80a8947bcc2d40040c69486448bb93292926154dbf3963f6e79633b8ccf0e9eb7b0165fd9d1d48e1782c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075622, "uuid": "ffbd4dd5-c8a1-4633-bd26-2ac12785ae8d", "value": "T18A448E43A2D2FCA1D9174A318D1DFEE83A6EB8708E59E65732187F1F14701B1D26329B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075622, "uuid": "7b7c9edc-f1dd-46ba-ba21-a0cdecd67a70", "value": "780437e8c81fd22a5669fb9201842564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075622, "uuid": "ef5cb514-b5b5-4dcc-b055-5566129d0bc8", "value": "3072:5wX2qkM7uLFzOA13ullm8jwSeM0M9Z9eG1AF0H4+UNdV9MUJ2/MQ5k6frA:GTkM7uLRt13Mw8H0M9sKUdJOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698075622, "uuid": "56863d27-ea6e-49a7-a184-a96aa764e92c", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698075622, "uuid": "35582340-8475-4d14-a2e9-d6eea435d454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698075622, "uuid": "569637aa-99d4-4f38-8838-bed4ccb6b8fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ae0b96-71aa-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698068769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068769, "uuid": "f8056bd4-160c-4877-b620-7adcf3371095", "comment": "Malware payload (RedLineStealer)", "value": "1c4e88aca06eb951fc3ecb4d69483b61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068769, "uuid": "7f6d0caf-0acc-4d5e-bcf4-273a4a87ec22", "comment": "Malware payload (RedLineStealer)", "value": "e1baff18a04574c3a9e1854aa5482e29fee7d2edaf053185b6691cdeaa4f9e65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068769, "uuid": "86e393fa-6b78-4e9f-a0a7-d8247d2a7b84", "comment": "Malware payload (RedLineStealer)", "value": "3314f48dafe05ab799cc30d1ee74c0296cc26433", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698068769, "uuid": "ff2c401f-23c6-40be-85de-e2d94ecc026d", "comment": "Malware payload (RedLineStealer)", "value": "7bf7b5229ed6a057b8d35cf7ced69f0b52b28ab677212e630b5962ec855bd9f370b563e16e502b7e10cdf00d241e3fc4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068769, "uuid": "84d0cb4a-bcce-4774-8ac5-7564c096a239", "value": "T1758533A34BE40832DDB9573415FA03830F32BD71BA7B449B3695692D0CB175668B237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068769, "uuid": "e555f0b1-4e15-43a1-9664-54a3e8021cbb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068769, "uuid": "35840b1a-ccee-42ce-8f49-3e4a4576aad9", "value": "49152:usZBCd6osnk+QqKMtKhRkg7uYPQU0WJrJQMDmOy:tSd6o2k5d7raMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698068769, "uuid": "d4e0950c-bc0b-47d6-b5c1-81ceebb369f4", "value": 1762816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698068769, "uuid": "bc07b496-3109-4fca-a75e-fdfd16269397", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698068769, "uuid": "dbb94089-5a4c-43c7-a2fb-d24aa9a9a5b1", "value": "1c4e88aca06eb951fc3ecb4d69483b61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcd7af9-71cf-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698084624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084624, "uuid": "e9f125fb-6c9e-4968-8397-b5aa52477b05", "comment": "Malware payload (RedLineStealer)", "value": "d1fbea3c1c3b77170f925787f319114b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084624, "uuid": "ca321f8e-2f40-44db-9ecd-265177b68675", "comment": "Malware payload (RedLineStealer)", "value": "e39701f5394430cbe23d118f6ddb57aacb2bab26a59546271dfcf19a96bfcf8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084624, "uuid": "5b027785-428a-44ea-af26-8774a2486429", "comment": "Malware payload (RedLineStealer)", "value": "e692e086ae8c1d208319a9aad3631500d3a5f008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084624, "uuid": "4fa91f04-0fba-4509-b32a-2954d5a5a387", "comment": "Malware payload (RedLineStealer)", "value": "11ed83e15b88e319c6f5b6f6101892136cf78ab3327e47a73c3443908bbbd45b0ed9fc304aa8b58e4035ca9914d2e9a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084624, "uuid": "416bbc0f-2e47-4273-9ebe-a88adb8177b2", "value": "T120752313AAC8A972ECF8537069FB234349373C71AD6843175356962B28B23ED593472F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084624, "uuid": "6c3ae86a-6a20-4324-9107-e5253036f8f5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084624, "uuid": "7dfdba9c-ede8-41e1-a791-6e1bfac2c947", "value": "24576:SyQ0+Y6j74kZsRRkvaI8gvXuxd5NnXV7fj7PvKwTyNRltsQdd0sPki2J6DLI3/Wa:5QhXdyRcJvXuxddzj7q+yN9dZLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698084624, "uuid": "789ecd71-c04f-4e9e-90c3-3d2519e417eb", "value": 1584128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698084624, "uuid": "7d777fcf-6e6f-4afe-83d8-1f4c06a223a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084624, "uuid": "3d0390b0-0b07-4fbd-b57b-dbafaf72e720", "value": "d1fbea3c1c3b77170f925787f319114b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808e022f-71b7-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698074344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074344, "uuid": "a8e6bf74-e231-42ca-9be6-6edd3495da53", "comment": "Malware payload (Formbook)", "value": "b8374940215d019e8690b9d9362ad745", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074344, "uuid": "c35aa8e0-aa50-44b3-b2cd-e1b2fdbf18b3", "comment": "Malware payload (Formbook)", "value": "e45e050839b17e21868dcd7e07c4f3ac4cf94fe727f51c6e958b680739e5f23b", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074344, "uuid": "a5dace1e-16fb-482a-b4a2-5b3d6334c2a8", "comment": "Malware payload (Formbook)", "value": "d5b6d5efe66c8629dd86d22348f1d832a6a2f650", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074344, "uuid": "6976c6e6-7410-40f5-9f8f-61d6f4b97778", "comment": "Malware payload (Formbook)", "value": "addcd134a7bac449db1a3b27f99e424079f089e802690179794475a903164605555c5c0dd445e053ea2258e341b945b4", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074344, "uuid": "512b974b-2992-47dc-a083-a667b31c73bf", "value": "T117C42326240ED5F1FB5329E8261C90E078A380D5DEB797FD9F50CF78A855A2E09E9720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074344, "uuid": "4ae9d7e6-ee2f-48cc-ba0f-7d8c8924e574", "value": "12288:ERynwNk3HBjobp32Tq4v9cuds24sZUfyIPdYoyl:ERTS3HB8l3Sq4evXIUffPyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698074344, "uuid": "de670c90-a800-4361-b768-0196be6d1d6b", "value": 581179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698074344, "uuid": "2897bf92-679c-45eb-8202-3e0b06d1e918", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074344, "uuid": "e83fcdd4-bc7a-4da5-8201-6a84e2bbc711", "value": "FINAL SELECTION SAMPLE QUOTATION.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9faa20-71fb-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698103593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103593, "uuid": "7a329b18-940a-42ca-9e43-8f48b2c6db05", "comment": "Malware payload (Stealc)", "value": "33dbb1a88dde7f4ca1c3eb4793a49259", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103593, "uuid": "762f1604-f3cc-43eb-b983-84c72f482aeb", "comment": "Malware payload (Stealc)", "value": "e5fceb9a524e67e0e9de3a7041d45e822a2ac51f111f77cfb821e9380b453fcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103593, "uuid": "7ec9fde7-2be1-4f01-9433-54eeb94a788a", "comment": "Malware payload (Stealc)", "value": "38f6cb34b4272c7880adf8c2ac096a3b3936bcf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103593, "uuid": "682c805f-c91c-4e77-ad18-8c58e5cc661c", "comment": "Malware payload (Stealc)", "value": "8c1cdee7f8e9b302cb5d21c05ca29297e11b0540f8e983acd0d0afe637620c1f2330d884c3e9d2a7e6fd613cf8157e5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103593, "uuid": "11e03491-ae69-4075-935e-9b13c1c29170", "value": "T12A448E03A2A1ECE1E56645318D2DC6E87A7FB861AE59EF5733187F1F18701A2D263313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103593, "uuid": "f276ebd6-f2fc-430f-9b63-263288cd97cf", "value": "a068146a0be0aaa89f57a8b52abbacb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103593, "uuid": "3fb32f68-1b14-44ad-b3dd-c76575720ad3", "value": "3072:3sXnpC3BgVAcmkmaLbbUtOtZPUwdvxNCUdSfIv8oXj7SP3mIUhaGe/n5mQrB7:Yu6VAkDLUtO//NCSSOXjmP2IwaGJQrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698103593, "uuid": "7c52afb1-bd25-4234-945a-05b1cbbb1e70", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698103593, "uuid": "92b7a9f6-37b4-4cef-b238-52b424c7d74d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103593, "uuid": "7d0e3df2-fb22-4db9-8267-dce102edb819", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e62c30d-71df-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698091413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698091413, "uuid": "b862054c-e5ef-4aac-9498-5419da9bd006", "comment": "Malware payload", "value": "3dd0c8098f91c4fe0cb9a085ef76b1ce", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698091413, "uuid": "8c8b7bf2-a6e9-4a85-86ae-32f5357219ea", "comment": "Malware payload", "value": "e6dfdf587e48c0d2b8dd2c08fb7f43a3559655d01516b8435866b86abe17a4fc", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698091413, "uuid": "e0240de2-0508-4fd4-bc43-e61d15a21285", "comment": "Malware payload", "value": "67c881d76418627e5e13f9ed170389d7deefd738", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698091413, "uuid": "258bfa2e-41ca-4234-b0fb-e380e1e0148d", "comment": "Malware payload", "value": "043f8e8b20c2f1705ca7ec15cd484d189d735cfc74c8374b4b98ea65c1893c1332de23bf382622063e0f521680348d70", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698091413, "uuid": "b1fdc3f6-1890-4c82-a8e5-5028e2f44906", "value": "T1C921ED050BDA1B69C3B25A7B59FEF3038436BC81D862CF2E42C4028C58A4120A8A4F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698091413, "uuid": "76b7371f-6d59-4f0c-bf55-0ec70d077f5f", "value": "24:8y17pIgzcq3JBkr+/44Z5ws4fNVOOa55U8UZUmfWhm:8QWA3JTALf2O4evqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698091413, "uuid": "2447c349-173c-4c5d-9c10-133e3add7bf8", "value": 1135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698091413, "uuid": "bf5e2914-dd01-4a26-bab4-b2198691bfca", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698091413, "uuid": "a844a753-b9aa-4b57-a421-47a6a06f5fdd", "value": "c6965db865c136786ed9b9c5c3a06350be05d01063186c145b0e4c4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f3e8bd-719c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698062832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062832, "uuid": "8f45d8a6-d775-4197-93d3-1927508f49ad", "comment": "Malware payload (AgentTesla)", "value": "6c7df4e48b72ec647cfe3901ee36a0d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062832, "uuid": "c0a50fa7-2bae-4383-8682-c697297b3ea6", "comment": "Malware payload (AgentTesla)", "value": "e774f64c2078e0b89fa7a65590044e70212823f02b0300636deff0ccb5a36971", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062832, "uuid": "962980d5-26da-434b-a278-3ff323cf2a1c", "comment": "Malware payload (AgentTesla)", "value": "11ffdc4cdcd4dd7a7cc42780693f70df315391c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698062832, "uuid": "9c93d527-b4c6-46d3-8025-a9812509c5a7", "comment": "Malware payload (AgentTesla)", "value": "4a63b6ffea5c25d608abd2ca13c5c8f89a82c20bdc10b37fb96e5b4a2eaaaf8229dfa9f0bb5875675ee64f8bede3d4e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062832, "uuid": "72a5718f-e4b6-4679-84de-3edad87032c1", "value": "T11EC423227076A277CEDB46F0ECA34A0B1FB681AB5566D1DECDBA30969DC039009D4377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062832, "uuid": "00b99ee9-3395-49b1-8c9e-c52aca172769", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062832, "uuid": "b8ff0aad-f282-407a-80e3-8583ee39fe2a", "value": "12288:fMCvoIvsHj5XwMFr4R04mfCR50/k1+ikYPiwkgB:fMCvoIvsFh120iR5eMv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698062832, "uuid": "0b5889d6-114f-4e46-b25c-e8c3941d8a9c", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698062832, "uuid": "e806ea21-e42c-4855-897e-650f88565019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698062832, "uuid": "ccadb2ad-c6f9-40bb-b994-97c153264cf4", "value": "Statement Of Account.pdf_____________________________________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4c8e26-7139-11ee-8907-42010a9c0042", "comment": "Malware payload (Healer)", "timestamp": 1698020405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698020405, "uuid": "e466c0f6-f663-4dfb-b1f6-ca4fb809f595", "comment": "Malware payload (Healer)", "value": "f8c81b9a2cd2778c624f0cdf49f5668b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698020405, "uuid": "62992096-a377-4179-a9ad-a0dcd31be1a4", "comment": "Malware payload (Healer)", "value": "e793813b72ce563f787a19edb3bf55a19b3caf2a08a47602abf10758ee8a1fec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698020405, "uuid": "1e0d0fbf-ceb0-410d-8011-699ebc327073", "comment": "Malware payload (Healer)", "value": "3bb0ce33d29a62cd7bd2dbc3a3df0ada54de7ad0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698020405, "uuid": "b2caed17-1536-4ae6-963a-4ca2fcb81f40", "comment": "Malware payload (Healer)", "value": "bf961a74afa78676bddd0eea64e0ba833c7250c45ed67e8d313efc41a44a9429ec692aedbf3eb5f5643eb70d0c191e4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698020405, "uuid": "6cdd4ee8-5139-4666-9d57-3c5142cf2983", "value": "T118852382B3D44923C77167758DFA52C34B32BCE54838A29B3351AE098DB64D4F539B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698020405, "uuid": "9fb12388-56b7-4066-8f4d-e506093976b0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698020405, "uuid": "5988a2cc-605d-4627-9c72-4afd627a2d79", "value": "24576:9yL23NnVwZ/quBszeE/DEUIl7Ux6cZVQta263rjOjdn6bgLpRdGfUVPeasq8yN:YLsyZSxN793zvQQ2wX8dq0AKea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698020405, "uuid": "2f67006d-3685-4214-85e8-3ff96961c79c", "value": 1828352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698020405, "uuid": "6348bc49-fe45-40e8-80c6-cc3c5ee164b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698020405, "uuid": "99c74507-5892-4b6b-9128-efc18d704fae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff12db5-71db-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1698089724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698089724, "uuid": "19d047d0-da95-4a53-b8f4-ad7cf5a16295", "comment": "Malware payload (LummaStealer)", "value": "62fff18212c8be20562865c69f551996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698089724, "uuid": "211f98b6-6345-4880-8a4b-49baf78b5fc2", "comment": "Malware payload (LummaStealer)", "value": "e82947097dd2700b1d14eb33d3de85751a7786332b5c657824792cc1941e1eae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698089724, "uuid": "0b301613-51fc-4a32-a10f-ac3018b70f21", "comment": "Malware payload (LummaStealer)", "value": "676d2d5373447a1f4dc5f907fbf176f3dc611525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698089724, "uuid": "0ecd8af8-4dd3-4462-be5e-6ae20f5f1525", "comment": "Malware payload (LummaStealer)", "value": "3e5ecf571b77eee7a5a07b6913d63127aa7549e1f4e7d2e0875d600efa80ea42b43290630c944deb1f8514ce90c90405", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698089724, "uuid": "2a83c6b4-9d6d-42fe-8f80-e7c9f99583ca", "value": "T14C752387FBF8A4A3CDB1337068F50363023A7D5558BCC30B6754AA0E5AB11906633B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698089724, "uuid": "4d7053a7-ff81-4863-a148-a32b1c2de63a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698089724, "uuid": "1e0199f1-5711-43ef-967b-ec316ddf6566", "value": "24576:OyCR7wpXTSYA3ghE0+kY61B9QssEgW07/Oxt+zTy/r5ZUohwiYM7GR7ZAqTPXvjO:dCRG2YgghE0+GN8/ktEy/Yo4M7GR7ZAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698089724, "uuid": "a0d707ba-70a5-4b27-a4d7-984c35327769", "value": 1567744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698089724, "uuid": "53ecca07-de9c-47cf-97b6-f32260a3a3c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698089724, "uuid": "e544aea6-fb1e-4ead-9e96-947b2b3a3b09", "value": "62fff18212c8be20562865c69f551996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7559b846-7194-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698059293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059293, "uuid": "4d153253-d367-447f-849c-5c2605d2486d", "comment": "Malware payload (AgentTesla)", "value": "aa0744bfdc8e6a693396ec61176236a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059293, "uuid": "32031acd-20b0-430d-8e07-dbcb09ee9e1e", "comment": "Malware payload (AgentTesla)", "value": "e85c646cbcaeabc47c9b4e77e3ba1a65d27950a6d564cb988c55dee550e42e44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059293, "uuid": "4493addc-4f88-481e-b6f5-7fbfc0694e19", "comment": "Malware payload (AgentTesla)", "value": "ce2534a6f685c450207824250c8756334b31b123", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059293, "uuid": "888dc678-a01b-491a-937b-a2c4eff59f4c", "comment": "Malware payload (AgentTesla)", "value": "64a437fd2e53aa338774b24f3a4666706f9b686a39069aa63fed8287ad5049b1eafed829464257136ddab3630fe8f57a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059293, "uuid": "3bc4fe9d-32d6-4c32-9e05-e5bc39e6c32d", "value": "T190E42346725F8502E76DD99F2D52C62880EE5F2FB4F06E61E27042C50C689F82C7AB9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059293, "uuid": "87cf381f-cc99-4d3e-9c93-712e057c07a9", "value": "12288:P1yTc66TU7mGn48xpKu04EkQYmrQUgcqVLfODJQHdCIYcbrAYMhJY10loB:QTZ7f4CpA4Qd2lZGNQHdCIYcPAJVloB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698059293, "uuid": "592c50a5-f923-430f-aa76-4c30a644c81a", "value": 658230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698059293, "uuid": "6d4b185a-00ad-4a1e-bba4-b5d328f22788", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059293, "uuid": "f29ebca1-e85b-461f-ace6-99a738a3d82e", "value": "PDA FILE.XLx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8574ea29-7192-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698058461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698058461, "uuid": "5765a420-56b0-4304-ae91-acf6c3352d9d", "comment": "Malware payload (AgentTesla)", "value": "6e24839c873a9397ea64113e524ac24b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698058461, "uuid": "a0179953-7603-4bd7-aeab-16729f84282a", "comment": "Malware payload (AgentTesla)", "value": "e8c2c3aebb80da29f56efe6d59c8566d5ee6f3ad1dd339bef2009b011f587ea3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698058461, "uuid": "0af992b0-4945-4594-bf40-2e14b7fa5c5e", "comment": "Malware payload (AgentTesla)", "value": "1e993533684b6190356c32f0459888b1deef73e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698058461, "uuid": "11d57ab9-95bd-4e1b-b7f6-55159a25057a", "comment": "Malware payload (AgentTesla)", "value": "e42b8836033003d3521871246984ce67c4ac21bd672bdc17285690d1d49e09c98a1f1715f04f458b0fa911bc513bd8d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698058461, "uuid": "e6f92c41-408c-465a-920e-c1fdf614da37", "value": "T17BD423AD17003ED1F8B42D373E255F97A5402D5E572B7AA5A3CDC6DB8C130BA0EA8980", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698058461, "uuid": "14c832d1-5ab7-4a5d-8b46-5612839af108", "value": "12288:g0MZmJfOFzwUpucBjul4nHffhP8GEL1e6vqGqO66QgKP96wE51PrJ:g0WcSbny4Hffx8GjQqcVkPkwkPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698058461, "uuid": "702bb9f1-16e9-4f4e-bc6e-161839542179", "value": 609893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698058461, "uuid": "21238a64-54c9-4ed0-9f30-53676b7073a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698058461, "uuid": "25d968f9-ed84-429a-90dd-7e6bd63df81a", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd35f30-7197-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1698060760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060760, "uuid": "dadf8036-9af3-4d27-a083-0f52e29071fb", "comment": "Malware payload (DBatLoader)", "value": "a6ffb64e02fe3e8fa84f64709822d43a", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060760, "uuid": "18a00fee-9f8c-4136-9b8b-af730cb846ca", "comment": "Malware payload (DBatLoader)", "value": "e96a8b745a43715726c8f062c5e5774fc013a893fac854debe567951b36c149f", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060760, "uuid": "e9537d6a-5aea-42c2-a551-ccda7abcf6aa", "comment": "Malware payload (DBatLoader)", "value": "7da69eb12f293031e56e31d178943a7b750ba5df", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060760, "uuid": "9fd70f52-d02d-4954-903a-f71ad0c47a79", "comment": "Malware payload (DBatLoader)", "value": "6d08a0c5ebd3cfa2052e1f197a8dbe24c43bd197cb134b38c040a1ce424df9e27a7c517f2f218aae476892c87776fbbc", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060760, "uuid": "9c3270e3-aed7-46fc-8acd-a2c9e9b3bd22", "value": "T1340533F301E76024AB370BB2B75CCDD714EACB9F41D8F82493F99C423A69894745AD68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060760, "uuid": "76c8948c-376d-4090-8f20-48e4834abed9", "value": "24576:hFAF+WGmd/sem/6omvExrD6SfxakPxKLux1318HL64u:rWGmdUTCvExrD3fxakJSHL64u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060760, "uuid": "71a2729f-b496-47f3-8059-5de671cde408", "value": 858229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060760, "uuid": "c2ba3ea7-66e4-406b-92b0-5cd62a15d83a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060760, "uuid": "0cca252f-437d-4e62-8d37-857c574eba19", "value": "U prilogu je potvrda narudzbe_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9591457b-71c9-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698082110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082110, "uuid": "4bf6a5e7-758b-49b4-85ff-c407735bae01", "comment": "Malware payload (RedLineStealer)", "value": "5d6f60aa9b1b28983f5a1fda117defb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082110, "uuid": "d5b47c1c-d89a-44e3-9a37-a25423abf292", "comment": "Malware payload (RedLineStealer)", "value": "e99ca734f760f8b2b1483bc7970b3766ac11d72a340480bbf1af3b4e07f7ad48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082110, "uuid": "3892f116-a646-42c0-bcb3-7b9291030834", "comment": "Malware payload (RedLineStealer)", "value": "840286bdad7d85b83bb83da6dc3769d209f47cb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698082110, "uuid": "ef7edde5-50de-4cfa-a139-6d240be31ab5", "comment": "Malware payload (RedLineStealer)", "value": "b35571ccc787325b5fdcb08cdc526d364341ade02aff06802664619fadc926cb42531480bfedffe96b4e1ec6e16d6df9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082110, "uuid": "66de8b79-3e26-424f-9083-82a5697c8095", "value": "T13E753341BEE554B2E87567B230FD53830E3A7DA2497A8A0B3B88D54F1CB2784953173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082110, "uuid": "e46d930d-d2bf-4822-8a7b-d78f71e352bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082110, "uuid": "58955814-cdc8-4f3f-842f-f08a7a3fe621", "value": "24576:lyW5PH3exrvzTpQVx9j0r5I+XLr/GNJhzcwKNoGbOe3NIwzBeDt/pPxYSpQlh:AI3exrvzTpygrH7GNvHKVZNITt/p2Sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698082110, "uuid": "608a78ab-d842-493e-a49d-4cb4f069f47a", "value": 1584128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698082110, "uuid": "3e3b2ae8-cd6e-4469-ae4f-3ee2553348e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698082110, "uuid": "eabe27b1-8280-4d8f-95a5-ed10713ab1c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d22681-718f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698057195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057195, "uuid": "6d506e7b-5a84-4e87-8604-d26f46e559ca", "comment": "Malware payload (AgentTesla)", "value": "8df8784c4c504ac7e235a0e42c1b1525", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057195, "uuid": "5587e777-3ffc-421a-8bbe-774cec35d7ba", "comment": "Malware payload (AgentTesla)", "value": "ea652ce006bdff45184664a2c691ca5c6256fc1a686dfa8721cf5a9d2e1f4593", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057195, "uuid": "63d3d8f7-ac3e-4243-a696-b81e0652197a", "comment": "Malware payload (AgentTesla)", "value": "32bb9133b9258f9e86d5bbcf69ed052b40e90d65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057195, "uuid": "0d7b3adc-605c-46f4-90a3-ab650ebb75db", "comment": "Malware payload (AgentTesla)", "value": "014c7d3b82c391a69bdb53a697200a6d6dbd91e3ba6cea68425d9496ddf8dd3ba6a4c0f0b71e74270ed02be55f095158", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057195, "uuid": "9fb16743-525d-44c1-888e-972a09cbd1a3", "value": "T181058C44E5D96480E83A9B70D774CF344B277EE95539E92C2CC93E633BB76839A13122", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057195, "uuid": "7af5b355-b364-4036-9da5-29305941d89f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057195, "uuid": "ddffb771-b4fa-4b14-bee6-87f6889ca96e", "value": "12288:d6z/U3CYGweOoR/g9dB6rON6g8O33M0QbFsLcTPrSRP7r9r/+ppppppppppppppZ:dRnGwf4/geON6tO3czFyc761q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057195, "uuid": "71ff3e98-2836-4121-ac8c-ceca590b01e6", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057195, "uuid": "be31a993-ece8-4061-8418-0a998e5e3309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057195, "uuid": "a0b87c31-d55e-43bf-812a-b4ac7db12bde", "value": "SecuriteInfo.com.Trojan.Olock.1.31203.31025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76fdc5d-7186-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698053498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053498, "uuid": "631e65bd-a569-40d3-8ea9-beb034d96795", "comment": "Malware payload (AgentTesla)", "value": "3eaa0df0516ba7f6f47f9b36846e6ffc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053498, "uuid": "c29adc3c-4378-4fe2-a250-90f4ebe25bed", "comment": "Malware payload (AgentTesla)", "value": "ea85d3b8e5460295de4961afc0dada2d5251369539869353ec2aa6003772207c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053498, "uuid": "a4d1b933-04c8-49bf-bf43-f1f28d57fbf3", "comment": "Malware payload (AgentTesla)", "value": "78108ea78b491bb5c5f71bff598f67fc695fa801", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053498, "uuid": "5c6c8dbd-74bf-4236-a2d4-c66a8be2ae3b", "comment": "Malware payload (AgentTesla)", "value": "31e213b5a18838c8c1154bc267958391ec95fd75ecc9fb2cbec417efe52f92926606e8f99c44b805d8481713e7d328ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053498, "uuid": "e16e85b4-6fef-4c4c-bd84-029a133b355a", "value": "T115F4F12033988BA6E13D8BFA15B4024213F5B527357ED3AC9FD224CB9E61F418565BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053498, "uuid": "91ee90c4-1d8b-43d4-9341-1069ab5e162e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053498, "uuid": "cef59bc6-6aa5-4c55-bfab-1c284cca123e", "value": "12288:HSX9K7R4SMvuvTXQNTaK3w4EZwtyB9U9yZoBszL:HStoRmEDQNTRwZwQPU9Yo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698053498, "uuid": "4d520a92-d5ea-40fd-b5f7-801205f20b51", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698053498, "uuid": "2161621b-fc3f-42e6-b2da-f8143e47386a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053498, "uuid": "8bbf2355-fe36-4ae5-8a16-c39ca4ca63a0", "value": "A3QKP6E1.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08a3901-71d2-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1698085994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698085994, "uuid": "1ff4c66a-8dde-427d-aa73-134a0cf6ee3c", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "6020dace849357f1667a1943c8db7291", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698085994, "uuid": "b7d7db10-f1ef-4341-acc0-a0635b970606", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ebf0fbb2d06f3a42839c341b052cfe7b8b4e0b7e93a5f37a3c426f27a762e63a", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698085994, "uuid": "a39a8a33-9828-4f11-b22f-714f67898c4d", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "3cb1268ae732e93e9420e353200f0998d7b1920f", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698085994, "uuid": "5f7f607b-17ca-49d1-a399-d260ec702114", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "08aa0d495159784d6a50f704bd4e844ebe65c2b99629c475a70f0ebd8fe228153e2b90457d338c07ec967fe3fd4610e7", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698085994, "uuid": "09585242-7a35-45d6-b7a8-bf315132b953", "value": "T16DC601A277E86893B6BB2E753C2D3359D9E732204FD6065BE31292401F32F38953951E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698085994, "uuid": "e594349f-ed65-460e-b2d8-8ffc3ca53e84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698085994, "uuid": "bcc10cab-7de5-43d0-b7da-091ee23a7531", "value": "196608:EduakRpFaUd+NYQdfrofYxotvu0GTF3tbw31e/NVMjVjmovD4IR87itwvgE:Ed1gaoQYQdfM3t2/Tbw3MFWj+S8Gtwvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698085994, "uuid": "526b9ab6-99e1-496e-a4bd-ced20e9b77a5", "value": 12049920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698085994, "uuid": "323ec875-78cf-4c55-a875-8a45e9afcee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698085994, "uuid": "36f03a7d-cdc6-4b66-9cbe-816a844aba3e", "value": "SecuriteInfo.com.Trojan.MulDropNET.43.19921.30871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ec5214-71ce-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698084089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084089, "uuid": "20a1e771-38c6-458c-a3f2-3542fee0c82f", "comment": "Malware payload", "value": "3ef99b36b34e2a62e06a06db98ddaca6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084089, "uuid": "57b1b5d5-7513-4973-8e59-c27cf2bf152b", "comment": "Malware payload", "value": "ec7a667502cce83909fff4285e5765cb4f2e36ff9e8d2ea56827e7d8adaaaf65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084089, "uuid": "1f7b7869-c084-47d0-9a87-4bce5e07d694", "comment": "Malware payload", "value": "19bd5a9312691210aed32cf90b17ccc0292c95d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084089, "uuid": "08931135-e529-488f-bfa5-79255433d264", "comment": "Malware payload", "value": "3e2f85b9a8c4764c820e0e3a138a6e5c8a58b2eb843679ce5a0bf28765142374c8ada862c1bd27fc75571d2663191c97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084089, "uuid": "39232dad-d0fd-460e-a639-51e08dd7041f", "value": "T13216332CA0A09961C70D853098E312DFE5F7097FB523CB7BE792BDA82CA625D05F2157", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084089, "uuid": "52440c8e-a0cb-407f-8c5a-ad75af3d72e7", "value": "98304:s4LQfYCUrBvZ8TeA6cNHjDvSEgnkgCXBWhPB2y:scQT+8TeA6+HjDM7Cxdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698084089, "uuid": "02b53c95-3a8f-4fc7-9328-8cecb95e36d6", "value": 4417536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698084089, "uuid": "360fa8b9-d0df-4db8-ba6c-9d7ba6007045", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084089, "uuid": "0cd41ef2-d178-47a1-a035-630c1c880c7d", "value": "Swift for Invoice payment 01-1229 - REV00 VSE31 C3373 T2 YG53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c17110-7194-11ee-8907-42010a9c0042", "comment": "Malware payload (sm)", "timestamp": 1698059126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059126, "uuid": "f38b6e1b-3f10-4a58-b4bc-e9beb5b3ccb2", "comment": "Malware payload (sm)", "value": "433c7047be05269e238fbf0afbf4d3b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sm", "colour": "#38AB48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059126, "uuid": "4b917b75-43ed-41a1-8f0f-3781bb4052eb", "comment": "Malware payload (sm)", "value": "ec8e8986dd4822eb7ef2d7098b1b58d1b188adee7757f244e0506ba613e9a55e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sm", "colour": "#38AB48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059126, "uuid": "4b7181c7-6afc-4f59-988c-7103880ed25d", "comment": "Malware payload (sm)", "value": "ee267d11e446af3f8176f46aef584aee630bf8b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sm", "colour": "#38AB48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698059126, "uuid": "f4014faa-66e3-48ef-9fa0-a4e40c79e623", "comment": "Malware payload (sm)", "value": "a9373f4604d54e33daf9c395014632158f773cd8c5f91dce5d5d86640b4f64d47c955d9ce692d98af64cd0c772a4bdf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sm", "colour": "#38AB48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059126, "uuid": "2b5671f1-168b-44f3-9943-d7558ca38f47", "value": "T1D77523C3A2E84263EE702B309CF605D32B357DE1597C855B17969E0A4CB05DCA076BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059126, "uuid": "942d2fc9-0cb3-401b-943b-d4e0fbb4c864", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059126, "uuid": "32342910-9f6f-41e8-ab72-13134f0f4ee7", "value": "24576:PyA5PjdXu5tL1ZE5Y5/MgG4feiwNMrUPWyHBU4PHai74VrCs6mnt+0:aABJ+5d16Ox7f4bWyHTfl7Jsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698059126, "uuid": "a765e1fc-14f7-4938-9513-5d7d88ae0cc1", "value": 1590784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698059126, "uuid": "516ddad5-7cbe-4a00-bc04-097b3f663c0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698059126, "uuid": "403ed66b-4326-4eb1-b4d0-240184d1b5e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1b0b48-71fb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698103520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103520, "uuid": "121ad6e2-9dc1-4d86-91c9-88cea211f2d2", "comment": "Malware payload", "value": "d8ad8ca6475ed3f88fbce364e0817a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103520, "uuid": "88c762e9-dafb-4310-9f46-a10a151f1782", "comment": "Malware payload", "value": "ec9173cbb54a9cac3f7189b8acddf567cd1ac10ee32ae3e66dd8d003eceb5c91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103520, "uuid": "f7aed39f-b313-410d-90e5-d230258a504e", "comment": "Malware payload", "value": "a537be20ad8c9b6d9d7ed6764b9a132b8103a918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103520, "uuid": "9aa54ab0-794f-42e5-99b5-6766ecb368b8", "comment": "Malware payload", "value": "e2f2ff32d2a41c85ad3822325e336caad70a34c8b6864e407ce7ff06d94de5fdc6876f1d516bf8e6d19a5b454b21e098", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103520, "uuid": "e0b7f61c-1543-4cb0-9eec-672e662f9c87", "value": "T1363512027EC188B2C0721D369A796B11AA7DBD201F718ECF7794191EEEB15C1D7327A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103520, "uuid": "5779e4a3-3b56-438b-8cb3-46097be6b462", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103520, "uuid": "d1091166-89b5-4157-8822-921ec831f28b", "value": "24576:MTbBv5rUDkdwJ4WhKwp5KSjUZfpaOKsr99:OB/ujhKWchKM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698103520, "uuid": "0ce7a3be-ed3a-44d0-902f-c49af9e97328", "value": 1120787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698103520, "uuid": "c2562401-2f79-40ec-af21-ccb1d04c6f2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103520, "uuid": "25afd55b-d0b6-4c93-b6dc-4803108a5234", "value": "z2NewOrder.png.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ea8bb7-7184-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698052526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052526, "uuid": "7861789c-6a32-450e-bd02-f6acf9f2c56b", "comment": "Malware payload (Stealc)", "value": "2ccce1466ab31b727e5f1de7155a4d93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052526, "uuid": "52c50bf4-9428-401f-8625-d45b712fe0fa", "comment": "Malware payload (Stealc)", "value": "ecf4b824a3456491a405f3da205847bd654fb62d9535c4dbba1d3467b78da89d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052526, "uuid": "db606523-6ded-4d49-b7ba-880d9bd35648", "comment": "Malware payload (Stealc)", "value": "385d3fff59745ee45f594ee59aab7becfe0d9bb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052526, "uuid": "4e5bb5e4-c6e2-48c2-976c-3bcab939e7ec", "comment": "Malware payload (Stealc)", "value": "8938f51c15157aed82f7f224d585f948caf7ff95c86b8709f02a777d9634f889808a69bb44f1d665e292001a3416fe9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052526, "uuid": "ccec8ff7-d463-49cf-9c9c-d2fe7040dc16", "value": "T185449E03A2D1EE70D91749728D2DF6E43A2EB9708F19EA57321A6F5F58701B2D263390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052526, "uuid": "446e8b54-aa11-425d-b0ba-80cb568ffd12", "value": "3dc5fd248fcafa52ac5c2283ccf28cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052526, "uuid": "69a8e07e-ec6b-415b-83ab-e10fde11059e", "value": "3072:cwXZ+EgI8LKPOwApEKIKgoQ/FcM0TvGl2K9mg9m/lpU75Uc5frpK:58EgI8LkRApEKZ1vI92/9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698052526, "uuid": "f46409fb-48ea-469c-be71-397d6faf05a1", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698052526, "uuid": "5d0062bb-1476-4335-90e2-776be830934c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052526, "uuid": "63e4e289-6a3e-4770-bd84-11b87747c2a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38c26e9-718b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698055612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055612, "uuid": "69577227-3ac1-47b7-ab27-8214e1b91140", "comment": "Malware payload (AgentTesla)", "value": "158efa5c991145a8283513b72d9fec09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055612, "uuid": "4001d345-7202-4b05-97bd-eb70c0975f14", "comment": "Malware payload (AgentTesla)", "value": "ed086c5fc9804111eaf06cb3fb613eccf64e1c704c05eb77003790216321542e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055612, "uuid": "0bad8dc1-ba2c-47f7-b128-c666fbde954b", "comment": "Malware payload (AgentTesla)", "value": "31de636758f1d63c3b547cbfc92dc33eeb89ee0c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055612, "uuid": "f84d05a5-0e6a-41c1-89f8-3f0d46b174ae", "comment": "Malware payload (AgentTesla)", "value": "78fbbbcdc3d1a1a0a620166a4e4e5ac864ea8445c18774d9bb3555babeeba7d45267d3ab064de406331d2bce39b72738", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055612, "uuid": "95c5d4fa-d561-469e-84d8-ece4637848ad", "value": "T14BC42389317321FB283DB1116DE797BB4E76A35340786E08C57A9029D788CAD89CCEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055612, "uuid": "700cc6df-f67d-4f39-941d-f0a0342331d7", "value": "12288:Vjzbmh4r0nNc0pEHGOF2M4d8NBkWpZ6/e7Y4QiMjFKA+9MOM:FmhY0nxeHrNKWC/kY4AjJ71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698055612, "uuid": "8b5d9068-dca4-4dfa-bf00-880a6aaaff54", "value": 571237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698055612, "uuid": "93e67e66-f6ce-49b0-87f2-0f5f11525b92", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055612, "uuid": "b7f370eb-6826-4ae4-876d-c142ca163d43", "value": "PROFORMA INVOICE.pdf___________________________________________________________________.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630dd2c2-713b-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1698021037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698021037, "uuid": "8f7f17dd-29b1-4f6d-a83f-a7aa5e0cd2f6", "comment": "Malware payload (CoinMiner)", "value": "b072aae7b2a632400089a197d4342343", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698021037, "uuid": "5f7edc64-cfe0-496a-b2c0-704cf7bd35db", "comment": "Malware payload (CoinMiner)", "value": "ed451ab9bc98df781e851bc59415edb980f7f74f940900d91cb710f22b37d27e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698021037, "uuid": "2ce89fc0-5cc0-4a95-990f-e0ad68dd812f", "comment": "Malware payload (CoinMiner)", "value": "ac59d48e8096c83eb6df8a7c0ff83056b83df1c3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698021037, "uuid": "938f8ac2-dbb9-4db8-a1c6-949afe9e14ca", "comment": "Malware payload (CoinMiner)", "value": "998635e4c0cd48bacaac0fdaf3bd324aedefae5eb1613f2557c8cb40c1a922e8883786ce1da0ada6e39505c8f5f11114", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698021037, "uuid": "4ea67581-e92d-4d03-9158-957dbf790309", "value": "T107858D09F39409E9D85BC730C9199F32D3B5B85A07229BAF1B56C6872E73AD05F3B211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698021037, "uuid": "f1a3de85-2b81-4bea-8f8d-685e5336182c", "value": "8a73a83fdced3fd9c55fbc1b70e551ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698021037, "uuid": "6a8b4b87-27a0-424d-9e6d-ce2820ccab5f", "value": "24576:oHDKnZ3PBiGVLvVwzE5L0r8hum199rrntIdpBiHAAfwT:NnZ3p3N7TJw6AAfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698021037, "uuid": "1537514f-475b-46fe-9cc7-72e25307aed2", "value": 1797856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698021037, "uuid": "f6cc38f9-2bd5-4170-8a8a-8e2e67e906c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698021037, "uuid": "7c43854f-6d47-44d3-8058-a1cb9df19d39", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a63ae7-7186-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698053175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053175, "uuid": "e56a3fd3-a7ea-45f4-a900-aed2e7766969", "comment": "Malware payload (AgentTesla)", "value": "c2958464e7e90d0245936608fea0a210", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053175, "uuid": "b7e8d9d2-7f9a-4158-a7e9-2b39719a4499", "comment": "Malware payload (AgentTesla)", "value": "ed5a2a496465c7a719724cdbc88a01f3cfd86e1c8833fc83aff8031f53525bf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053175, "uuid": "0b4d0e9a-9153-41e0-9edf-f2d74c08cd33", "comment": "Malware payload (AgentTesla)", "value": "40830d261d242f2ab64f941f267d131c01c25b9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053175, "uuid": "b6dc8e4a-a2a5-40ab-80dc-b71c642ffcf8", "comment": "Malware payload (AgentTesla)", "value": "9daed3bc8422612769935fd228cc59807ec9867b674873c35ff3331b51a03f81af57a55bbb1e93446d850d645f028fd1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053175, "uuid": "c462ed0e-b632-4c3a-a2cb-01bcf6e78690", "value": "T17755E05AA7C5ECCDF7E66D314CF0C10011A26E47A81AC65F7C493AAC52F13C72B9AD1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053175, "uuid": "423ab5ff-de3a-4114-88bd-620610c3e006", "value": "12288:KMYnQ3j67SESV1eXl8OhA90zmvo+8LLrA8Dp174oB6Jv7Sbh8BFNBOYdle2QvgL9:KBz1+KPDLP61shcFPDdle+zYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698053175, "uuid": "7e6356d6-443a-45b8-89bd-7a51d762022c", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698053175, "uuid": "9fddc429-56e5-4429-9f2a-48f93c3a7fe1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053175, "uuid": "c252b80a-2478-4a7e-bcbc-9d76b80df7af", "value": "Offical Order.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4e506f-7185-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698053028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053028, "uuid": "6a7328a0-e4d1-4913-9514-bc1397d1df22", "comment": "Malware payload", "value": "7631462c29eea8fadd3036a921ce6b3b", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053028, "uuid": "4433b33f-019c-4c57-b7a9-de5a37d555dc", "comment": "Malware payload", "value": "ed82836a4388d81308586279bbf4982d698c1aec37b525d7614a91bcf3609fe2", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053028, "uuid": "e4a495eb-a514-4711-aeeb-30d5dd32cf2f", "comment": "Malware payload", "value": "f7eaf9ab91a144c573ea4ecff003fd7e3c402f09", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053028, "uuid": "5c6c13a6-b0b1-4c17-a14b-0e968d10beb7", "comment": "Malware payload", "value": "8afd46613b1d16047cbaab2f6269255c2c80d7ba6a0653d267fef9d35d3578cfdbd66592bc538024731836b8f6c28078", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053028, "uuid": "149bc762-2034-4a10-8f31-4aa620dcaa12", "value": "T1A5F1AF72750681E5BB5BBBE92C0B5E8C9383A914AFAA81E068C8BC0253736446D43DB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053028, "uuid": "b7b9172b-4885-4720-9883-e087f1bc3b4a", "value": "192:jTQStI7dtvULVQSwIBZ9wDXi4fzZlIlIf:XQS67dyLVHBELi4KQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698053028, "uuid": "c78c86db-87f0-4d1b-b219-488351f27c64", "value": 8000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698053028, "uuid": "061861ee-f029-43d1-b4de-11fcc89f848b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053028, "uuid": "e2496450-9c1b-4090-98d3-9a700d8c9398", "value": "Remittance slip 060223.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbc8181-71b7-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698074178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074178, "uuid": "52875337-bbf1-46a5-901f-022bc1b30eac", "comment": "Malware payload (AgentTesla)", "value": "10b4adf5a770a6eeb3b2627779620bc8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074178, "uuid": "037872fe-c4e3-4244-b3b5-f2d38c52585c", "comment": "Malware payload (AgentTesla)", "value": "ede38ce3dc1f4f0f0232bbc8c8f7bbc0a0b2497194b4a554549ce42f9e620726", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074178, "uuid": "1fdfc0ed-7a9b-47e0-8b28-8d6c4538a36d", "comment": "Malware payload (AgentTesla)", "value": "031fca7ec7608460b3eef2ad8aa2f2743fe7458a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698074178, "uuid": "82ca014f-f2cf-4b47-956f-1d73fdd4d021", "comment": "Malware payload (AgentTesla)", "value": "d12ab27aea9fa6123d7b597f68387eebf3625814ffce5f651f5ecc2de8b5ab22e6a307b5018e676659949bc48dfa0988", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074178, "uuid": "0c10a1c2-2c17-4688-98d9-2839151a6409", "value": "T169D4234B9D88FD2670F8B1ED303D56ED4A0CC8FA1BB6DE582D2578F03514859DD6A0C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074178, "uuid": "5d684497-0c33-43e8-8949-9ffc523d2e24", "value": "12288:VKtajvUJQ0Eq24yEyXo2RkSnD2LKVR0sDtE5jF9MaQypZV:Qtevu/2pJdD+GO+E5QavpZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698074178, "uuid": "59b10908-d517-4003-a013-881a1be2bcf5", "value": 617730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698074178, "uuid": "a685da83-5ace-4465-a7f6-5838076fd208", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698074178, "uuid": "3bf890cf-5453-4471-b37e-36ac0806b61d", "value": "INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517f74cb-71be-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698077272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077272, "uuid": "fefe0ab4-6225-47e0-bc74-aaa607e50eb7", "comment": "Malware payload (RemcosRAT)", "value": "635340ec17f6b2878f48fdd0e87c35d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077272, "uuid": "ab68af97-78a5-4f50-aac9-00009ac6d8c6", "comment": "Malware payload (RemcosRAT)", "value": "ee6bcda383fa62c017842b044edca04af71e649d642fb7bf088c64ce9d4e6d00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077272, "uuid": "59739600-faa1-4d6a-93c6-9e7dc818b74b", "comment": "Malware payload (RemcosRAT)", "value": "f4c22a1fa9ba0f75fe4ba14607f31a0be8ad3e40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698077272, "uuid": "96863e30-a3fe-4503-aaf0-fa93d6b84353", "comment": "Malware payload (RemcosRAT)", "value": "d8e03eb16618c7d881ea9e1ef07949e4d82fabca63f7b6514a6b34d0276803e3631f852a315a1d3dba29437eee0886ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077272, "uuid": "d174e107-d10c-4dfb-a1dc-0140aeddfdb1", "value": "T18F55D025E2934237C1631A3A8DBB9364581ABF643B246C1767F41CB98F367853C2B6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077272, "uuid": "d0cef0a9-d4ca-40d2-b181-5fb0c23d60e4", "value": "943a00a286edd3507b735f866788c4b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077272, "uuid": "2a558000-7a8b-421f-884d-0a4ed186eb8a", "value": "12288:iKl1+wjWARTvUKbV2p11lx8Nimm5cfGNJ3+AJf3tDWwEPbWKiwfat4YJy4IcBBdl:zlxtU9jxR7W+6AJKPdfaLScBbUGoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698077272, "uuid": "b22d216a-e3a1-4323-8185-8b637762f6bc", "value": 1355264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698077272, "uuid": "192f2ed7-ca26-485d-bda8-66af7b0a0d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698077272, "uuid": "777456e9-5ef1-42d4-a44a-772ce9f5e118", "value": "Telex Release Confirmation B_L #2722610400 - Copy.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68b3c1f-7190-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698057765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057765, "uuid": "672ac880-ca79-4514-b082-965cbf27e02f", "comment": "Malware payload", "value": "214a2a320ef037a672c9176fdc6d1725", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057765, "uuid": "536a8b77-d4ee-4d69-a460-9861aa248100", "comment": "Malware payload", "value": "ef1b16a209228df8622452cb6197a7cea549330a6d088253c53c98ca96210b1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057765, "uuid": "39612349-d016-44f1-9ba3-b1b7f5d5990e", "comment": "Malware payload", "value": "b822a342ccad35141d5ef4f7b9dab543dea26bf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057765, "uuid": "f506fea3-bad8-4ad9-861c-41d29e4b1aa5", "comment": "Malware payload", "value": "c21f5176dacb0421aa1c2c5b73d92702ad55989e34ad422f40612b15e6a171abbd0dd53d7c872730a961fed07bfddb79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057765, "uuid": "efc02f8f-705f-401a-932b-1b2e75ab3b40", "value": "T11F247446F68492A9CC28A3B07532DA7007167EABED74645E5ADD3E273FB74F20076843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057765, "uuid": "54c07f49-8b30-4991-a8ab-bfae6b492865", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057765, "uuid": "b5474b71-90e5-4a95-8044-aae8571511f5", "value": "3072:Ult8fPl67SQzNMbu3zbxSY7KZnS/KzJBLY:UlOl67SQzNMbu3zbL7qS/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057765, "uuid": "a6398962-a0c7-4199-9842-ed21c1972282", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057765, "uuid": "d1ded195-4762-426c-bdfb-9852f144b56c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057765, "uuid": "985fe0d1-bf13-4ecb-9bf9-41035fd7da66", "value": "NMKNN988.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64adef65-718e-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698056688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056688, "uuid": "356c31bc-67ab-4816-8299-93e66228ac24", "comment": "Malware payload (RemcosRAT)", "value": "ba52167a69834d25c67df4412e649a3c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056688, "uuid": "b4cea6f2-71b4-4ed7-b5d5-c90efb78c7e1", "comment": "Malware payload (RemcosRAT)", "value": "ef1db319c2b98e64e1d797a82ca0238f03cd24372014577d58b42f3974e37e32", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056688, "uuid": "1781c5b8-69e2-438b-b539-8d2854e0bca2", "comment": "Malware payload (RemcosRAT)", "value": "a5790b8555d0a912c23b0899d9b74a9528d2b9e1", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056688, "uuid": "628b1f0c-15c8-4839-8dd1-7546b422db95", "comment": "Malware payload (RemcosRAT)", "value": "e96d3afd5926ba28361681387a563f8cc8035f9e3ef0c01a0387ed46cd23a9fb4db0af1fb596b33ef041e77151501bde", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056688, "uuid": "bc959ecd-64a3-46b3-9c01-d702635c91a5", "value": "T1BF926BE1D5060908C807279AAF0248968BEA412D17360621BEDFA7DEB706D5C933FF4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056688, "uuid": "b3a0c0da-e05d-4064-a625-a46a9b5003b9", "value": "384:85gyhk69uVemBG287sv55lemkVi05vd0VFz9TYPX7bg/eBskaVw:ygyP9EdP3z0FWFePX7k/eWFVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698056688, "uuid": "9006b1ca-99ec-4902-ae0a-89cc753f1eb3", "value": 19571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698056688, "uuid": "518637af-d0ed-4270-9c93-a87a7ae5b226", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056688, "uuid": "93655b80-7cc6-4354-820d-a5a4c64d9d8f", "value": "Draft BL, CI & PL.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07a623d-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042722, "uuid": "68d71cae-259d-4701-9063-c7d7be447eed", "comment": "Malware payload", "value": "70ec6f9d3fb7e486401d03b406728184", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042722, "uuid": "0fe87666-0fd4-4a5a-a0b3-80f3d4874712", "comment": "Malware payload", "value": "efabd0b1387cb232dd50156c23703f770342147e992bc1db370070644af4b1f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042722, "uuid": "cd2a5b6c-9971-4150-aaa7-cc0eb0fb8c17", "comment": "Malware payload", "value": "550e3c5c684d200ee9885e488df7c9753d4bc051", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042722, "uuid": "0face795-d045-452b-80f7-0256322624e8", "comment": "Malware payload", "value": "959556b9f8597cf3e8c8bdd8a1496e17df909297d5c3f69dcfa712a37e785cb7887d071a1ac67744e69eda15e8bf0ae4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042722, "uuid": "81573d6d-b9df-44e4-b421-861446b5ec52", "value": "T1B4F48E827BC740C6E6A77AF115B7E323E735B57A732E69CBDB902C231660440AD60376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042722, "uuid": "d0de5149-c2fc-401b-9a1e-c0facbf701c6", "value": "6144:Chu/KkiKMAf17yLj8YK7frpEgrJUN/7CXL0gXh6tBisbwhY1UTwT83MX8OZHm7Pz:cKPMAf17yLjpMoFC/wBlbzSo8k1G7rv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042722, "uuid": "1303031c-f299-44ae-99eb-6e70d0b56ee3", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042722, "uuid": "c62c43ae-7072-471c-98d3-733332bab9fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042722, "uuid": "fbe02e20-744b-45e5-8238-6da7ab9f0695", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.4986.8368", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8610aab7-71a1-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1698064904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698064904, "uuid": "1a3ad93a-6501-4013-abf1-4cd5c9a5ab84", "comment": "Malware payload (Tofsee)", "value": "4ec6874cf1e5dda6078b0b14c973faeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698064904, "uuid": "a4a4fa60-05c2-4330-8427-de6db7bbb104", "comment": "Malware payload (Tofsee)", "value": "f027b993e207aac2a99ab54bec5b5c0ef2f0e8d47ba3b997d0dbccdc0d30f702", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698064904, "uuid": "fb01ca45-508d-4fbd-817e-5172efcc641d", "comment": "Malware payload (Tofsee)", "value": "44e31db2bf7f1cb65832aa36f308565e62be90f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698064904, "uuid": "e5e661b3-9531-4ee1-8da3-ce5a008b7b74", "comment": "Malware payload (Tofsee)", "value": "9ca7967cfa2765d0bd84ee6bfaa22851e7f39bf3628b66bf0db5b5e46ca0e9aca4255f5e8e7e721a48c7c69a6b155f1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698064904, "uuid": "7776fbc1-8b01-4d76-aa84-91a7315e41bb", "value": "T17E449E03AED1ECA0DA16C6318D2DFAE4B67EB8714E59E65733187F1F18701A1D26B390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698064904, "uuid": "637c109e-bd78-4b1a-92a4-b8f059b1bc1b", "value": "780437e8c81fd22a5669fb9201842564", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698064904, "uuid": "608085e4-9cc8-423d-b300-f7d523703206", "value": "3072:XwX5qj4TlLF3OY19GUzsgw8M5m7bLbK2qeqvJlUDbEkN1DcqXW5kaA68frA:0Qj4TlLl919GUu63xqPR+DYK1D7aX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698064904, "uuid": "b3c2c6b9-b09e-4ac5-94be-a620865f383c", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698064904, "uuid": "34f0c0fd-5ea5-4bb1-92ac-564cf4c43ba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698064904, "uuid": "af67620a-4fa9-490f-8998-2d75a9220779", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c055ff1-7166-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698039493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039493, "uuid": "9a5d3232-0dd9-4613-b915-2e8b28c0ccc7", "comment": "Malware payload (Amadey)", "value": "de7e45c65c9daf878d46182ad3fe3ea4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039493, "uuid": "c97a2973-21cd-4495-9fc6-af900be48e03", "comment": "Malware payload (Amadey)", "value": "f076d2ab79a5e3d002b1b4e71ae60b72768e80fb8cc63582b16a1afd0d9ccf80", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039493, "uuid": "7e4d1dd6-c86c-4a30-903b-b22470f83eeb", "comment": "Malware payload (Amadey)", "value": "a43bb4bd82c3b322baa569c2f96ddf9861e0d5fe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698039493, "uuid": "a80407c8-10b4-468b-a16b-423f67c80440", "comment": "Malware payload (Amadey)", "value": "c211e11457f761732355d0cdd76d10c3be8b30a80a100196c665ef8c89f91d5874e3a70ca0d142af2095249828ba6273", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039493, "uuid": "ea01fee4-ad62-450f-ad91-7a3faaf52fad", "value": "T181752325A7E98473CDB41B304DF612D317327DB05C70A39B3385AE4A4EE3680A63A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039493, "uuid": "2d7fd31d-2e9e-402e-8d91-c90aadeeff91", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039493, "uuid": "983f73ef-473e-45b7-86a6-8cc6b889c1d5", "value": "24576:Iy7F9VrwTI+uqYWZwkQr/B92EIK1dtwOTUa6hEi3oNDjpa3NePzFO4b:P7F9FwTIMYWZwkQZHTrKYNDNadizFO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698039493, "uuid": "a971588f-ef15-4cfb-baf2-854253768907", "value": 1591808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698039493, "uuid": "b5836d08-db23-4436-bab9-1ef832e8cabf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698039493, "uuid": "51704ed3-e6de-44b0-b358-d87574cdc6cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbdf6d9-7185-11ee-8907-42010a9c0042", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1698052841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052841, "uuid": "dc4a8ab7-8097-4db3-ba8d-4f0683addc82", "comment": "Malware payload (Gh0stRAT)", "value": "52c9b999a4a83e2b0dc47fc33e992750", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052841, "uuid": "4e9a615a-3378-4f0a-8c55-1be525016b22", "comment": "Malware payload (Gh0stRAT)", "value": "f0cb5a8eae9458a444c21915f7655c70d4757b19d27caae88438abd2add5fc85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052841, "uuid": "6b0a3222-3ddd-49ad-92f4-194817de2492", "comment": "Malware payload (Gh0stRAT)", "value": "b158d0acd1b467183492dc197b066191702cfe66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698052841, "uuid": "648cf1f0-ff02-4371-a62d-7b137fd7db35", "comment": "Malware payload (Gh0stRAT)", "value": "5e890667d6332b417bd5acfc6ebb6606030b5a6684e0a7008b364679a04b906b7e42f85cb7ea997e1e686689835dffd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052841, "uuid": "8578606a-738c-485b-b68d-d52d67629c3e", "value": "T175C46D93EBB384F6C85C0831947ED3B775356720B617DA4363D0CE63E6A22B16E2135A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052841, "uuid": "2a31db3d-9a61-4c1a-bb0b-570bcfaa26c3", "value": "11dc97522cdc0de1cc494dba26794844", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052841, "uuid": "c0bf9294-5d27-4921-83df-561d98464d37", "value": "12288:Wv/gE58qVdiuir+TB44zeWf0l+Kmi5zCAQHM5xyT3Jp:WJ6qVdiuir+TB44zd0wKmwCAQHM5UT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698052841, "uuid": "b8be6337-40cb-4f31-8301-dd01a1637a2f", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698052841, "uuid": "54b55e1a-5a0e-419c-8412-31b16fcc1db6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698052841, "uuid": "6cedc140-9527-456d-8d52-4065012d014a", "value": "52C9B999A4A83E2B0DC47FC33E992750.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38a5e19-7185-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698053035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053035, "uuid": "eb65773f-dfc3-45b2-9160-d1aa86f61200", "comment": "Malware payload", "value": "78225846d3b2cb404f4dbfe6e37a414e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053035, "uuid": "f5365bb1-1326-4da1-9e5c-ca16b2aae7d4", "comment": "Malware payload", "value": "f0e50fae6183fabd2514fcb7524905bd8a23665d6785c963bad6b0ff3c024d0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053035, "uuid": "fd7f8468-fa68-4600-8a97-7b41ca114abc", "comment": "Malware payload", "value": "470931b7de8fed1c1ffa63cc5469bdd385d36268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698053035, "uuid": "c27291d6-54f4-4af9-8faa-cf3ef1e24db9", "comment": "Malware payload", "value": "37c73654817c8e74a7917882ea2de91aaf07e0a9c8bdf305ac7f4d07b0a925cf497dcbb540ceba2fc5170916f3898b6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053035, "uuid": "14d030ed-2744-423d-a5b8-703637a69833", "value": "T122721908FA9D5437CAAC463954A3538AD338B723BC83E3EB5DD4AAE536073C459012E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053035, "uuid": "7f1bd588-c91a-409d-bd2a-59b42a93dbd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053035, "uuid": "712cc768-212c-47de-9c98-b8f64e71f0dd", "value": "384:BztL+6iWZiTHnMnjEKugPVE70k+qY/sgKwQOp:aW0MA3WpRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698053035, "uuid": "d2d297fc-9150-45c9-be2f-c448174815ae", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698053035, "uuid": "36cee728-3714-4182-96b4-d0f9be87d7ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698053035, "uuid": "708ac336-5b8c-4b15-8d8a-b60c5f9d9bfb", "value": "Remittance slip 060223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2491416-71af-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698070991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698070991, "uuid": "44fe8d97-23b3-4561-9d47-a373ac59067d", "comment": "Malware payload", "value": "2cfb74cde3110b5fd3e26d78e54e6af2", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698070991, "uuid": "eec292dc-c422-40dc-9875-f20490fff18e", "comment": "Malware payload", "value": "f170f7ca1f0d51e07b6fc87440f8670eed9c138d34d26e6bf9d090ffa5aabd0b", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698070991, "uuid": "83510e87-bb5b-45f8-a963-86f11f032085", "comment": "Malware payload", "value": "4964ae3ccc88f354d2a2936ea78242eeb2b23329", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698070991, "uuid": "17d7af7c-7c11-4b40-af70-35dd0af23ea3", "comment": "Malware payload", "value": "e474e644fe8e42d0fe43fc3b8bafa19f4230320f0808b3edabad24e2ff1a46248d704e462970dd7b81768e68ae654b98", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698070991, "uuid": "b964d07e-c1bf-492a-8f60-bca70d7ed8b6", "value": "T12E11EF0F095B2B30C6B4C375F4A3A613CA392C0BEF962F5B04D8439808693457464E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698070991, "uuid": "08ccd6a7-53f8-4c1e-b79b-5f36cfec3640", "value": "24:8QXOcNvsE498AWvlmXDyEisrab/E0PKmy:8QXvS97W2rabNPKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698070991, "uuid": "dcef45b7-6f09-491d-b078-07af59756376", "value": 1046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698070991, "uuid": "b96b7dec-4f80-4f45-9d6f-5725d7556b96", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698070991, "uuid": "27686eb7-514c-4e61-a7b5-aa457bfe7bb2", "value": "12312313.LNK", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2057e3ad-71fc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698103818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103818, "uuid": "f74d62bc-2a50-49e3-a46d-098d56955f46", "comment": "Malware payload", "value": "27f973eacc806d42f70e6def07e89871", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103818, "uuid": "848bea03-6b11-4703-b9f0-063f7f321f53", "comment": "Malware payload", "value": "f17108a6c271f42d9f7b644ea62e50dc8486aca44fa2d64b4c31ba233c9d2e01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103818, "uuid": "0d8ad3d7-2d4c-457a-8f8e-b5a7db2a527d", "comment": "Malware payload", "value": "527dd5051e811337b695f9d738cff85e74be8b69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103818, "uuid": "febafecf-6f0d-4357-a22f-23194dd420d4", "comment": "Malware payload", "value": "397620969e8656e871bb884def93dd63a94e1d80186a99553b790ea4ad22eb4b6fd698f56fbd17103604852ba25af0a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103818, "uuid": "4764544d-6727-4acd-9fbf-93ea89d9f978", "value": "T148523B5D6FCC8B32C87A4BBA4863534023B1F760AC57EB5D18CC605ABE673660953B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103818, "uuid": "f70c21c8-d854-4508-9dec-2d3c0bf05a22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103818, "uuid": "bfeab440-a881-4fdb-8bbf-e79b388834d6", "value": "384:Gliq5OfpWaQLuAwsLe9nETAufFaNh8oQCOSway7XGfB0:04SuAwrETRfIccy7X+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698103818, "uuid": "1c2daf99-e12b-4e5a-8e43-9bec9cc3acf7", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698103818, "uuid": "dc2365f8-e518-4542-a96f-666a3703c941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103818, "uuid": "99c314fd-62dd-4c92-9bbc-9d88d4ef0ae2", "value": "TotalAware2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0bcfd8-71ce-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698084081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084081, "uuid": "faacfcfb-8982-4ff2-b211-5d58bff74f18", "comment": "Malware payload (AgentTesla)", "value": "08ac9636621d5481b829af4e7a5be9a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084081, "uuid": "db904f01-471a-4612-b303-d77e325520d8", "comment": "Malware payload (AgentTesla)", "value": "f1766635b1f5e7015ff13d8b6998366b45550d8be505f002b8e6192db3e503e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084081, "uuid": "0679dc48-c407-4167-91e2-6abc160ed481", "comment": "Malware payload (AgentTesla)", "value": "5cd09f5294b2a9c370ffcb07a21acf853ebe2744", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698084081, "uuid": "04db1a69-385c-43af-b3f8-5ca83e8fcd07", "comment": "Malware payload (AgentTesla)", "value": "9a5fdaf9be5636cd00f6ca0276f103678e020caea0a872ca55a46802c925ac95a0984b3b734cec0996dc2ff3aea83e6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084081, "uuid": "e56b0a70-dade-4956-bf28-4e6d5dbd40dc", "value": "T126D4126565990B67C9B86BF97C51A84613A170BE6C03EB980FE332CF2D44F439E0169F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084081, "uuid": "1fc2d4fc-5d30-4fd1-a595-234de0863b66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084081, "uuid": "b40f62c4-fa65-4128-af05-0779ab50b382", "value": "12288:9hNh6sxTA6qNhbF1IyZSm3f1CL3MBWYYlWZvVLSCHDRY6bHhoQeh:9DDxs6gWyZ3f1CowkvVLSP6bHhbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698084081, "uuid": "5e4aec6b-7ac2-4e1d-972d-79abf630d867", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698084081, "uuid": "cc9db327-98fa-4e07-8c15-0c0f1ebd5421", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698084081, "uuid": "a7a63720-6897-4927-a49a-3dfa16d210a8", "value": "GRUPO DE COTIZACI\u00d3N.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5dc591f-7178-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698047456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047456, "uuid": "1813814e-c151-48d3-a229-bb32a0cc7920", "comment": "Malware payload (AgentTesla)", "value": "dc2108c83c99f6de36bacb45ee7eebf0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047456, "uuid": "9d99fec5-c036-4c20-87dd-4a215bf1d3bc", "comment": "Malware payload (AgentTesla)", "value": "f18ff90f37795df1cc56b24c9c68709218bf898cfc865c91b6d973c01b5416ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047456, "uuid": "6de4ebb3-24f2-4293-8129-85f11d23c8a1", "comment": "Malware payload (AgentTesla)", "value": "0aaa3bf8a801cc271563d893762a2c9d4e853d6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047456, "uuid": "234093dc-da2b-4782-bb02-fbd1d34530c1", "comment": "Malware payload (AgentTesla)", "value": "4b9335eb71081fbe5676ba219325fd25aecae9eccec1bc9b0b2285d9d5b4e3385046e56d148620473b8e401faad98839", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047456, "uuid": "94ca18a0-dc84-4334-afc4-fcb3c4947bed", "value": "T10974020D67DC5923DAC9293FD08162640BB8E9B26D87F38B1FDE42E10563BC1901A7B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047456, "uuid": "755822d0-3979-4ab7-ba3d-ab045d570d83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047456, "uuid": "bd03ccf4-53ba-440f-8751-99f3d058c94f", "value": "6144:tFUSKUli4RDuMJSeTZ9Zu1Bu8vrtUAAbafDfBtL21fdAwzJ0DsFHgCO:tFUSKUBNXJSe/ZCBjRIbarfBx21Rt0A2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047456, "uuid": "6e1aca69-c54e-4530-9a9c-9bd8c78f368b", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047456, "uuid": "ce17fe14-020c-4f1a-9692-8c2fc6486a7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047456, "uuid": "43aff1b2-22be-4b89-8ab3-442c855a54d0", "value": "project order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8ea1c0-71fa-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698102927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698102927, "uuid": "eac788a4-9025-4d95-acb6-cbdc9e5ee5db", "comment": "Malware payload (Amadey)", "value": "c255ba3e69b8b4c17a865ac2c3a8d4ff", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698102927, "uuid": "5fcf3429-98b8-424b-a05d-0224a7f31df1", "comment": "Malware payload (Amadey)", "value": "f2179eb340691661b6e8b8a81b8cbb475020deda09b5e7be12770eef5ff3ea6e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698102927, "uuid": "cf19979b-e773-49fb-bdc8-d8e84ffe2a10", "comment": "Malware payload (Amadey)", "value": "9b184dce4559aaf33b79f22c6e7e66766a340a29", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698102927, "uuid": "c80453fd-e20f-42b0-93ec-8b08e61b9cc0", "comment": "Malware payload (Amadey)", "value": "385818a818610f1dd9be4470478f2250440b3f5dbcb799a38a50a89518774a376d39956a4d8884b5f1b1f2c23db3dbe1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698102927, "uuid": "c9204c55-ae3d-4c8a-8254-61c0837d1075", "value": "T1857523D2D7E964B6D8B3177114FB02932D36BC92A4A693BB3790580E0CA258474717FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698102927, "uuid": "502dcd2a-775f-479a-b617-a292f50e667d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698102927, "uuid": "aab4e3ca-86ea-45f7-9fdb-2cecb5ff8149", "value": "49152:RHvyS+lGBQ8KwwWy6ntoy3yE+qeka6vnkfEQ0:BvalGHKWNnf9Jeh6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698102927, "uuid": "482af431-25d6-4a51-929d-b3bcab0ab2f6", "value": 1586176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698102927, "uuid": "16e9c08e-eff2-42f1-887e-688463ebcf17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698102927, "uuid": "4eded936-d27c-4ebb-ba90-b1339ebbed92", "value": "c255ba3e69b8b4c17a865ac2c3a8d4ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd02432-7177-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698046717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046717, "uuid": "2858ac46-b6c0-47fa-bd00-7efbab9298df", "comment": "Malware payload (AgentTesla)", "value": "157910b4d9be2c2bf3119ad64aa8fbff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046717, "uuid": "4c92b554-4fb6-401a-a2c2-03494adcf7f2", "comment": "Malware payload (AgentTesla)", "value": "f27cf1250a55bb3435ce7f02598e15f981f09e6d0735cb06c253c535f7626d8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046717, "uuid": "3a2bff74-70a6-4cdf-b5e6-349b6a1a36ed", "comment": "Malware payload (AgentTesla)", "value": "82e996e20c263b28f819b3c33a29a753e654d8a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698046717, "uuid": "cb2c7599-67ad-4ac2-8b7c-07b7dee7458f", "comment": "Malware payload (AgentTesla)", "value": "35f74423b8dd1f64fa9cfd885966612f5364353688d6cb5af559f7ba1ca9c7fb39143c6480babffb7fc8071dcc88d2b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046717, "uuid": "5f2f9d2d-acaa-4cb4-9911-9a59cde717cb", "value": "T1F635DF4172A0988EE0D31AF69C7ED1A052B17D5F9121CB0DAE42EA2E74FE3C355D235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046717, "uuid": "19cd108a-2c57-4698-bb1d-7696efc1ba92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046717, "uuid": "616d2c32-4fce-4a20-a5c0-11ad5744d387", "value": "24576:enZLJJu2+Ig/+gCrvXaIeOgHEB3ngzd8:aZdJ5BKRmoOgHSgzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698046717, "uuid": "17618fe2-6b8f-4b1c-9ae4-cafbea473d02", "value": 1066496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698046717, "uuid": "fc337797-95b4-4a52-8987-07ac383cdf58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698046717, "uuid": "dfd061d2-4d65-405d-ad21-d19250445fd3", "value": "MACHINE QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cabe61ad-718b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698055571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055571, "uuid": "864cd4c3-f9af-47e4-9bc1-010b1039b634", "comment": "Malware payload (AgentTesla)", "value": "301d8e59de0ff0d9bbb436169314ef99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055571, "uuid": "2d0c4f2a-b4e2-488d-aa10-6e1fd3387a8b", "comment": "Malware payload (AgentTesla)", "value": "f34f9a04e2851e35cc9e6fa91ffd6ffa40cdcb9794e32aa99b5aadfb31e2af05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055571, "uuid": "d99542b8-df94-4ca3-bb5c-991d82d0a426", "comment": "Malware payload (AgentTesla)", "value": "79f124b08135fa5f05b371ac9f3c90b279bdbfc1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698055571, "uuid": "c75a8633-af0d-4687-9680-67fc8498c2b6", "comment": "Malware payload (AgentTesla)", "value": "617de715ef54ad03fa2e851e33dfb0932e2acc65f508503c9fd5d9f046a22f5c2ad94b7b288be4f10389ab7e1b467925", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055571, "uuid": "388de76e-5fa4-47a7-885d-579095fcb2fd", "value": "T1EDC42389317321FB283DB1116DE797BB4E76A25340786F08C5769029D788CAD89CCEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055571, "uuid": "01018c6c-227e-418d-bd89-05bda94c1c78", "value": "12288:Yjzbmh4r0nNc0pEHGOF2M4d8NBkWpZ6/e7Y4QiMjFKA+9MOD:0mhY0nxeHrNKWC/kY4AjJ78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698055571, "uuid": "780cb185-fd7e-484c-af5d-f3a27baa22b0", "value": 571228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698055571, "uuid": "9800c674-026c-4ec7-81ea-8a5b349064c3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698055571, "uuid": "31431c2c-259b-4e38-adf8-d93ac0e353dc", "value": "PAYMENT SLIP.pdf___________________________________________________________________.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f71201-7179-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698047770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047770, "uuid": "7728a85a-e477-4946-8f9d-45a152d2661f", "comment": "Malware payload", "value": "cd3801a44fe095fe83e2117a961b9e40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047770, "uuid": "c8dd2e87-b0e8-47d4-b72b-2de6b682747f", "comment": "Malware payload", "value": "f3b237c64d8b200d410cf552edb90f466b25f08ee578a2ed5136c9797454cfbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047770, "uuid": "9418da17-35e0-4aa2-8f33-d9bd2f66c524", "comment": "Malware payload", "value": "7aa0d34c8cecef945bb05b71d61d4ef6f262740a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698047770, "uuid": "c19ca4a8-2505-4554-b97b-38553cba87e2", "comment": "Malware payload", "value": "0e4cb140b9cd9e6fe9386a83012eabf416bd957d67918f0f841b253e0bcb80c25b65798dd0bb5103e9b6e6c21ddae1d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047770, "uuid": "ab58f283-d188-4ff4-b7c5-e53a6c742193", "value": "T13C63491CA3CCEA12C768697DA5F2517603F9E1B7250AF34F5E8052A52D83BE1491AF83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047770, "uuid": "8571d29a-9f18-46a2-891f-2b69c982e052", "value": "1536:vlzl8u0ucJfiSMAGllIhReOdpo2RnNJz9LKvv1I:NZp0uIa1ApxLnNtJKX1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698047770, "uuid": "471e426b-e588-467b-bd98-d0958493691d", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698047770, "uuid": "84a702b4-6c6a-41de-8c4c-1d1c27885c09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698047770, "uuid": "90f1fc82-5732-4f06-8cf5-326982583e32", "value": "New Design parts.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7366f282-717a-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698048123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698048123, "uuid": "041ceab9-b021-488f-997a-b941ba77de8d", "comment": "Malware payload (GuLoader)", "value": "fd9f257ede4256e537566a2588c025b4", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698048123, "uuid": "06b6082e-c940-4e7f-8f48-3281fcc5462b", "comment": "Malware payload (GuLoader)", "value": "f4815b87e81d4b6371326db31b0cb71d201d774f4fca8e866692768030fff729", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698048123, "uuid": "ffd86e1f-6eeb-446b-a052-f60bbf42a392", "comment": "Malware payload (GuLoader)", "value": "ac08110a794c0d073c070a31d26dad8b01fb9b1f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698048123, "uuid": "ee9da819-441e-4ced-b96e-bce3b3a9da6f", "comment": "Malware payload (GuLoader)", "value": "1c6c7c31f5e99734147a8d534a19c906c96ed821d8b19574adc21f3193c79c2025d5294cf9bd1317155df31e0de09b37", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698048123, "uuid": "d8d98b8a-86c9-436a-82ab-d1fcbdf32984", "value": "T1BE927CE6DF07095A4A0727D6FD41C95A9D78961693760128FFAD038EA30A48C833DF6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698048123, "uuid": "b2a5ce14-6bd1-4e51-a7ab-89410c23b1a4", "value": "384:jwZrIvxXwh6QnSuFehpKfI6SwJbVNDlJD/vWEMFWmqFs9FFZlE+vg:jwZ4g4HuoCRh1lh/vW0mlfVEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698048123, "uuid": "54de3f92-ee8e-4efc-9589-484a08a10ced", "value": 19751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698048123, "uuid": "259b15a9-459f-432a-9a86-999a5d3e54c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698048123, "uuid": "9f49639c-4778-4ffa-a223-d13f23fba35c", "value": "PT90490 Solicitud oferta DISELECTRIC SIEMENS 10_23_2023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee5f28f-71f0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698098903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698098903, "uuid": "fa08863d-2070-4048-bb1f-4d8abd542c11", "comment": "Malware payload", "value": "6fb977bed7ec8c806f4b4f6793c487f0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698098903, "uuid": "f9e40c0f-2efe-4ab8-a143-d9532e768bf2", "comment": "Malware payload", "value": "f4f02fa577c6f391afde55b6972139e08710dd2b67e690e2d36e1b68bd1e559d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698098903, "uuid": "8420aa26-3f40-4940-b653-6a5b964efef0", "comment": "Malware payload", "value": "28eff19d3bffb8c3f33ecced2a273756ed82a655", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698098903, "uuid": "731a20a4-1f6e-47ea-906b-65fa4b4b3e17", "comment": "Malware payload", "value": "3c39c63b49e03aa7f85ea5fd90bbcb9e60e36b043b8fa381c1ac77328d04ba8b8939e7dcc762ff8410e4a05197a5409f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698098903, "uuid": "f8bae002-8994-45ba-99af-a252da1633ce", "value": "T16105220C374F5E40CB582579E4A044CDE7FAE2ABEA51F34A1AED73786082AC1516D7E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698098903, "uuid": "8c7521d5-011a-4f29-81d5-0c0b15cf5263", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698098903, "uuid": "9c37f740-4896-4ad0-a595-02743dd0cd37", "value": "12288:Dg81b10xu3b3JPZk10MPSe4YNaOKNDP4Q1SZ/8RQWE82kQqI0SEphlTOHdej90Cq:1b2xMVexEOKNj88REJqjz6H4x2qY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698098903, "uuid": "577b10ca-8be2-4131-9285-39c5aaff0377", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698098903, "uuid": "23195e4f-f65a-4f25-bf13-4a1c29b90673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698098903, "uuid": "0ae7aad6-c237-4fe3-96cb-f0a9a59a6de9", "value": "0001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828c1539-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698057597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057597, "uuid": "30a2f810-e8fd-4cd3-8cb1-9e68a7549e7d", "comment": "Malware payload (Formbook)", "value": "fc633c4e726243e07d8a1c28c67de8af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057597, "uuid": "80587cf7-2e56-4021-992f-d448e3fe68f0", "comment": "Malware payload (Formbook)", "value": "f66b4cbcde98ac876118266f3b3456ef620d94f6cd99468cbd7d7d803e2edf6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057597, "uuid": "0a534c2a-f352-461e-bc9e-42a067286aca", "comment": "Malware payload (Formbook)", "value": "fb8aabd321f6d13d6258b06b497b724e241f9d2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057597, "uuid": "8b684ebc-2127-47e9-a722-a11799353363", "comment": "Malware payload (Formbook)", "value": "bc831e00d3e9534b78cc69bfb7071309c7e78307f81818298aadf42fe32c419f8ecc23ee9b0f4e3ca7d3aeafce1416d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057597, "uuid": "cdddeffe-5a12-4982-a23a-096c1b8a4072", "value": "T161C40182B3984B62D8AE47B18425C631E73065186C63DEB0CC859ED7B6D9B131DAFCC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057597, "uuid": "46134a73-079b-4155-b3d0-2c3556959510", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057597, "uuid": "bfc30642-80e1-43b6-b995-6b492171753b", "value": "12288:qYq7XFwyqW2DXV8iJJUMLvJJlNDnhBGMl8StoHTy0xMh+zT2bDnoGn:qY8XV27eOJFvhSmIM4P2nT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057597, "uuid": "cb91d89a-b1ed-48b5-9e26-1d52cb2c63d4", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057597, "uuid": "ac98ac36-ea00-4723-a682-3691edd23388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057597, "uuid": "b5c2921f-c6c7-4dfe-910f-d6b725769707", "value": "doc 202307688990001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5075b2-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698057610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057610, "uuid": "68f0f78d-d8e1-4074-941a-813918fe0a4b", "comment": "Malware payload (AgentTesla)", "value": "233285caa7336b8861a8794f7c19d2d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057610, "uuid": "d0de1187-1e71-464e-933e-b1ec58038b47", "comment": "Malware payload (AgentTesla)", "value": "f695583efa17f06a36917be7fb79ec389f1e28a12cb27129e0bbe6f6180e5ca6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057610, "uuid": "03af3b78-bd4c-4b12-8497-bd3bb935da0e", "comment": "Malware payload (AgentTesla)", "value": "ba03b9432f22e0c8152fd6ebcefa4bdbf922546a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057610, "uuid": "129938b9-b9c8-4011-b596-e2aecac324bd", "comment": "Malware payload (AgentTesla)", "value": "0dc748e9406a0a37476d8e039231f1cee0c6d7d3a3dfd075f458e679b4a49a9f9cc2eec1b49d2a0c2d392d3640477153", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057610, "uuid": "8a09be57-2fc2-4ea4-b090-0ec1d7c0695d", "value": "T1D4D4238454D39772F451CEAF3A674FC8B8A76FF982110407BEA57246E01DE29F6FA600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057610, "uuid": "bdf9f33f-690a-4c81-b48f-59e266b48c5c", "value": "12288:heLxDc8KljhirR08qZBsUGGMhjIM9AoPYa19ksJzRrhE5dangp/11Sa:2cFER08JUGZKDO19ksxgengIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057610, "uuid": "50bf52d6-d91a-4766-9d1a-4c2c01b415e2", "value": 615680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057610, "uuid": "34613a59-2d5c-4e89-8388-5c76ff481f33", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057610, "uuid": "f8c81a4b-4d22-4b4b-9846-bba67be7aac3", "value": "Invalid Bank Details.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78540572-71fb-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698103536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103536, "uuid": "184d04f5-e4a3-417d-aa09-1b8e9d746ae3", "comment": "Malware payload (AgentTesla)", "value": "f7d517b9cb937a81c473f12c84e69820", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103536, "uuid": "94d8657f-aa48-4e48-b2f3-a9b5ed7c4fe7", "comment": "Malware payload (AgentTesla)", "value": "f71ff54bd250d1bde0328accdde7d6fd91753aef80eb3a29f5bd5b1596083f03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103536, "uuid": "b88c760b-9b23-49b5-8f17-b32d47847e11", "comment": "Malware payload (AgentTesla)", "value": "d3fba7e0f4121e56fc8ac06b242dae0704b9b056", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698103536, "uuid": "9edcd5d0-00a8-4178-bf9c-26acdfd47669", "comment": "Malware payload (AgentTesla)", "value": "69ad1832282c1b3769f449386563559d68000a3b536d22fc62df140443b0c92580ac3e7371364f1c787ba1c6cbab71f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103536, "uuid": "7dad3e28-eb5b-4967-b566-a4d3de26ba5f", "value": "T1B7658D495F4AEA13CD100271D496C6F72A09DE9F9717A3336BECBDB331873885688399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103536, "uuid": "6ac6b4a4-723f-4c29-b614-68e148c2659e", "value": "24576:NJw+jqObbKGdxzYqhf9VMM+YzdtCExxi14:zw+GObbKGHp5MM+odtCEni14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698103536, "uuid": "bf76edbb-2551-4f1c-84d2-1520ed9fd0c3", "value": 1458176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698103536, "uuid": "3f1dde54-cab0-4f1c-84a0-9e4c33a52586", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698103536, "uuid": "5d149f65-0a8a-4265-98d4-557ebd2aa9e2", "value": "n459_2023.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcce386-71af-11ee-8907-42010a9c0042", "comment": "Malware payload (AZORult)", "timestamp": 1698071118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071118, "uuid": "6bfeb89e-0097-4dee-80b5-653ef099483b", "comment": "Malware payload (AZORult)", "value": "a79062799aced4dd8fc1768b926cdcda", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071118, "uuid": "fc3a3137-a004-4a56-8e38-b59ec8fb9f67", "comment": "Malware payload (AZORult)", "value": "f7e8e4b2e30621f7ff042c3a42a77ef7e25e75d2c3ad265833198e5b374c24fe", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071118, "uuid": "385d8de6-aeb2-41d3-9502-33c841c2ebee", "comment": "Malware payload (AZORult)", "value": "94773be10ae633dd40b7b880247c03664719cedf", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698071118, "uuid": "f811cf11-fdb4-436f-8ff1-d8375ff71116", "comment": "Malware payload (AZORult)", "value": "6e3b6ae0f5d1e1532e62b43c883e247201886f2beede6179b3b9bc5ef331cbcd4bf0850f8338383a83928dd84d431719", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071118, "uuid": "0d34b288-666b-4d8d-b796-19c78c2639fc", "value": "T1BA5523248D40DE22E6E5163396640FFF15226C0F96496DB7039C7E4C767A182BF2E3DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071118, "uuid": "72fbddce-f893-46bf-9653-999940f61b02", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071118, "uuid": "d237d7e8-168a-417e-bcba-5348bc4c8229", "value": "24576:4+DHq+nW5pgR67xiegibLL9WKgILf+wNE1r1tdRadUfuEYpqpB99fv0Ooc8:LLLW5pZ7kedbLLbb+wNMtzadSudpqTbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698071118, "uuid": "fcedfe64-e03b-44df-9dba-bc31d9ccdd00", "value": 1303888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698071118, "uuid": "c648a0b6-9676-47fd-8ab6-b07461af31f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698071118, "uuid": "2b4cd1e3-4041-4939-9728-eb7d32228754", "value": "Myrosin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9e621c-716d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698042712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042712, "uuid": "03eabf0d-d899-40e5-960f-288b6187d9ab", "comment": "Malware payload", "value": "881253af978601784bd5cf1041260f2e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042712, "uuid": "3ff41534-62be-44ce-ac12-5da2614ade7e", "comment": "Malware payload", "value": "f861f2f92487efd93b8d82800bd0bab8e74e82ee95a6aa34457c5a9fe25f490a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042712, "uuid": "b4528cde-179c-41d5-a99a-8e2a1e3e32d3", "comment": "Malware payload", "value": "a97a25b306ffc124e689d64a89f08561b553c14a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698042712, "uuid": "423729c8-1857-47b8-a910-a3560f0eee2b", "comment": "Malware payload", "value": "ce397a3ceef57ec795bbf291b1e84b38c5f2794bc2a8df1193f9b79cdab63f811f9512dae0dc8f6877981205cd566aa8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042712, "uuid": "ac5994ee-9cc5-40d5-b6c5-4d7acc5d251e", "value": "T1F563AF37B9A281F7C159037424E15B3B9E7FAA110AD288938FA89D556F316F1D23B307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042712, "uuid": "fd9ee650-f9bb-4723-b6c7-7cce024b108f", "value": "ae48e5acdf579825991fb2f931fd0cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042712, "uuid": "77db5350-3bfc-4d0f-821d-b69684a4c0d7", "value": "768:+oiGAxMTMbi/JALlKJQOIl/EiwvlnkBDnSrTiB9FJTkx8cttge2Ba8:D2MTMbcmON3kBD8+aLtVf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698042712, "uuid": "5662592b-4f51-48f9-a607-6895b3c8d30f", "value": 67679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698042712, "uuid": "7e20f41d-83fb-42ad-a3aa-572c4f3dcaf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698042712, "uuid": "2f9f0ae0-5ab8-4bc7-a4de-26494aedb0bb", "value": "SecuriteInfo.com.BackDoor.Attack.787.17773.21365", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcfe7473-7197-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698060755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060755, "uuid": "4b7fd24f-81d2-441d-8435-4f1db38946f3", "comment": "Malware payload (AgentTesla)", "value": "32574ddd8e15878cffac0cce7754d9e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060755, "uuid": "83dcc2af-98d6-494f-bde6-946c1d174232", "comment": "Malware payload (AgentTesla)", "value": "f8843027fb160fc3fcdc633e81c03d1e9092f2e2239a7b6b88ca12474e8eead4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060755, "uuid": "201f6361-4a5f-4a2f-9326-324e1af6036f", "comment": "Malware payload (AgentTesla)", "value": "1c4587ffe6d81c2d61c4a06c6d77c22ff211aeb6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698060755, "uuid": "4ae697a1-3825-4678-9722-02cf20767ff9", "comment": "Malware payload (AgentTesla)", "value": "d62010e2ae60710552542e90b574a9a2b92e5982bfc531854242f4b9f987d8e15cb141c5eb970bbaa58208aba1a24fb8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060755, "uuid": "574d6b22-7f47-4e15-8a61-698a84d5ad5d", "value": "T1D1D4237D4005D2DDA0582B99CCF818E3DDAA55F9EE5BA4F885385C90CE2EC930BAD7C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060755, "uuid": "2cbf60b5-2fdf-45f6-9468-1dd9de83517e", "value": "12288:FYDdQPDRPYC/ff5lfPexb50J8icuQhhqZnmfKuSvzTknV:quDHDPeb0qicuOmmgUnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698060755, "uuid": "2d4b1f86-ec91-4e06-a1eb-52ea0c63b31a", "value": 644244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698060755, "uuid": "2329e13e-f0c0-4883-a12f-1634b1788ee1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698060755, "uuid": "dc9f227e-903a-4f81-afa5-cae88985341f", "value": "HSBC Payment Advice_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39074415-715e-11ee-8907-42010a9c0042", "comment": "Malware payload (TeamBot)", "timestamp": 1698035999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698035999, "uuid": "ac2d4308-83ba-4862-895a-54de6f9e12ea", "comment": "Malware payload (TeamBot)", "value": "55f20f6463212e1dac7a03b134e07b37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698035999, "uuid": "350d5898-e1a2-44b8-bd9f-53b192dea121", "comment": "Malware payload (TeamBot)", "value": "f966c3f9cbad2cc07002c5c23b898ecd0d3ba62e5471017781d2bf8d18dd329c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698035999, "uuid": "8b3f621e-87b1-485d-bc08-b2926d4b9a83", "comment": "Malware payload (TeamBot)", "value": "156645a62c0f2775ddb7355837210de15f10c799", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698035999, "uuid": "6d5ba620-6a8d-4798-bb04-9c04bc205896", "comment": "Malware payload (TeamBot)", "value": "d78e66adfb50985bb25a6f66d18db5d48c53aafb078018150781f1befb593faa9ffed5984a7ad5cbe4b5503562cb6a52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698035999, "uuid": "816f7d51-9c62-4145-a416-17f8146f5cde", "value": "T18A04CF21B6E0D032E06759310970C6A22E7BFCB25B6544CB37A83A7EAE707E15B35753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698035999, "uuid": "376c1f82-50ee-4b17-b5a7-baf1a2cc83fc", "value": "8ea5db4b889f56362e73547d3beef0d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698035999, "uuid": "7abc2f95-373f-49b1-82bc-7ebf5bda3c90", "value": "3072:pyBNbfM6eAackTPxXlsUQytwJ1DEgPYeIxgfn953YAzg3PBX:0unAa9TPhSNytvgPygV5/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698035999, "uuid": "de61b7ea-9f21-444b-8b47-6d764cf94948", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698035999, "uuid": "d1456515-e950-4d90-9a3e-3512d76cf215", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698035999, "uuid": "e0601415-e148-46e0-b8b8-af9b828a4f9a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4001e936-715b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698034722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698034722, "uuid": "001e372e-56a2-417f-a0b2-ad2012403968", "comment": "Malware payload", "value": "cab325ac5de55e2f623564f8fb13f738", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698034722, "uuid": "6a9d4f45-c713-4bcd-b58f-a60793d953e7", "comment": "Malware payload", "value": "fce96ae799d511d622016225fb2149d4d6d637c9e7dcb5554c3bd7e9839a3d8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698034722, "uuid": "02327e27-84f1-41f6-82f0-935f97f98fc0", "comment": "Malware payload", "value": "79e71eb7a01659c3f15f1e5d11ce368c53e3554d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698034722, "uuid": "c1eaa982-2d27-4122-8661-ba72efa388da", "comment": "Malware payload", "value": "e756d494fc9f71f2804329ff2eba093ab36418f26e9a7957202350c34f042358154659305ef5e4b95f14636a655f9525", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698034722, "uuid": "6c02cba7-9e61-4ad7-a42c-3a13350331eb", "value": "T17F33463B674E8A59E759E6BB4149894E4AFCB73E33C140D0B9BCA3703B3D40E4A615B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698034722, "uuid": "f8cd59a2-197f-4598-9157-9a6a331c8dc8", "value": "1536:8Doacqj2C58cdTzAHzDhj0RA6SH++jU+HaRdzyDQAG+:Tacq6zHFEgYiaRdzysAG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698034722, "uuid": "81fa5fe3-031e-4be7-b06b-8d0ba41189a5", "value": 54113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698034722, "uuid": "075aab6e-1ea6-4aa4-bfa4-d81de4568658", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698034722, "uuid": "df861d02-3756-4147-8170-98650eb17fef", "value": "e5538d4150f77fe23836696ea83ad5bca13cec966286cf811b0ed8b7.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e05a451-7190-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698057616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057616, "uuid": "460044f9-ecb6-4bb7-af97-d45a854f5db5", "comment": "Malware payload (AgentTesla)", "value": "bd1d9fd1e232c54f4acda8942d8d948f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057616, "uuid": "0ed2468e-2f88-4157-9aba-54f35c29d389", "comment": "Malware payload (AgentTesla)", "value": "fe2b7ad78d722728b8dbb2749996b8f4b8ba4cd03c7664f6a8a08612ead20a0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057616, "uuid": "a5bebfa0-c205-4eaa-8cdc-f406bb6995da", "comment": "Malware payload (AgentTesla)", "value": "1ea143ae27e4f3a8f40b01226ea89c0318eaa308", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698057616, "uuid": "8fc413b9-ce19-43ae-bad2-157886c5e11a", "comment": "Malware payload (AgentTesla)", "value": "d710cbf0b4ecb923f68f4df44fce0e45e9ae2ec7e3c928103cf8e8717eba5894832b00c7f635ae1a75d46a518d29040f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057616, "uuid": "b65b3ac2-098b-4e76-9c09-a3d59d1a9c87", "value": "T117E41290717E2B6BE87E57F25C16780227F1973A2962F206CDDAB0D770A4F101692F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057616, "uuid": "b408c12e-3de3-4816-8afa-377865555735", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057616, "uuid": "981787e7-c2d6-4833-92f4-26aa8a13844d", "value": "12288:ivor/GHOWMG6ITc4pPloLqnga3lTW/JHod844zYM0RStcjPNX3:ivoruuWMG6YZPiGJ1ToJ48vY/RS+Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698057616, "uuid": "8bcf8739-c173-4508-a7c1-139e3f16e3a8", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698057616, "uuid": "31bcdad2-306b-456f-9e87-8d4dcb478031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698057616, "uuid": "10ac5e3e-e58b-4e37-82e4-0b1e3ba4642f", "value": "uDTrS7GPboXX7u0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67ef170-716f-11ee-8907-42010a9c0042", "comment": "Malware payload (STRRAT)", "timestamp": 1698043538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698043538, "uuid": "11c65657-a31a-40d1-94a1-3dfb6fd8f195", "comment": "Malware payload (STRRAT)", "value": "333a9414bf9a3a929bccae9e9e6c31e2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698043538, "uuid": "56848e41-e132-4e6d-9afe-9252724c3837", "comment": "Malware payload (STRRAT)", "value": "fed69483c65124aaa131a3fb4e99508ee0497b7672811349bbe541f541df5362", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698043538, "uuid": "301f1da2-4eb4-4ee0-b809-20010f575e8b", "comment": "Malware payload (STRRAT)", "value": "80f0949ca74c2b9127070691e1dd67dd82027f54", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698043538, "uuid": "c08f1744-2790-43af-b3c4-78c2fe98ca69", "comment": "Malware payload (STRRAT)", "value": "a6f2de893ff54bce7f68a6364c2c46b42f80fa943bb45cda9b20f40e393ae2ef5fc3494af69cf6213d6a4e50c0e66af2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698043538, "uuid": "9a2eabff-ef0d-44dc-a8d8-a175e1e0111c", "value": "T121745A0BB9CC0E95BA78600441EFD396E2BD890D641CA44EBF637F1F6E62EC94D12346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698043538, "uuid": "d368d305-056e-45b0-b767-307b91869336", "value": "6144:rCgNHBY/YrwRjVPL6tzp9eAtDelFpn9JG534vPcV1z7uPmdSmMBpA0Q:u4qYreoUKD4TG9APg3/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698043538, "uuid": "380b2e12-f4f2-4ff4-9f53-1c4284c492c7", "value": 358106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698043538, "uuid": "6a209e8a-86c7-4bdf-b95f-6b40583106b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698043538, "uuid": "30e47ee4-778c-45da-b592-8993389d5532", "value": "Urgent Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7409b919-718e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698056714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056714, "uuid": "c1321381-5b2d-49bf-b5d1-2fa6f1564143", "comment": "Malware payload (AgentTesla)", "value": "a81dac5a180de2d7ed4cf3ae3d8e4d49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056714, "uuid": "a97032af-fb3b-41c9-9c2a-a670af40aeb1", "comment": "Malware payload (AgentTesla)", "value": "ff7cea1471a8650fec0cf17b7006d68320702939027341f922389672bfe88115", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056714, "uuid": "f42263ae-6381-4db9-b7d3-6d603288d2c6", "comment": "Malware payload (AgentTesla)", "value": "a5181674a4cfc5db0348c4ca88e09acc0907bd49", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698056714, "uuid": "eee4eb1b-d665-46fc-a405-7fc8a85aeca8", "comment": "Malware payload (AgentTesla)", "value": "c30ca6581d770d49ea620a2a012d99bc24dc8e214af5ca561c4041d2ab130a4f8c2a975e79a9a00c0b00acaca0aa8b5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056714, "uuid": "27de8e16-0c76-4b45-92b1-998b48f6807e", "value": "T13E65330DB28C5B03EB79887E25ED811A43FB51D36170E3194AC2E8A05F977FB6E04597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056714, "uuid": "34927345-5883-4d5b-af6c-75f8169ef97b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056714, "uuid": "e0c07ba5-4197-4f11-8332-6692506b43e1", "value": "24576:8HpridmYG0nyfGhciuoNbC94SPQCfBAaaSYBG2YliG9DbX:eramqu79XoCfBDYBGMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698056714, "uuid": "a53832c6-ba32-4b77-af91-4e3c774e49be", "value": 1424896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698056714, "uuid": "d5cc7b7f-fe4a-47b6-9dd6-650b8a013794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698056714, "uuid": "6a7937cd-127f-4d24-9ad7-c1a7711e5b1f", "value": "Zamowienie_nr_SA_2110232023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }